Semgrep portfolio
Semgrep Code (SAST), Semgrep Supply Chain (SCA), Semgrep Secrets, and the AppSec Platform that unifies them. Per-contributor licensing, YAML custom rules, AI Assistant noise filtering, and cross-file dataflow that works across 30-plus programming languages, with Merito writing the custom rules and wiring scans into pull requests.
Why Merito for Semgrep
Semgrep is the developer-first AppSec vendor that grew out of an open-source program-analysis engine. The commercial Semgrep Code adds cross-file and cross-function dataflow analysis, 20,000-plus Pro Rules from Semgrep's security research team, and AI Assistant noise filtering. Semgrep Supply Chain extends the dataflow analysis into transitive dependency graphs to differentiate reachable-and-exploitable from reachable-but-safe paths. Semgrep Secrets combines semantic dataflow with active validation to filter expired or test secrets out of the backlog.
Semgrep AppSec Platform is the unifying SaaS console where Code, Supply Chain, and Secrets share policy, AI Assistant, and the centralized findings surface. The Team plan bundles all three analysis engines plus the AI Assistant and the dashboard at a per-contributor price. A free tier covers teams with up to 10 contributors and 10 private repositories, and the Enterprise plan adds higher-volume usage, SLAs and on-prem deployment.
YAML custom rule authoring is the practical differentiator. Rules look like source code, which makes them easy for developers and AppSec architects to read and write without learning a domain-specific language. Programs that adopt Semgrep without authoring custom rules use it as a noisier substitute for other SAST tools rather than the better one.
A Semgrep program is mostly rule work. We design the policy, write custom rules for your internal coding standards, calibrate Pro Rules and AI Assistant Memories, and move scanning into PR-time CI/CD and the IDE. Then we stay through the false-positive reviews, which are where developers decide whether to trust what AppSec sends them.
The Semgrep toolchain
SAST, SCA, and Secrets detection from a single vendor with shared dataflow analysis foundations.
SAST
Static application security testing across 30-plus programming languages with cross-file dataflow, 20,000-plus Pro Rules, YAML custom rules, and AI Assistant noise filtering.
SCA
Software composition analysis with dataflow reachability through transitive dependency graphs. Differentiates reachable-and-exploitable from reachable-but-safe paths.
Secrets
Secrets detection combining semantic dataflow analysis, entropy, regex, and active validation to filter expired and test secrets from the backlog.
The AppSec Platform that consolidates the analysis engines under one policy plane and per-contributor licensing.
Unified platform
SaaS console that unifies Semgrep Code, Supply Chain, and Secrets under one policy plane. Per-contributor pricing and free tier for small teams.
Merito services
AppSec Platform tenant setup, SCM integration onboarding, Pro Rules calibration, custom YAML rule authoring, and AI Assistant Memories configuration.
AppSec program scoping for Semgrep adoption alongside Checkmarx, Snyk, Black Duck Coverity, and OpenText Application Security.
Semgrep gates on pull requests, IDE plugins, and findings routed to developer tickets, whether the code lives in GitHub, GitLab, Azure DevOps or Bitbucket.
Developer-facing AppSec adoption, custom rule authoring training, and AppSec champion programs.
Named engineer, priority SLAs, and release-window coverage for Semgrep programs Merito implements.
Custom YAML rules maintained as the codebase changes, Pro Rules recalibrated, AI Assistant Memories retuned, and triage ownership adjusted as teams grow.
YAML rule authoring for AppSec architects, AI Assistant Memories for security engineers, and reading Semgrep findings in the pull request and IDE for developers.
Engineers fluent in Semgrep rule authoring, placed inside your AppSec team for as long as the program runs.
Semgrep licensing
Most Semgrep value comes from custom rules and AI Assistant Memories written for your code. Small teams can start on the free tier and move up as contributor count grows.
Active development
Fresh analysis of recent Semgrep releases, reviewed by Merito as they ship.
View all product release updates.png&w=2560&q=75)
Semgrep October 2026 adds Semgrep Guardian support for Codex and extends controls for AI providers and Agentic Workflows. It also improves GitHub integration reliability, exposes Autofix results in the findings API, and fixes scan, secrets, and workflow execution issues.
Semgrep’s September 2026 updates make AI-assisted development scanning more visible to release owners by showing Guardian setup, scan results, sign-in requirements, and server errors directly in supported AI coding agents. Teams can export Agentic Workflows issues through CSV and the public API, while fixes improve branch accuracy, repository attribution, and branch-check reliability for private connectivity. These changes help enterprises produce more dependable security evidence for AI-assisted delivery.
Semgrep’s August 2026 update introduces structured, searchable Agentic Workflows logs and improves source-file links when SCM connectivity fails. Organizations using current Policies should plan for unified policies migration beginning August 24, 2026; the existing Policies experience sunsets November 1, 2026. The release also adds breaking_change and full_scan vocabulary to the public beta policies API and updates project finding counts to include Reviewing and To fix statuses.
Related solutions
Semgrep at the center of a program that may also run Checkmarx, Snyk, Black Duck or Sonatype.
AppSec gates inside CI/CD with Semgrep as the developer-first scanning surface.
Frequently Asked Questions
Consultation request
Tell us where the AppSec program stands, which scanners you run and how many custom rules you expect to need. A Merito Semgrep specialist follows up within one business day.
Per-contributor pricing
Per-contributor Team plan, with a free tier for up to 10 contributors and 10 private repositories.
YAML custom rules
Rules look like source code. AppSec architects encode internal coding standards into the scanner directly without learning a domain-specific language.
Next step
Semgrep work opens with an AppSec maturity assessment and an agreed scope for custom rules. Programs that adopt Semgrep without rules use it as a noisier substitute for other SAST tools.