Developer-first AppSec, sold and operated by Merito.

Semgrep is the developer-first AppSec vendor that grew out of an open-source program-analysis engine. The commercial Semgrep Code adds cross-file and cross-function dataflow analysis, 20,000-plus Pro Rules from Semgrep's security research team, and AI Assistant noise filtering. Semgrep Supply Chain extends the dataflow analysis into transitive dependency graphs to differentiate reachable-and-exploitable from reachable-but-safe paths. Semgrep Secrets combines semantic dataflow with active validation to filter expired or test secrets out of the backlog.

Semgrep AppSec Platform is the unifying SaaS console where Code, Supply Chain, and Secrets share policy, AI Assistant, and the centralized findings surface. The Team plan bundles all three analysis engines plus the AI Assistant and the dashboard at a per-contributor price. Free tier covers teams with up to 10 contributors and 10 private repositories. Enterprise plan adds higher-volume usage, SLAs, and on-prem deployment.

YAML custom rule authoring is the practical differentiator. Rules look like source code, which makes them easy for developers and AppSec architects to read and write without learning a domain-specific language. Programs that adopt Semgrep without authoring custom rules use it as a noisier substitute for other SAST tools rather than the better one.