Some of what you see here is sample content. While the community forms, part of the members, reviews, ratings and discussions are seeded examples. Every one is badged Sample, and they do count towards the totals on this site. Vendor pages, the security data and the tools are real.
Custom rules turned static analysis from noise into signal
4.4/5overall, average of the five axes
Deployment effort4
Support quality4
Features vs promises4
Pricing transparency5
Return on investment5
What happened
Off-the-shelf SAST gave us thousands of findings nobody triaged. Writing our own Semgrep rules for the patterns that actually hurt us produced a short list engineers accept. It takes investment in rule writing, and if nobody on the team wants to own that, you will get less out of it than from a heavier commercial tool.
Worked well
Rule syntax is approachable. Fast scans. Findings are relevant because you defined them.
Did not
You must invest in writing rules. Fewer out-of-box language integrations than the incumbents. Reporting is basic.
9 found this helpful