Semgrep
Analyser that reads your code at rest and flags dangerous patterns: hardcoded secret, concatenated query, unvalidated input. What sets it apart is its rules, written to look like the code they hunt, with wildcards, rather than as a regular expression or a syntax tree walk. Thirty-plus languages, open source engine, ready-made community rules.
Strengths
- Readable rules shaped like the code they hunt: you can write one for your own codebase without learning a query language
- Open source engine, thirty-plus languages, community rules usable right away
- Fast enough to run on pre-commit, so feedback lands while you are still writing
Limitations
- Static analysis only: no view of runtime behaviour, and none of the auth logic flaws
- Generic rules produce noise on an unusual codebase, you need to triage before trusting the output
Best for
- Developer who wants an automatic guardrail on agent-generated code they do not read line by line
- Team with no security budget wanting to cover the most common mistakes without a vendor