Semgrep

Semgrep builds static analysis and application security tooling designed to find bugs and enforce security standards with low false positives. The company was founded in 2017 by three MIT graduates, and its work grew out of the open-source project sgrep. Its technical scope spans static analysis, AI-assisted SAST, software composition and supply chain analysis, secrets detection, and integration into developer workflows from IDEs through to CI/CD pipelines.

The company maintains two principal products. Semgrep, the open-source static analysis tool, is built for speed and developer use, aiming to detect bugs and enforce security standards without generating excessive noise. The Semgrep AppSec Platform combines AI-assisted SAST, supply chain analysis, and secrets detection in a single product, intended to help security and engineering teams identify and remediate genuine issues before release.

Semgrep's stated emphasis is on accuracy over volume of findings, on tooling that does not obstruct the development process, and on reducing friction between application security and engineering teams. Organisations using Semgrep include Figma, Dropbox, Slack, Snowflake, HashiCorp and GitLab. The company describes its mission as making it expensive for attackers to exploit software.