Semgrep
Shares rank 4 of 9 static analyzers by recommenders
More people criticize it than recommend it. Free open-source static analysis tool that catches common bugs like secrets, SQL injection and weak hashing. Critics say it misses AI-specific bugs and produces many false positives.
7 people recommended Semgrep in Hacker News comments, 3 had mixed feelings and 9 criticized it, November 2025 to October 2026.
Summary written by Claude from the comments below.
19 people gave an opinion
- recommend it
- 7
- mixed feelings
- 3
- warn against or regret it
- 9
The record
Recommended in 4 of 12 months
In 7 different threads.
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
Why it doesn’t carry the badge
- 7 people recommend itNeeds 10 or more, not met.
- 0.7 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 4 of 12 monthsNeeds 4 or more, met.
- Recommended in 7 threadsNeeds 5 or more, met.
- The biggest thread supplies 14% of its recommendersNeeds half or less, met.
The same rules apply to every product, and the badge can’t be bought. Mixed feelings count toward neither side. How the badge works
What people say about it
Reasons grouped from a sample of 18 of the 21 opinions about it, picked in proportion to how many people recommend it, have mixed feelings and criticize it. Each mark is one comment in the sample. Open a reason to read what they said.
What people warn about
Each mark is one comment
Misses AI-specific and behavioural bugs
“Existing tools like Bandit and Semgrep use generic rules that were not built around AI tool failure modes.”
Comment from 2 Sep 2026 in “VibeGuard – security linter for AI-generated code” “Existing tools like ESLint, Semgrep, and Bandit were built for human-written code.”
Comment from 18 Mar 2026 in “Vchk – Security scanner for AI-generated code” Hard to adopt and use
“haven't tried semgrep but the rules engine seemed intimidating”
Comment from 14 Jun 2026 in “Formal Methods and the Future of Programming” “sound great but in practice are painful to consistently use”
Comment from 16 Dec 2025 in “AI will make formal verification go mainstream” Many false positives
“flagging patterns will always lead to huge false positive rates”
Comment from 20 Feb 2026 in “Making frontier cybersecurity capabilities available to defenders” “Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives”
Comment from 11 Feb 2026 in “Vulnerabilities in 45 Open Source Projects (vLLM, Langfuse, Phase, NocoDB)” Slow on large repositories
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube on large monorepos”
Comment from 2 Feb 2026 in “RMA – Fast Rust monorepo scanner cross-file taint, typestate, <0.5s on 100k LOC” “Semgrep takes 10-30s on a medium repo.”
Comment from 4 Apr 2026 in “Foxguard – a security scanner as fast as a linter”
Why people recommend it
Each mark is one comment
Catches common bugs like secrets and SQLi
“Semgrep's a solid choice for this. The stuff you're catching - secrets, SQLi, weak hashing- is where pattern matching shines.”
Comment from 3 Feb 2026 in “Yikes – Security scanner for AI-generated code” “These tools have been catching bugs reliably for years.”
Comment from 4 Apr 2026 in “LLMs audit code from the same blind spot they wrote it from. Here's the fix” Runs in security and verification pipelines
“No more breaking security policies… we have semgrep, trivy and kerno running in the verfication pipelines”
Comment from 14 Aug 2026 on Hacker News “tools like trivy and sempreg are basically the backbone of every safe program”
Comment from 7 May 2026 on Hacker News Recommended as a must-know tool
“For a tool that actually legitimately does this, look at Semgrep.”
Comment from 5 Apr 2026 in “Isseven” “just FYI for anyone who doesn't know about this amazing tool yet”
Comment from 27 Aug 2026 in “Beyond Recall and the Illusion of Competence”
Other static analyzers people recommend
The four most recommended other static analyzers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Mixed | Criticize | Approval | Months | Had for | Badge |
|---|---|---|---|---|---|---|---|
| zizmor | 13 | 2 | 1 | 93% | 6 | — | Approved |
| clang-tidy | 12 | 1 | 3 | 80% | 5 | — | Approved |
| PHPStan | 8 | 2 | 0 | 100% | 5 | — | — |
| SemgrepThis page | 7 | 3 | 9 | 44% | 4 | — | — |
| SonarQube | 7 | 3 | 10 | 41% | 5 | — | — |
What people said
18 of the 21 opinions about it, picked in proportion to the three counts, newest first. Each links to the original comment.
“Existing tools like Bandit and Semgrep use generic rules that were not built around AI tool failure modes.”
“just FYI for anyone who doesn't know about this amazing tool yet”
“No more breaking security policies… we have semgrep, trivy and kerno running in the verfication pipelines”
“makes some perform worse and none perform better”
“makes what semgrep sells obsolete”
“which is almost cheating, since it finds bugs on its own, but worth a try”
“haven't tried semgrep but the rules engine seemed intimidating”
“tools like trivy and sempreg are basically the backbone of every safe program”
“For a tool that actually legitimately does this, look at Semgrep.”
“These tools have been catching bugs reliably for years.”
“Semgrep takes 10-30s on a medium repo.”
“Existing tools like ESLint, Semgrep, and Bandit were built for human-written code.”
“flagging patterns will always lead to huge false positive rates”
“Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives”
“without the Python runtime overhead”
“Semgrep's a solid choice for this. The stuff you're catching - secrets, SQLi, weak hashing- is where pattern matching shines.”
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube on large monorepos”
“sound great but in practice are painful to consistently use”
Counts come from 1,791,911 Hacker News comments labeled by Claude, November 2025 to October 2026, with data through October 31, 2026. Counts updated 2 Nov 2026. How we count. Report a mistake.