r2c

Questions & Answers

What is Semgrep (r2c)?

Semgrep, originally r2c, is an App Security Platform that provides static application security testing (SAST), software composition analysis (SCA), and secrets detection. It combines AI reasoning with rule-based analysis to find and fix code issues.

Who is Semgrep designed for?

Semgrep is designed for developers, AppSec teams, and engineering organizations aiming to integrate security into their development workflows. It helps teams secure code effectively and accelerate development without compromising on security.

How does Semgrep differentiate itself from other SAST/SCA tools?

Semgrep distinguishes itself by combining AI reasoning with rule-based detection, which significantly reduces false positives by up to 80% across SAST and SCA. It also uses reachability analysis for SCA to flag only exploitable dependency vulnerabilities, and AI learns code context to prioritize findings.

When is the best time to use Semgrep in the development process?

Semgrep is best used early in the development process, often referred to as 'shifting left,' to catch and fix vulnerabilities as code is written or committed. It integrates into CI/CD pipelines to provide continuous security feedback and prevent insecure code from shipping.

What kind of rules does Semgrep use for detection?

Semgrep utilizes a comprehensive registry of rules written by both Semgrep and its community, which users can explore and contribute to. These rules, combined with semantic analysis and AI, enable the platform to detect various code issues, including OWASP risks, business logic flaws, and hardcoded secrets.