Blog | Security Trends, Secure Coding, and Application Security Announcements

- Semgrep Code
  Find and fix the issues that matter in your code (SAST)
- Semgrep Supply Chain
  Fix vulnerabilities in open source dependencies and block malware
- Semgrep Secrets
  Find and fix hardcoded secrets with semantic analysis
- Semgrep Guardian
  Scan and fix AI-generated code the moment it's written
- Multimodal
  Combine AI reasoning with rule-based analysis for detection, triage, and remediation
- Semgrep AppSec Platform
  Automate, manage, and enforce security across your organization
- Semgrep Workflows
  Build and deploy security pipelines that combine static analysis with AI at scale
- Product Updates
  Stay up to date on changes to the Semgrep platform, big and small
- Open-Source Malware Protection
  Protect against software supply chain attacks
- Static application security testing
  Increase security while accelerating development
- OWASP Top 10
  Prevent the most critical web application security risks
- Secure Guardrails
  Protect Your Code with Secure Guardrails
- Fintech
  Mitigate software supply chain risks
- SaaS & Cloud
  Increase security while accelerating development
- Docs
  Want to read all the docs? Start here
- Blog
  Get the latest news about Semgrep
- ROI Calculator
  See how Semgrep can save you time and money
- Community Slack
  Join the friendly Slack group to ask questions or share feedback
- Events
  Join us at a Semgrep Event!
- Case Studies
  See why users love Semgrep
- Video Library
  View our library of on-demand webinars
- Community Edition
- About
  The Semgrep story & values
- Careers
  Join the team!
- Partners
  Become a Semgrep partner
Pricing
Sign in
Product support
Contact us
Book demo Try for free

Announcing Pyro Caml: A Continuous Profiler for OCaml

Semgrep is open-sourcing Pyro Caml 1.0.0, the first continuous profiler for OCaml, built to run in production under gVisor, sample call stacks via Memprof, and ship data to...

Austin Theriault

Application Security

Mythos: Bad Takes, Facts, and Fear

Mythos is a significant advance in a trend that favors offense.

Isaac Evans

Introducing Semgrep Custom Workflows

Operationalize AI alongside deterministic analysis to automate code security workflows you can build, test, and deploy at scale.

Vivek Khimani Braden Riggs

Accelerate and Automate Remediation with Semgrep Autofix

Semgrep Autofix combines the world’s most popular static analysis engine with frontier-model LLMs to provide contextual upgrade guidance, line-level breaking change analysis,...

Nabeel Saeed Katie Kent

Application Security

Catching IDORs, Broken Authorization, and Other Logic Issues with Semgrep AI-Powered Detection

Built on the Semgrep Pro Engine, AI-powered detection starts with deterministic findings—improving true positive rates for IDORs and business logic vulnerabilities over LLM-only...

Jack Moxon

Open Source

Semgrep Community Edition Fall Release 2025

Semgrep delivers up to 3× improved scan performance and runs natively on ~500 million more machines.

Jaweed Metz Milan Williams

Security Research

Can LLMs Detect IDORs? Understanding the Boundaries of AI Reasoning

Analyzing accuracy of LLM generated IDOR findings

Vasilii Ermilov

Security Research

Finding vulnerabilities in modern web apps using Claude Code and OpenAI Codex

Our deep dive into AI Coding Agents capabilities for finding vulnerabilities reveals surprising strengths, critical weaknesses, and a serious problem with consistency.

Romain Gaucher Vasilii Ermilov Clint Gibler

Announcements

From idea to (secure) app: Semgrep + Replit

Over 30 million people use Replit to turn natural language into production ready code. Starting today, Replit Agent automatically uses Semgrep Community Edition to find and fix...