Skip to main content

​
Quickstart

Select your IDE in the following tabs and follow the instructions to set up your first Semgrep IDE scan.
For Microsoft VS Code users:
1
Install the Semgrep extension. If you’re unfamiliar with installing VS Code extensions, see the Extension Marketplace’s article Install an Extension.
2
Use Ctrl+⇧Shift+P or ⌘Command+⇧Shift+P (macOS) to launch the Command Palette, and run the following to sign in to Semgrep AppSec Platform:
You can use the extension without signing in, but doing so enables better results since you benefit from Semgrep Code and its Pro rules.
3
Launch the Command Palette using Ctrl+⇧Shift+P or ⌘Command+⇧Shift+P (macOS), and scan your files by running:
4
To see detailed vulnerability information, hover over the code underlined in yellow. You can also see the findings identified by Semgrep using ⇧Shift+Ctrl+M or ⌘Command+⇧Shift+M (macOS) and opening the Problems tab.

​
Scan scope and limitations

Semgrep’s VS Code extension supports the use of Pro rules and cross-file analysis. Other IDE scans use Semgrep Community Edition (CE) for its speed, and these scans are limited to single-file analysis. As a result, you may encounter a higher rate of false positives.