Semgrep vs TruffleHog

From $40 per contributor/month (indicative)

Free tier available

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

Open-source CLI is free and fully functional including verification.

Widely used

Semgrep · since 2020

Widely used

Truffle Security · since 2016

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Live verification cuts false positives to near zero for supported providers.
• Free and easy to add as a pre-commit hook or CI step.
• Scans far beyond git — buckets, images, logs.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

• No dashboard or workflow in the free CLI.
• Verification requires outbound network calls, which some environments block.
• Full-history scans on large repositories are slow.

Teams that want customisable static analysis and can start entirely for free.

Teams that want free, high-signal secret scanning in the pipeline today.