# Semgrep

Hacker Approved page: https://hackerapproved.com/p/semgrep/

7 people recommended Semgrep in Hacker News comments, 3 had mixed feelings and 9 criticized it, November 2025 to October 2026. It was recommended in 4 of 12 months, in 7 threads. It does not meet the Hacker Approved badge rule.

**Verdict:** More people criticize it than recommend it. Free open-source static analysis tool that catches common bugs like secrets, SQL injection and weak hashing. Critics say it misses AI-specific bugs and produces many false positives.

Summary written by Claude from the comments below.

## What people warn about

- Misses AI-specific and behavioural bugs (2 comments in the sample): "Existing tools like Bandit and Semgrep use generic 
rules that were not built around AI tool failure 
modes." ([source](https://news.ycombinator.com/item?id=49534490)) "Existing tools like ESLint, Semgrep, and Bandit were built for human-written code." ([source](https://news.ycombinator.com/item?id=47421289))
- Hard to adopt and use (2 comments in the sample): "haven't tried semgrep but the rules engine seemed intimidating" ([source](https://news.ycombinator.com/item?id=48528855)) "sound great but in practice are painful to consistently use" ([source](https://news.ycombinator.com/item?id=46295137))
- Many false positives (2 comments in the sample): "flagging patterns will always lead to huge false positive rates" ([source](https://news.ycombinator.com/item?id=47093997)) "Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives" ([source](https://news.ycombinator.com/item?id=46975146))
- Slow on large repositories (2 comments in the sample): "tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube on large monorepos" ([source](https://news.ycombinator.com/item?id=46854089)) "Semgrep takes 10-30s on a medium repo." ([source](https://news.ycombinator.com/item?id=47636802))

## Why people recommend it

- Catches common bugs like secrets and SQLi (2 comments in the sample): "Semgrep's a solid choice for this. The stuff you're catching - secrets, SQLi, 
weak hashing-  is where pattern matching shines." ([source](https://news.ycombinator.com/item?id=46870029)) "These tools have been catching bugs reliably for years." ([source](https://news.ycombinator.com/item?id=47638543))
- Runs in security and verification pipelines (2 comments in the sample): "No more breaking security policies… we have semgrep, trivy and kerno running in the verfication pipelines" ([source](https://news.ycombinator.com/item?id=49297313)) "tools like trivy and sempreg are basically the backbone of every safe program" ([source](https://news.ycombinator.com/item?id=48049946))
- Recommended as a must-know tool (2 comments in the sample): "For a tool that actually legitimately does this, look at Semgrep." ([source](https://news.ycombinator.com/item?id=47645558)) "just FYI for anyone who doesn't know about this amazing tool yet" ([source](https://news.ycombinator.com/item?id=49461681))

## Other static analyzers people recommend

- [zizmor](https://hackerapproved.com/p/zizmor/): 13 recommend, 2 mixed, 1 criticize
- [clang-tidy](https://hackerapproved.com/p/clang-tidy/): 12 recommend, 1 mixed, 3 criticize
- [PHPStan](https://hackerapproved.com/p/phpstan/): 8 recommend, 2 mixed, 0 criticize
- [SonarQube](https://hackerapproved.com/p/sonarqube/): 7 recommend, 3 mixed, 10 criticize

## The badge

A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged.

## Cite as

Hacker Approved, "Semgrep", https://hackerapproved.com/p/semgrep/ (7 recommend, 3 mixed, 9 criticize; Hacker News comments, November 2025 to October 2026).

Counts updated 2 Nov 2026, with data through October 31, 2026.