Snyk vs Semgrep

From $25 per contributing developer/month (indicative, Team)

From $40 per contributor/month (indicative)

Priced per contributing developer. Enterprise agreements add reporting and governance and get expensive.

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Free plan with a monthly test allowance, generous enough for small projects.

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

Category standard

Snyk · since 2015

Widely used

Semgrep · since 2020

• Reachability analysis dramatically cuts the noise from transitive dependency alerts.
• Automated fix pull requests make remediation a merge rather than a project.
• One vendor covers dependencies, code, containers and IaC.

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Per-developer pricing scales uncomfortably in large engineering organisations.
• SAST is less deep than dedicated code-analysis vendors.
• Still produces substantial alert volume on older codebases.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

Engineering teams that want security findings arriving in the pull request with a fix attached.

Teams that want customisable static analysis and can start entirely for free.