Documentation Index
Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
Use this file to discover all available pages before exploring further.
Scan with Semgrep AppSec Platform
Deploy static application security testing (SAST), software composition analysis (SCA), and secrets scans from one platform.
Get started
Run your first Semgrep scan.
Deploy Semgrep
Deploy Semgrep to your organization quickly and at scale.
Triage and remediate
Triage and remediate findings; fine-tune guardrails for developers.
Write rules
Enforce your organization’s coding standards with custom rules.
Supported languages
| Product | Languages |
|---|---|
| Semgrep Code | Generally available (GA) C and C++ • C# • Generic • Go • Java • JavaScript • JSON • Kotlin • Python • TypeScript • Ruby • Rust • JSX • PHP • Scala • Swift • Terraform Beta APEX • Elixir Experimental Bash • Cairo • Circom • Clojure • Dart • Dockerfile • Hack • HTML • Jsonnet • Julia • Lisp • Lua • Move on Aptos • Move on Sui • OCaml • R • Scheme • Solidity • YAML • XML |
| Semgrep Supply Chain | Generally available reachability C# • Go • Java • JavaScript and TypeScript • Kotlin • PHP • Python • Ruby • Rust • Scala • Swift Languages without support for reachability analysis Dart • Elixir |
| Semgrep Secrets | Language-agnostic; can detect 630+ types of credentials or keys. |
See Supported languages documentation for more details.
April 2026 release notes summary
- Added the ability to manually run full scans for the non-default or non-primary branches using Semgrep Managed Scans, as well as the ability to retry Semgrep Managed Scans that failed or didn’t complete.
- The interfile analysis engine has been redesigned to improve performance. These improvements change how findings are generated, which might result in additional true positives and fewer false positives.
- Semgrep Playground is now mobile-friendly.
- The Finding Details page now displays the reason why a finding was ignored at the top. Users no longer need to go to the Activity section to see this information.
- Added Supply Chain reachability coverage for Rust.
- Added dependency path information to SBOM exports and the
/issuesAPI endpoint. - Findings of critical or high severity with high or medium confidence identified during diff-aware scans are now included in autotriage analysis.