Semgrep is an application security company. Its platform scans source code for vulnerabilities, risky open source dependencies and hardcoded secrets, and helps developers fix what it finds inside the tools they already use, such as pull requests, editors and CI pipelines.
It is built for security teams that are flooded with findings and for developers who ignore tools that slow them down. The Semgrep AppSec Platform aims to cut the noise to the issues that matter and put them in front of the person who can fix them, including when the code was written by an AI assistant.
At A Glance
| Vendor | Semgrep |
|---|---|
| Category | Application security (SAST, SCA, secrets detection) |
| Identities covered | Hardcoded secrets such as API keys and tokens in source code |
| Deployment | Platform with CI scanning or Managed Scans, Network Broker for private networks |
| Agentic AI | Semgrep Guardian for AI coding agents, Semgrep Multimodal AI triage and remediation |
| Customers | Lyft, Dropbox, GitLab, HashiCorp, Squarespace |
| Funding | Series D led by Menlo Ventures |
| Market classification | Application Security |
What Semgrep Does
Semgrep’s approach combines AI reasoning with rule-based analysis for detection, triage and remediation, and putting results where developers work. The AppSec Platform is the management layer that lets a security team automate and enforce policy across the organisation, and Semgrep Workflows lets teams build security pipelines that mix static analysis with AI at scale. As more code comes from AI assistants, Semgrep now also checks code at the moment it is generated, not only when it reaches review, so the same policies cover human and AI-written code.
Products
Semgrep Code
Semgrep Code is static analysis (SAST) for first-party code. It analyses across functions by default, with optional cross-file analysis, and teams can write custom rules alongside more than 3,000 community rules. Findings appear in pull requests and editors.
Semgrep Supply Chain
Supply Chain is for teams that need to know which vulnerable or malicious open source packages actually matter. Codebase-aware reachability analysis checks whether vulnerable code is really used, with a reported reduction in false positives of up to 98%. It also:
- Detects malicious dependencies and analyses their impact, including zero-day supply chain attacks
- Produces SBOMs and checks licence compliance
- Supports critical and high severity findings at GA level in 12 languages
Semgrep Secrets
Semgrep Secrets finds hardcoded credentials before they turn into incidents. It uses semantic, entropy and regex analysis, checks whether a credential is still live, supports custom rules for secrets specific to internal services, and offers Git pre-commit hooks that stop secrets being committed at all.
Semgrep Multimodal
Multimodal uses AI to catch logic flaws that rules miss, such as IDORs, broken authorisation and multi-step logic errors. It triages findings automatically using code context, patterns and earlier decisions, and gives fix and upgrade guidance in pull requests and IDEs. Each human triage decision becomes a reusable memory that suppresses repeat false positives.
Semgrep Guardian
Guardian is a plugin for AI coding agents, built from an MCP server, hooks and skills, that lets teams scan and fix AI-generated code the moment it is written. It is live for Claude Code, Cursor and Windsurf. Its firewall blocks malware at the network layer before a package is installed, it catches credentials before an agent commits them, and security teams can define rules that Guardian enforces across agents and IDEs. Teams can also add the Semgrep MCP server or a post-write hook to any MCP-compatible agent.
How It Works
The core deployment does not need access to customer code, and no code is sent anywhere during that process.
| Component | What it does |
|---|---|
| CI scanning | Semgrep runs inside the customer’s CI and supports many popular CI providers. |
| Managed Scans | Repositories are scanned from the platform without changes to CI. |
| Network Broker | Gives the platform secure access to services on a private network, such as a self-hosted source code manager. |
| Secrets validation | To check a token, Semgrep sends a request to the relevant service from within the customer’s infrastructure, and the secret is not sent to Semgrep’s servers. |
| Notifications | Findings go out through Slack, email and webhooks, with an API for custom integrations. |
Identities And Systems Covered
Semgrep is not an identity platform, but Semgrep Secrets addresses machine credentials stored in code.
| Secrets | API keys, tokens and other hardcoded credentials. |
|---|---|
| Validation targets | Services such as AWS and GitHub, queried to see whether a token is still valid. |
| Custom secrets | Credentials specific to a customer’s internal services. |
| Prevention points | Pre-commit hooks, editor and code review alerts, and Guardian checks on AI agents. |
| Source code managers | GitHub, GitLab, Bitbucket and Azure Repos, including self-hosted GitLab Self-Managed. |
Integrations
| Area | Integrations |
|---|---|
| AI coding agents | Claude Code, Cursor, Windsurf, MCP-compatible agents |
| Notifications | Slack |
| Cloud context partners | Palo Alto Networks, Sysdig, StackHawk |
Company Background
| Funding | Series D led by Menlo Ventures. |
|---|---|
| Investors | Menlo Ventures, LSVP, Sequoia, Redpoint, Felicis and Harpoon. |
| Open source | Semgrep Community Edition, developed in a public GitHub repository. |
Note: This overview is compiled from Semgrep’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.