Application Security Platform

What do you like best about the product?

The best thing about Semgrep is its flexibility and speed as a static analysis tool. It allows me to define custom rules with clear, human-readable YAML syntax, making vulnerability detection and code standard enforcement highly adaptable to specific project needs. It integrates smoothly into CI/CD pipelines, providing fast feedback without slowing down development. I also appreciate the extensive public rule registry and AI-assisted features like noise filtering and autofix suggestions, which help improve fix rates and reduce remediation time, making it easier to maintain secure, high-quality code continuously

What do you dislike about the product?

I dislike about Semgrep is that it can produce noisy results with a lot of false positives out-of-the-box, requiring upfront tuning and rule customization to reduce irrelevant findings. This tuning process demands ongoing effort and security expertise, which can create operational overhead, especially at larger scales.

What problems is the product solving and how is that benefiting you?

Semgrep solves the problem of identifying security vulnerabilities and enforcing code standards early in the development cycle through a lightweight, semantic static code analysis tool.
It benefits me by enabling fast, contextual scans directly in CI pipelines without slowing down development. With easy-to-write custom rules and a large public registry, Semgrep helps catch bugs, insecure coding patterns, and deprecated APIs before they make it to production. This proactive detection and remediation improve code quality, reduce security risks, and streamline developer workflows by providing actionable feedback where it’s most needed.

What do you like best about the product?

Flexible, transparent rule engine with clear YAML syntax and data‑flow patterns, plus an extensive public registry for quick wins and customization.
• Smooth CI/CD integration and lightweight runtime, enabling frequent scans without major impact on developer velocity.
• Autofix capabilities (deterministic rule‑based and Assistant AI‑assisted) that propose or apply safe code changes, reducing mean time to remediate

What do you dislike about the product?

Governance overhead at scale; maintaining org‑wide rule sets, exceptions, and updates across many repos becomes an operational burden without a dedicated owner.
• Autofix and AI noise filtering are helpful but still evolving; effectiveness varies by language and codebase, and some teams remain cautious about applying fixes automatically.

What problems is the product solving and how is that benefiting you?

Semgrep is helping embed security into daily development by catching risky patterns early in pull requests and CI, which reduces rework and keeps release velocity high. Transparent, customizable rules let the team encode our own guardrails and quickly add checks for new frameworks, so coverage improves without waiting on vendor updates. AI‑assisted noise filtering and autofix guidance cut triage time and help developers resolve issues faster, which lowers MTTR and helps us meet remediation SLAs more consistently.
Operationally, fast scans and easy CI/SCM integration mean developers see actionable feedback where they work, not in a separate portal, increasing adoption and fixing rates. As a result, we’ve moved from sporadic security reviews to consistent, automated checks across services, with measurable gains in fix rate and fewer high‑risk patterns reaching production. The net benefit is stronger secure‑by‑default practices with minimal productivity tax, plus lower compliance risk thanks to policy‑as‑code rules we can audit and evolve over time.

What do you like best about the product?

I appreciate how Semgrep excels in validating and QA testing capabilities, showing good efficacy in performing these tasks. The ease of use is particularly notable, requiring less scripting compared to other alternatives, and the initial setup process was straightforward and effortless. I value its functionality in conducting functional testing, which simplifies my tasks significantly. The test case design and resulting outcomes are particularly pleasing, enhancing my testing process. Whenever I encounter issues that other tools cannot resolve, Semgrep becomes an indispensable resource, allowing me to progress by utilizing its features effectively. Overall, I find Semgrep a worthy exploration for its functionality and user-friendly approach.

What do you dislike about the product?

Nothing

What problems is the product solving and how is that benefiting you?

I find Semgrep improves my workflow for functional testing, making it easy to use and reducing scripting. It solves problems when other tools fail, helping me proceed further and block issues effectively.

What do you like best about the product?

Semgrep offers a single platform for SAST and SCA solutions which is good, but the best part is semgrep rules they are so flexible and easy to write that you dont need to manually do filtering or removing.
The tool has another feature I personally like is github actions that will show bugs in git itself with an AI reviewed fixed version.

What do you dislike about the product?

Semgrep doesnt have Product wise segmentation like for organizations with multiple products you will have only projects and have to use labels to categorise those products.

What problems is the product solving and how is that benefiting you?

It provides great SCA and SAST solutioning.

What do you like best about the product?

It's a very user-friendly tool for scanning code repositories, and I find it much easier to use compared to our previous Checkmarx scan.
Its quiet easy to integrate with our existing code repository and can also be filtered based on the need.

What do you dislike about the product?

Since we have only recently started using this tool, there is nothing we dislike about it so far.

What problems is the product solving and how is that benefiting you?

Its helping to find out the vulnerability with open-source softwares and implemented in our pipelines for code deployment has helped us a lot to proactively finding out the vulnerability before reaching of any environment.