Welcome to the Semgrep blog

The surface area of software is expanding at a rate well above our ability to secure it. How can we speed software delivery and prevent security incidents at the same time?

Introducing free access to Semgrep Supply Chain and Code’s Pro features, for up to 10 monthly contributors. Additionally, Semgrep is faster and runs with every keystroke in the browser and in VS Code.

What do people mean exactly when they use the term reachability? As it turns out, there are many distinct approaches to reachability analysis, but not many resources available that explain how they differ.

In this blog post, we'll go over the different methods of reachability analysis, the pros and cons of each, and why we think Semgrep's is the most effective and pragmatic when it comes to prioritizing software supply chain vulnerabilities.

With Semgrep Supply Chain, you can now mitigate supply chain vulnerabilities before a CVE even drops with Dependency Search and enforce your organization's license policies on pull requests with License Compliance.

The surface area of software is expanding at a rate well above our ability to secure it. How can we speed software delivery and prevent security incidents at the same time?

Introducing free access to Semgrep Supply Chain and Code’s Pro features, for up to 10 monthly contributors. Additionally, Semgrep is faster and runs with every keystroke in the browser and in VS Code.

What do people mean exactly when they use the term reachability? As it turns out, there are many distinct approaches to reachability analysis, but not many resources available that explain how they differ.

In this blog post, we'll go over the different methods of reachability analysis, the pros and cons of each, and why we think Semgrep's is the most effective and pragmatic when it comes to prioritizing software supply chain vulnerabilities.

With Semgrep Supply Chain, you can now mitigate supply chain vulnerabilities before a CVE even drops with Dependency Search and enforce your organization's license policies on pull requests with License Compliance.