Semgrep
returntocorp/semgrep
An open-source alternative to Snyk.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code. (from the repository)
- Stars
- 17,127
- Licence
- LGPL-2.1
- Last push
- 2026-10-19
- Written in
- C
Is it alive?
Four readings from the repository, each with the rule behind it. No blended score.
Activity
Active
Last push 9 days ago
Active: pushed within 90 days. Slowing: within a year. Quiet: longer.
Releases
Recent
v1.181.0, 13 days ago
Recent: a tagged release within six months. Some projects ship from the main branch and never tag.
Issues
73% closed
890 open · 2,433 closed
Share of all issues ever filed that are now closed. Under 20 issues is too few to read.
Momentum
No readings yet
17,127 stars
Change in stars across our daily readings, over up to 30 days. Needs a week of readings.
What a business may do with it
Weak copyleftLGPL-2.1
Usable inside a closed product. Changes to its own files must be shared under the same licence when you distribute them.
This describes the licence family GitHub identified, not legal advice about this project. The repository’s own LICENSE file is what binds you.
Run it yourself
Semgrep’s README does not show a docker run, docker compose up or helm install in a code block, so this page will not guess one. It may be a desktop app, a library, or documented on its website.
Where this page comes from
- Stars, licence, activity, issues, releases and the self-host command are read from the repository. 2026-10-19
- The pairing with Snyk and the category come from opensourcealternative.to, a community directory of open-source alternatives. We re-read it weekly.
- Star momentum comes from our own daily readings of the repository. How we collect data