Blog | Security Trends, Secure Coding, and Application Security Announcements

- Semgrep Code
  Find and fix the issues that matter in your code (SAST)
- Semgrep Supply Chain
  Fix vulnerabilities in open source dependencies and block malware
- Semgrep Secrets
  Find and fix hardcoded secrets with semantic analysis
- Semgrep Guardian
  Scan and fix AI-generated code the moment it's written
- Multimodal
  Combine AI reasoning with rule-based analysis for detection, triage, and remediation
- Semgrep AppSec Platform
  Automate, manage, and enforce security across your organization
- Semgrep Workflows
  Build and deploy security pipelines that combine static analysis with AI at scale
- Product Updates
  Stay up to date on changes to the Semgrep platform, big and small
- Open-Source Malware Protection
  Protect against software supply chain attacks
- Static application security testing
  Increase security while accelerating development
- OWASP Top 10
  Prevent the most critical web application security risks
- Secure Guardrails
  Protect Your Code with Secure Guardrails
- Fintech
  Mitigate software supply chain risks
- SaaS & Cloud
  Increase security while accelerating development
- Docs
  Want to read all the docs? Start here
- Blog
  Get the latest news about Semgrep
- ROI Calculator
  See how Semgrep can save you time and money
- Community Slack
  Join the friendly Slack group to ask questions or share feedback
- Events
  Join us at a Semgrep Event!
- Case Studies
  See why users love Semgrep
- Video Library
  View our library of on-demand webinars
- Community Edition
- About
  The Semgrep story & values
- Careers
  Join the team!
- Partners
  Become a Semgrep partner
Pricing
Sign in
Product support
Contact us
Book demo Try for free

Introducing Malware Detection and Response Automation

Semgrep Supply Chain now includes Malware Detection and Response Automation, providing end-to-end protection during package compromises.

Nabeel Saeed

Announcements

Introducing Semgrep Agentic Workflows: Automate Deep Vulnerability Hunting at Scale

Today we're launching nine pre-built Agentic Workflows that hunt for the subtle authentication, injection, and logic flaws that matter most, covering 70+ CWEs across the OWASP...

Pablo Estrada

Announcements

Introducing Semgrep Guardian: Security for AI-Generated Code

Your fastest growing attack surface is your AI agent. As AI writes more code than ever, AppSec teams are seeing 10x the vulnerabilities and traditional gates can't keep up....

Milan Williams

Announcements

Announcing Pyro Caml: A Continuous Profiler for OCaml

Semgrep is open-sourcing Pyro Caml 1.0.0, the first continuous profiler for OCaml, built to run in production under gVisor, sample call stacks via Memprof, and ship data to...

Austin Theriault

Application Security

Mythos: Bad Takes, Facts, and Fear

Mythos is a significant advance in a trend that favors offense.

Isaac Evans

Application Security

Catching IDORs, Broken Authorization, and Other Logic Issues with Semgrep AI-Powered Detection

Built on the Semgrep Pro Engine, AI-powered detection starts with deterministic findings—improving true positive rates for IDORs and business logic vulnerabilities over LLM-only...