{"record":"Semgrep evidence record","url":"https://nexalign.io/vendors/semgrep","vendor":{"slug":"semgrep","name":"Semgrep","domain":"semgrep.dev","category":"devsecops","categoryLabel":"DevSecOps and application security"},"lastChecked":"2026-07-18T16:20:31.825Z","coverage":{"earliest":"2023-04-14T19:01:01.000Z","latest":"2026-07-18T16:20:31.825Z"},"terms":{"isRanking":false,"isRating":false,"statesSuitability":false,"note":"This is a record of what public sources hold about a named company. It states no ranking, no rating and no suitability verdict, and none may be derived from it. An absent or small record means the public registers publish little under that name; it is not evidence that a product is secure. A larger advisory count generally reflects wider deployment and more scrutiny rather than a weaker product.","licence":"https://nexalign.io/vendors#licence","corrections":"info@nexalign.io"},"totals":{"evidenceItems":24,"kindsOfSource":3,"attributedAdvisories":0,"knownExploited":0,"registerEntriesNotAttributable":3,"practitionerThreads":9,"independentItems":4,"vendorPublishedItems":0,"shareFromSourcesTheVendorDoesNotControl":1},"sources":[{"source":"European Vulnerability Database","operator":"ENISA, European Union","classification":"authoritative","items":3,"latest":"2026-04-30T00:00:20.000Z"},{"source":"Engineering discussions","operator":"Hacker News, public threads","classification":"independent","items":17,"latest":"2026-07-09T15:30:15.000Z"},{"source":"Analyst, review and reference sources","operator":"Recognised analysts, review marketplaces and technology press","classification":"independent","items":4,"latest":"2026-07-18T16:20:31.825Z"}],"advisories":{"shown":0,"total":0,"truncated":false,"items":[]},"practitionerThreads":{"shown":5,"total":9,"truncated":true,"items":[{"title":"Making Semgrep rip: How Ripgrep inspired us to shave hours off (some) scans","context":"Hacker News","url":"https://news.ycombinator.com/item?id=48481677","date":"2026-06-10T19:50:48.000Z"},{"title":"We Benchmarked Claude Code, Codex, Semgrep, CodeQL, Trent on 28 CWE-Bench CVEs","context":"Hacker News","url":"https://news.ycombinator.com/item?id=48308084","date":"2026-05-28T12:39:46.000Z"},{"title":"semgrep: Lightweight static analysis for many languages","context":"Hacker News","url":"https://news.ycombinator.com/item?id=44493197","date":"2025-07-07T18:19:27.000Z"},{"title":"Upgrading Semgrep from OCaml 4 to OCaml 5","context":"Hacker News","url":"https://news.ycombinator.com/item?id=43346669","date":"2025-03-12T19:11:48.000Z"},{"title":"Did Semgrep Just Get a Lot More Interesting?","context":"Hacker News","url":"https://news.ycombinator.com/item?id=43054673","date":"2025-02-15T00:40:31.000Z"}]},"independentCoverage":{"shown":4,"total":4,"truncated":false,"items":[{"title":"Semgrep - Wikipedia","host":"en.wikipedia.org","url":"https://en.wikipedia.org/wiki/Semgrep","date":null},{"title":"Semgrep: Pros and Cons 2026","host":"peerspot.com","url":"https://www.peerspot.com/products/semgrep-pros-and-cons","date":null},{"title":"Semgrep Features | G2","host":"g2.com","url":"https://www.g2.com/products/semgrep/features","date":null},{"title":"Semgrep Reviews 2026: Details, Pricing, & Features | G2","host":"g2.com","url":"https://www.g2.com/products/semgrep/reviews","date":null}]},"vendorPublished":{"shown":0,"total":0,"truncated":false,"items":[]},"openQuestions":["3 register entries mention Semgrep, but none of them could be attributed to a product of Semgrep. They describe other vendors' software and are not shown here.","Pricing, contract terms, notice periods and support commitments are not part of any public register. They come from the vendor and belong in a negotiation record.","Certification status such as ISO 27001, SOC 2 or BSI C5 has to be checked against the current certificate and its stated scope. A valid certificate can still exclude the product being bought."]}