Semgrep vs Dependabot

From $40 per contributor/month (indicative)

Free

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Completely free. Advanced Security features such as code scanning are separately licensed.

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

Free on all GitHub repositories including private ones.

Widely used

Semgrep · since 2020

Category standard

GitHub (Microsoft) · since 2017

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Free and requires a single config file to enable.
• Version-bump pull requests mean remediation is a review, not a task.
• Grouped updates keep the PR volume manageable.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

• No reachability analysis, so it reports vulnerabilities in code you never call.
• PR noise is a genuine problem on large dependency trees without grouping configured.
• GitHub only.

Teams that want customisable static analysis and can start entirely for free.

Every GitHub repository, as the free baseline before considering a paid SCA tool.