Semgrep Community Edition Fall Release 2025

TL;DR: 

Semgrep Community Edition’s latest release brings two major upgrades:

• Up to 3x better scan performance on large repos with our brand new memory-efficient multicore engine

• Native Windows support (no WSL required!) making Semgrep accessible to ~500M more developers

Simple. Fast. Open to everyone.

Semgrep is an Application Security (AppSec) platform built to help developers and security teams find and fix code issues early without slowing them down. At the heart of it all is Semgrep Community Edition (CE), the community-powered tool trusted by millions of developers worldwide. Semgrep CE makes security scanning free and fast across dozens of languages, so you can catch real issues quickly and confidently. And now, with the Semgrep Community Edition Fall Release 2025, it’s getting even better. 

Whether you’re scanning a small project or the biggest monorepo ever seen, Semgrep CE is ready to run anywhere. With up to 3x better scan performance thanks to multicore support, and long-awaited native Windows support, these updates bring Semgrep to more developers than ever. These improvements are also available to all Semgrep customers, from individual developers to large organizations, so everyone benefits from ludicrously fast scans.

Up to 3x better scan performance for monorepos

Until now, scanning monorepos meant making a tough trade-off. Our legacy engine duplicated analysis across cores, so memory usage ballooned as you scaled. You could increase cores for faster scans – but risk running out of memory – or stick to single-threaded scans and accept painfully slow results. Neither option was great.

Our new memory-efficient multicore engine removes that trade-off entirely. The new engine shares analysis state across all cores, dramatically reducing memory usage while still parallelizing the work. Best of both worlds!

The result:

• Scan larger repos without crashing your laptop or CI runners

• Use more cores in memory-constrained environments

• Same (or better) speed, with far less resource usage, up to 3x faster in our benchmarks

In benchmark repository (secDevLabs), multicore scanning achieves a 3× speedup while maintaining memory usage below 3 GB.

And the best part? It’s now the default.

Run $ semgrep --config=auto (or any of your usual scan commands) to feel the difference. 

This massive engineering effort involved deep collaboration with the broader OCaml community. We’ll share a technical deep dive with more benchmarks soon - keep an eye out!

Our friends in C:\Users\ can scan now (native Windows support)

More than half of devs code on Windows (source), and for many folks, Semgrep’s old reliance on Windows Subsystem for Linux (WSL) made it difficult to get started. 

With this release, Semgrep CE now runs natively on Windows machines, so our start-menu loving friends don’t have to worry about WSL anymore. 

Fire it up in VS Code, IntelliJ, or your terminal and start scanning right away. This unlocks whole new communities — government, enterprise IT, finance — who can now use Semgrep the same way Linux and macOS devs do. 

Built in the open

These updates came straight from community feedback: GitHub issues, Slack threads, and many conversations at community events. 

Semgrep CE stays what it’s always been: fast, free, and open-source security for real developers.

👉 Get started

Install Semgrep CE and feel the speed yourself.