Product Tours

Want to learn how Semgrep Code and Semgrep Supply Chain can help you fix more vulnerabilities within your first and third-party code?

Semgrep Code

Code analysis at ludicrous speed. Find bugs, run security scans in CI, and enforce security standards across your organization.

Semgrep Supply Chain

Semgrep Supply Chain’s reachability analysis lets you quickly find and remediate the 2% of issues that are actually reachable..

Learn more on Semgrep's blog

Subscribe to our blog for the latest security tips and product updates.

Development
February 10, 20225 min read
Semgrep Code announcement blog
Raghav Jain
Announcements
October 04, 20224 min read
It's time to ignore 98% of dependency alerts. Introducing
Adam Berman
Announcements
December 01, 20225 min read
Releasing Semgrep 1.0
Yoann Padioleau

FAQ

When can we try this?

We are working on making all these production-ready but we can enable the code remediation feature right away for you to test and keep you on the waitlist for other features. Note that you need to sign our Terms and Conditions because we’ll be sending pieces of your code to OpenAI.

Out of all these capabilities, which ones are ready for us to try?

You can try code remediation right away and give us feedback.

How accurate is the code remediation?

We are currently analyzing it, but so far we have found it to be pretty accurate for some of the JavaScript and Python code we have tested. We are opening up this preview release to get more feedback from people like yourself.
By the way, note that the GPT-4’s suggestions are just that, suggestions. You are free to ignore them. If you ignore it because it was not accurate, we ask you to provide feedback so that we can look into it.

Can we try this in production?

We recommend trying code remediation in your development branches for your production apps. Please remember that code remediation is just a suggestion. If you think it's inaccurate, please let us know and feel free to ignore it.

Do you need code access?

We don’t need code access, however note that we do need to send vulnerable code snippets to OpenAI.

Do you send the code to OpenAI?

We don’t send your entire code to OopenAI but only the minimum necessary functions and lines that are deemed vulnerable.

Do you send the code to Microsoft?

We believe that although GPT-4 is partly owned by Microsoft, they won’t have direct access to your code.

Static analysis at ludicrous speed
Find bugs and enforce code standards
Trusted by top companies