Semgrep, Inc. (formerly known as Return To Corporation or r2c) is an American application security (AppSec) company headquartered in San Francisco, California. Founded in 2017 by Isaac Evans, Luke O'Malley, and Drew Dennison, the company specializes in lightweight, developer-first static program analysis and automated code governance.
Semgrep emerged from open-source roots, evolving from early code-analysis research and the open-source tool sgrep (originally created at Facebook as part of the pfff toolset). The company develops and maintains the open-source Semgrep engine while offering a commercial enterprise platform—the Semgrep AppSec Platform—designed to help engineering and security teams detect, triage, and remediate vulnerabilities directly inside continuous integration and continuous delivery (CI/CD) pipelines and integrated development environments (IDEs).
Core Mission and Technology Approach
The foundational philosophy behind Semgrep is "semantic grep"—providing the speed and familiarity of pattern-matching search utilities (like grep or ripgrep) combined with abstract syntax tree (AST) parsing and semantic code analysis.
Traditional Static Application Security Testing (SAST) tools often suffer from slow scan speeds, complex custom query DSLs, and high false-positive rates. Semgrep addresses these challenges by:
- Writing rules in native code syntax: Security rules look identical to the target source code, allowing developers to write custom queries without learning specialized query languages.
- Local and CI-native execution: Scans run locally on developer workstations or in ephemeral build runners; source code is analyzed without requiring it to be uploaded to external servers.
- High-speed scanning: Operating directly on syntax trees with inter-file and intra-function analysis allows scans to finish in seconds to minutes, making it viable for pull-request (PR) gating.
Core Products and Platform Modules
1. Semgrep Open Source Software (OSS) / Community Edition
Semgrep OSS is a multi-language static analysis engine distributed under the LGPL 2.1 license. It allows individual engineers and researchers to run scans via a local command-line interface (CLI).
- Language Coverage: Supports over 30 programming languages, including Python, JavaScript, TypeScript, Go, Java, C, C++, C#, Ruby, PHP, Rust, Kotlin, Scala, and configuration formats such as JSON, YAML, and Terraform.
- Custom Rule Engine: Enables teams to define pattern-matching security rules, architectural constraints, and anti-patterns in human-readable YAML configurations.
- Extensible Registry: Grants access to thousands of open-source rules contributed by the Semgrep security research team and the broader security community.
2. Semgrep Code (SAST)
Semgrep Code is the commercial Static Application Security Testing module built on top of the open-source engine. It provides advanced enterprise-grade analysis features:
- Deep Semantic Analysis: Delivers inter-procedural (cross-function) and cross-file dataflow reachability and taint analysis.
- Proprietary Rulepacks: Includes tens of thousands of high-signal rules maintained by Semgrep's dedicated security research team, focusing on OWASP Top 10 vulnerabilities, business logic flaws, and insecure framework usage.
- Inline Developer Feedback: Delivers security findings directly into developer pull requests, code reviews, and IDEs with specific remediation guidance and autofixes.
3. Semgrep Supply Chain (SCA)
Semgrep Supply Chain is a Software Composition Analysis solution designed to identify vulnerabilities in open-source third-party dependencies.
- Reachability Analysis: Unlike traditional SCA tools that flag every vulnerable dependency present in a package.json or requirements.txt file, Semgrep evaluates whether the vulnerable code paths or functions are actually imported and reachable within the application's source code.
- Noise Reduction: Reduces false-positive vulnerability alerts on third-party libraries by up to 98%, enabling developers to prioritize actual attack vectors.
- Lockfile and Package Management Support: Analyzes ecosystem manifests across npm, PyPI, Maven, Go modules, RubyGems, NuGet, and Cargo.
4. Semgrep Secrets
Semgrep Secrets is an automated credential and secrets detection engine built to prevent sensitive assets from leaking into source control.
- Multi-layered Detection: Combines regular expression pattern matching, Shannon entropy analysis, and semantic context awareness (tracking variable assignments and constants).
- Live Secret Validation: Performs non-destructive API checks against target service providers to verify whether detected tokens, API keys, or private certificates are active and valid.
- Pre-commit and PR Gating: Blocks developers from committing or merging active secrets into shared code repositories.
5. Semgrep Assistant (AI-Powered AppSec)
An integrated artificial intelligence layer trained to assist security analysts and developers throughout the vulnerability lifecycle:
- Automated Triage: Analyzes the surrounding code context, historical triage behavior, and codebase architecture to automatically mark low-risk or false-positive findings.
- Context-Aware Remediation: Produces tailored code patches, upgrade instructions, and explanation steps directly inside review threads.
- Organizational Memory: Learns from decisions made by human security reviewers to suppress repeating noise across identical code patterns.
6. Semgrep Model Context Protocol (MCP) Server & AI Integrations
Semgrep provides MCP connectors and dedicated extensions for modern AI coding tools and IDEs (e.g., Cursor, VS Code, Windsurf, JetBrains). This enables AI coding agents to run local Semgrep checks in real time and automatically conform generated code to company security policies.
Services and Platform Capabilities
Semgrep, Inc. packages its software solutions with enterprise platform services, management tools, and support programs:
- Semgrep AppSec Platform Dashboard: A centralized, web-based software-as-a-service (SaaS) and on-premises console providing centralized governance, repository asset inventories, compliance tracking, and cross-team vulnerability metrics.
- Semgrep Registry & Playground: A hosted collaborative environment where developers can test, validate, and share Semgrep rules against custom code snippets before rolling them out across an organization.
- CI/CD Integrations: Out-of-the-box integrations with GitHub Actions, GitLab CI/CD, Bitbucket Pipelines, Azure DevOps, CircleCI, Jenkins, and custom container workflows.
- Security Program & Enterprise Support: Dedicated technical account management, professional rule-authoring services, custom deployment architecture assistance, and security policy engineering for enterprise customers.
Target Audience and Industry Use Cases
Semgrep is adopted across software companies, financial institutions, healthcare providers, and high-growth technology enterprises. Notable enterprise users include organizations like Dropbox, Slack, Figma, Snowflake, and Vanta.
Primary operational use cases include:
1. Shift-Left DevSecOps: Embedding automated guardrails directly into early development cycles to prevent insecure patterns before code merges.
2. Regulatory & Compliance Adherence: Enforcing code standards mapped to SOC 2, ISO 27001, PCI-DSS, HIPAA, and OWASP recommendations.
3. Internal API and Framework Migration: Authoring rules to enforce the deprecation of legacy frameworks or unsafe internal APIs across massive codebases.
4. Vulnerability Backlog Reduction: Using reachability analysis and AI triage to prioritize high-risk, exploitable issues over theoretical defects.
