# Semgrep

**Source:** https://www.startuphub.ai/startups/semgrep-2rfq
**Profile type:** Startup

> Semgrep is an open-source static analysis tool that helps developers find and fix bugs and security vulnerabilities in their code.

## About

Semgrep offers an AI-assisted application security platform that combines rule-based detection with AI reasoning for SAST, SCA, and secrets detection. Their platform helps organizations automate, manage, and enforce security across development workflows, including scanning and fixing AI-generated code. Semgrep serves developers, startups, and various industries like Fintech and SaaS & Cloud.

## Key facts

- **Slug:** semgrep-2rfq
- **Website:** https://semgrep.dev
- **Location:** San Francisco, United States
- **Employees:** 273
- **Operating status:** Active
- **Total funding:** $30M
- **Sectors / tags:** Developer Tools, Code Analysis, Security, Static Analysis, Open Source
- **Social:**
  - LinkedIn: https://www.linkedin.com/company/semgrep
  - Twitter: https://x.com/semgrep
  - GitHub: https://github.com/semgrep

## StartupHub.ai scores

- **Ahrefs DR:** 77/100
- **Agent Readiness:** C (63/100)

## Funding rounds

| Date | Round | Amount | Lead investors |
| --- | --- | --- | --- |
| 1 Mar 2023 | [Series A](https://www.startuphub.ai/investment_rounds/semgrep-series-a-2023) | $20M | [Index Ventures](https://www.startuphub.ai/investors/index-ventures) |
| 20 Apr 2021 | [Seed](https://www.startuphub.ai/investment_rounds/semgrep-seed-2021) | $10M | [Another VC](https://www.startuphub.ai/investors/another-vc-merged-0cec22f9) |

## Tech stack

Detected on semgrep.dev, last scanned 2026-10-17.

- **Frontend:** Tailwind CSS, Bootstrap
- **Analytics:** Google Tag Manager
- **SEO:** Bitly
- **Observability:** FullStory
- **CDN:** AWS CloudFront, Netlify
- **Email provider:** Google Workspace
- **Cookie consent:** OneTrust
- **Status page:** Statuspage
- **Affiliate program:** Self-hosted affiliate

## JSON-LD

Structured data aligned with this page's `<script type="application/ld+json">` (included when the profile is server-rendered).

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BreadcrumbList",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://www.startuphub.ai"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Startups",
          "item": "https://www.startuphub.ai/startups"
        },
        {
          "@type": "ListItem",
          "position": 3,
          "name": "Semgrep",
          "item": "https://www.startuphub.ai/startups/semgrep-2rfq"
        }
      ]
    },
    {
      "@type": "ProfilePage",
      "@id": "https://www.startuphub.ai/startups/semgrep-2rfq#webpage",
      "url": "https://www.startuphub.ai/startups/semgrep-2rfq",
      "name": "Semgrep - AI Startup Profile | StartupHub.ai",
      "description": "This is the StartupHub.ai profile of Semgrep. Semgrep is a startup operating in Developer Tools and Code Analysis. Semgrep is an open-source static analysis tool that helps developers find and fix bugs and security vulnerabilities in their code. Headquartered in San Francisco, United States. The company has approximately 273 employees.",
      "dateModified": "2026-10-31T09:48:18.623Z",
      "mainEntity": {
        "@type": "Organization",
        "@id": "https://www.startuphub.ai/startups/semgrep-2rfq#organization"
      }
    },
    {
      "@type": "Organization",
      "@id": "https://www.startuphub.ai/startups/semgrep-2rfq#organization",
      "name": "Semgrep",
      "url": "https://semgrep.dev",
      "logo": "https://cdn.startuphub.ai/storage/v1/object/public/entity-images/logos/10c84653-8494-4c1d-9091-835b919df147-square.webp",
      "image": "https://cdn.startuphub.ai/storage/v1/object/public/entity-images/logos/10c84653-8494-4c1d-9091-835b919df147-square.webp",
      "description": "Semgrep offers an AI-assisted application security platform that combines rule-based detection with AI reasoning for SAST, SCA, and secrets detection. Their platform helps organizations automate, manage, and enforce security across development workflows, including scanning and fixing AI-generated code. Semgrep serves developers, startups, and various industries like Fintech and SaaS & Cloud.",
      "sameAs": [
        "https://www.linkedin.com/company/semgrep",
        "https://x.com/semgrep",
        "https://github.com/semgrep"
      ],
      "numberOfEmployees": {
        "@type": "QuantitativeValue",
        "value": 273
      },
      "address": {
        "@type": "PostalAddress",
        "addressLocality": "San Francisco",
        "addressCountry": "US"
      },
      "knowsAbout": [
        "Developer Tools",
        "Code Analysis",
        "Security",
        "Static Analysis",
        "Open Source"
      ]
    }
  ]
}
```

## Community reviews

Community reviews below were gathered from public sources into one place. Each quote is copied word for word and links to where it was posted.

- **Reddit r/google_antigravity** | iCreaty | 2026-05-24 | negative | highlighted criticism
  > "Since updating to Antigravity 2.0 then moving back to the IDE, it keeps spawning hundreds of semgrep-core-proprietary processes, and using all 24GB of memory and then freezing my MacBook? Has anyone else had this issue and found a fix for it?"
  > Source: https://www.reddit.com/r/google_antigravity/comments/1tm0t1l/hundreds_of_semgrepcoreproprietary_processes/
- **Reddit r/golang** | titpetric | 2025-01-20 | positive | highlighted endorsement
  > "I love semgrep (not affiliated) and I've used it to detect some code smells. While only an initial list, there's some interesting (for me) linters rising out of it: Detect memory leak exposure on maps Detect non-returning loops Detect symbol usage code smells (atomic.Value) Detect code smells like repeated Logger() calls I guess the checks themselves are quite opinionated."
  > Source: https://www.reddit.com/r/golang/comments/1i5yw5v/semgrep_rules_for_code_style_code_smells/
- **Reddit r/PracticalDevSecOps** | Expert-Inspector4889 | 2026-07-01 | mixed
  > "Semgrep's default rules were decent but not impressive on their own. The value showed up after I wrote 2 custom rules for how this codebase "should" be written, and then it caught several cross-file auth flaws that Bandit missed."
  > Source: https://www.reddit.com/r/PracticalDevSecOps/comments/1ukhtcl/bandit_vs_semgrep_vs_codeql_on_the_same_codebase/
- **Reddit r/security** | Unique_Buy_3905 | 2026-03-26 | mixed
  > "We have been using Semgrep for SAST and like the developer experience, the custom rules are flexible and it plugs into our workflow cleanly. But the SCA coverage is limited and there is no real correlation layer between what Semgrep finds and what our container and pipeline scans surface separately."
  > Source: https://www.reddit.com/r/security/comments/1s41yeg/checkmarx_vs_semgrep_for_teams_that_want_real/
- **Reddit r/cybersecurity** | OutsideOrnery6990 | 2026-03-06 | mixed
  > "I know a lot of people recommend the free version of Semgrep, Snyk, Aikido Security, and some others. But I also heard people say that these tools are not really adequate for production applications, which I understand free tools have limitations. Semgrep specifically changed their licensing model and I'm not sure how good it is now if I only use the free version."
  > Source: https://www.reddit.com/r/cybersecurity/comments/1rm4jj3/can_anyone_suggest_good_choice_of_free_sast_and/
- **Reddit r/ExperiencedDevs** | Peace_Seeker_1319 | 2026-02-12 | negative
  > "our entire static analysis stack - SonarQube, Semgrep, and a $35k/year Checkmarx enterprise license - found nothing. what happened is: // POST /webhooks/stripe async function handlePaymentSuccess(req, res) { const event = req.body; const session = event.data.object; con"
  > Source: https://www.reddit.com/r/ExperiencedDevs/comments/1r2nrb5/ested_sonarqube_semgrep_and_checkmarx_on_our/