June 2025 Summaries

An independent research study by Doyensec compared the Semgrep Community Edition and the commercial Semgrep Code, focusing on their effectiveness as static application security testing (SAST) tools. The research, supported financially by Semgrep but conducted with full editorial independence, utilized standardized vulnerable applications, OWASP WebGoat and OWASP Juice Shop, to evaluate detection capabilities and reliability. The findings indicated that Semgrep Code offers a significantly higher true positive rate in detecting vulnerabilities compared to the Community Edition, without increasing false positives, thanks to enhancements like inter-file dataflow analysis, inter-procedural analysis, and additional security rules. While the Community Edition is a cost-effective entry point for basic security scanning, the study suggests that upgrading to Semgrep Code can provide substantial improvements in detection rates, especially as organizational needs evolve, making it a worthwhile investment for those requiring enhanced security coverage and developer efficiency.

Semgrep has introduced the first reachability analysis for PHP, a popular server-side language powering over 70% of websites, to enhance security by reducing noise in vulnerability alerts. This analysis, which is available for 12 programming languages including PHP, identifies not only whether a codebase includes a dependency with a known vulnerability but also if the code executes the vulnerable parts in a harmful manner. This allows security teams to notify developers or fail builds only for vulnerabilities that are truly reachable. An example is given using CVE-2016-10033, an injection vulnerability in the PHPMailer library, where the reachability analysis determines if an application executes the vulnerable mail() function. Now generally available, Semgrep Supply Chain's reachability analysis for PHP includes all critical severity issues back to 2017 and high severity issues from May 2022 onwards. Existing customers automatically receive this feature, while new users can access it by creating an account and scanning their projects.

Semgrep has introduced Assistant Memories, a feature that allows its security platform to continuously learn from interactions such as manual triage and developer feedback, thus personalizing the static application security testing (SAST) tool to specific organizational contexts. This enhancement reduces false positives, as Memories enable the tool to store and apply contextual information about an environment, thereby improving the accuracy of triage decisions. Assistant Memories allows Semgrep to transform manual triage into a high-return-on-investment activity by permanently decreasing irrelevant alerts, with users able to preview and activate suggested memories for specific projects, rules, or vulnerability classes. The platform's accuracy is underscored by high user agreement rates, and its architecture is designed to integrate future AI model improvements, ensuring ongoing advancements in security effectiveness and reliability.

Semgrep, a tool used by security researchers, pentesters, consultants, and developers, has released version 1.124, which includes performance improvements that can make the tool up to three times faster under certain conditions. This update focuses on improving rule-loading speed, especially when using many small rule files, and is a response to community feedback that identified a bottleneck in rule validation. Although the performance gains are more noticeable in smaller repositories, the enhancements represent a significant win for the ecosystem by enabling quicker iterations during local development. Semgrep's open-source Community Edition, licensed under LGPL 2.1, benefits from customer and community contributions, ensuring continuous improvements in security and performance. The developers are also exploring experimental and managed scans to enhance horizontal scalability and continuous analysis, demonstrating a commitment to security coverage without compromise.