Skip to main content

Quickstart

Learn how to set up Semgrep OSS, scan your codebase for security issues, and view your findings in the CLI.

Prerequisites

See Prerequisites to ensure that your machine meets Semgrep's requirements.

Set up Semgrep

Install the Semgrep CLI and confirm the installation:

# macOS users only
brew install semgrep

# macOS, Linux, or Windows Subsystem for Linux (WSL) users
python3 -m pip install semgrep

# confirm
semgrep --version

Scan your codebase

Navigate to the root of your codebase, and run your first scan. The specific command you use depends on how you want to view the results.

To run a scan using recommended rules for your programming language, and view the results in the CLI:

semgrep scan

To export the results to a plain text file:

semgrep scan --text --output=semgrep.txt

To export the results to a SARIF file:

semgrep scan --sarif --output=semgrep.sarif

To export the results to a JSON file:

semgrep scan --json --output=semgrep.json

Scan your codebase with a specific ruleset

You can scan your codebase using --config auto to run Semgrep with rules that apply to your programming languages and frameworks:

semgrep scan --config auto --pro
info

Semgrep collects pseudonymous metrics when you use rules from the Registry. You can turn this off with --metrics=off.

To scan your codebase with a specific ruleset, either one that you write or one that you obtain from the Semgrep Registry, use the --config flag.

# Scan with the rules defined in rules.yaml
semgrep scan --config rules.yaml

You can include as many configuration flags as necessary.

# Scan with rules defined in two separate config files
semgrep scan --config rules.yaml --config more_rules.yaml

Rules stored under a hidden directory, such as dir/.hidden/myrule.yml, are processed by Semgrep when scanning with the --config flag.

Scan with rules in a directory and all its subdirectories:

semgrep scan --config DIRECTORY_NAME

Scan with all YAML rules detected in the current working directory and all its subdirectories:

semgrep scan --config .