- Home
- Software Composition Analysis Software
- Semgrep Supply Chain
On the recordRead 30 Sep 202615 facts
Semgrep Supply Chain
San Francisco, California, United States
Plans and prices
Free Edition
Free
up to 10 repositories · maximum 10 contributors · GitHub/GitLab authentication
Read 30 Sep 2026 · semgrep.dev
Teams — Supply Chain
$30a month
500 private repositories max · 20 AI credits per developer per month · SSO
Read 30 Sep 2026 · semgrep.dev
Enterprise
Priced on request
No limit on repositories scanned or contributors · optional dedicated infrastructure · dedicated account manager
Read 30 Sep 2026 · semgrep.dev
On the record
- API access
- The pricing comparison lists REST API access for Teams and Enterprise.semgrep.dev · read 30 Sep 2026
- Code handling
- Semgrep says that when it runs locally or fully in a CI pipeline, source code stays on the user's computer or CI environment; opted-in AI processing submits part of a file containing a finding to a model.semgrep.dev · read 30 Sep 2026
- Company history
- Semgrep says it was founded in 2017 by Drew Dennison, Isaac Evans, and Luke O’Malley.semgrep.dev · read 30 Sep 2026
- Compliance
- Semgrep's Trust Portal says its SOC 2 Type II report and full-scope penetration test cover the AppSec Platform, including Supply Chain.trust.semgrep.dev · read 30 Sep 2026
- Dependency upgrades
- The product offers autofix pull requests, line-level breaking-change detection, and upgrade guidance based on LLM reasoning and static-analysis context.semgrep.dev · read 30 Sep 2026
- Integrations
- Semgrep lists GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, and Buildkite among its CI integrations, with Slack, email, webhooks, VS Code, and IntelliJ also listed.semgrep.dev · read 30 Sep 2026
- Malware detection
- Semgrep describes malicious dependency detection, impact analysis, and policies to help respond to zero-day supply-chain attacks.semgrep.dev · read 30 Sep 2026
- Plan limits
- The pricing comparison lists 10 private repositories maximum for Free Edition, 500 maximum for Teams, and unlimited for Enterprise.semgrep.dev · read 30 Sep 2026
- Purpose
- Semgrep Supply Chain detects vulnerabilities in open-source dependencies, blocks malware, and provides codebase-aware reachability analysis and upgrade guidance.semgrep.dev · read 30 Sep 2026
- Reachability
- Semgrep says codebase-aware reachability can reduce false positives by up to 98%.semgrep.dev · read 30 Sep 2026
- Severity coverage
- The product page states that critical and high severity findings have GA-level support in 12 languages.semgrep.dev · read 30 Sep 2026
- Supply-chain features
- The pricing comparison lists software composition analysis, lockfile and code scanning, reachability analysis, malicious dependency detection, SBOM generation, license compliance checking, and dependency search.semgrep.dev · read 30 Sep 2026
- Support
- The pricing page lists community-based support for Free Edition, award-winning support for Teams, and a dedicated account manager and tailored onboarding for Enterprise.semgrep.dev · read 30 Sep 2026
