Semgrep Pro versus Semgrep OSS
You can use Semgrep Pro or Semgrep OSS to scan your code for security issues, bugs, and compliance to coding standards. Semgrep uses both an engine and rules to scan your code.
Rules, which are written in YAML, describe how Semgrep generates a finding, such as a security issue. A rule encapsulates the pattern-matching logic and is meant to be readable and customizable.
Semgrep Pro includes different types of analyses, such as Semgrep Code's cross-file, cross-function analysis in Semgrep Code. Semgrep OSS runs only single-function analysis.
This document outlines key differences between the Semgrep OSS and Pro product lines.
The terms used in this document are defined as follows:
- Semgrep OSS
- Refers to Semgrep offerings with an open-source license, primarily the Semgrep OSS Engine, a fast and customizable static application security testing (SAST) scanner. To run Semgrep completely on OSS, use the OSS Engine and rules in the Semgrep Registry with open source licenses, or write your own custom rules.
- Semgrep Pro
- Refers to proprietary product offerings from Semgrep, Inc. These include:
- Semgrep Code
- A SAST scanner that uses cross-file (interfile) and cross-function (interprocedural) analysis for improved results over Semgrep OSS. Semgrep Code includes premium rules, known as Pro rules, that use the cross-file analysis to reduce false positives.
- Semgrep Supply Chain
- A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions across the software development life cycle (SDLC).
- Semgrep Secrets
- A a secrets scanner that, in addition to detecting secrets, validates these leaked secrets on a variety of services to help you prioritize active secrets.
- Semgrep AppSec Platform
- A a web application for the deployment, management, and monitoring of findings from Semgrep's SAST, SCA, and secrets scanners. It integrates with continuous integration (CI) providers such as GitHub Actions, GitLab CI/CD, CircleCI, and more.
All Semgrep Pro products are free for up to 10 contributors.
🔎 Core scanning features
The following tables describe Semgrep's essential scanning and findings management capabilities.
SAST (Static application security testing)
| Feature | Semgrep OSS | Semgrep Pro |
|---|---|---|
| Single-file analysis | ✔️ | ✔️ |
| Single-function analysis | ✔️ | ✔️ |
| Cross-file (across multiple files or interfile) analysis | -- | ✔️ |
| Cross-function (across multiple functions or interprocedural) analysis | -- | ✔️ |
| Dataflow analysis (taint) | -- | ✔️ |
SCA (Software composition analysis)
| Feature | Semgrep OSS | Semgrep Pro |
|---|---|---|
| Reachability analysis for direct dependencies | -- | ✔️ |
| License compliance | -- | ✔️ |
| Dependency search | -- | ✔️ |
| SBOM export | -- | ✔️ |
💬 Scan management and monitoring
The following table displays various notification channels and reporting features.
| Feature | Semgrep OSS | Semgrep Pro |
|---|---|---|
| Centralized management of scan results (triage, remediation, fine-tuning noisy rules) | -- | ✔️ |
| Notifications and reports (Slack, email, webhooks, and API) | -- | ✔️ |
| Send scan results to GitLab SAST and GitHub Advanced Security | -- | ✔️ |
| Findings dashboard | -- | ✔️ |
| Findings retention | -- | As long as account is active |
🧰 Scan customization features
The following table displays customization features and tools that enhance Semgrep's core scanning capabilities. These features can increase true-positive rate and provide deeper insights into remediation.
| Feature | Semgrep OSS | Semgrep Pro |
|---|---|---|
| Write your own rules | ✔️ | ✔️ |
| Community-contributed rule registry | ✔️ | ✔️ |
| Rule-writing environment | ✔️ Playground | ✔️ Playground and Editor for logged-in users |
| Private rules* | -- | ✔️ |
| Proprietary rule registry | -- | ✔️ |
| Policy-based workflows† | -- | ✔️ |
*Private rules refer to rules that are guaranteed a private access scope in the cloud. This scope of access does not apply to Semgrep OSS, as Semgrep OSS is purely CLI-based.
† Policy-based workflows provide security teams a means to block merges, leave PR/MR comments, or silently monitor for potential issues based on the presence of a finding.
🤖 Developer experience
The following table lists tools to enable developers to resolve findings in their own code.
| Feature | Semgrep OSS | Semgrep Pro |
|---|---|---|
| VS Code extension | ✔️ | ✔️ |
| IntelliJ extension | ✔️ | ✔️ |
pre-commit‡ | ✔️ | ✔️ |
| Autofix | ✔️ | ✔️ |
| Autofix in PR/MR comments | -- | ✔️ |
| GPT-assisted autofix | -- | ✔️ |
‡pre-commit requires some manual set-up.
🏢 User and organization management
| Feature | Semgrep OSS | Semgrep Pro |
|---|---|---|
| Role-based access control (RBAC) | -- | ✔️ |
| Personal and organizational accounts | -- | ✔️ |
| SSO, OpenID, or OAuth2 authentication | -- | ✔️ |
🧾 Licenses and tiers
| Product line | License | Subscription tiers |
|---|---|---|
| Semgrep Pro | Proprietary |
|
| Semgrep OSS Engine | GNU LGPL 2.1 | -- |
| Publicly-contributed rules | Dependent on author | -- |
See Licensing for more details.