Is Semgrep suitable for engineering teams that want to write custom security rules?

Direct answer

Yes. Semgrep has the most approachable rule syntax of the major SAST tools, custom rules work on the free tier, and rules live in your repo as YAML you can review like code. The limit is structural: rules match patterns you already know to look for, so custom rules scale your known unknowns and do nothing for the bugs nobody thought to write a rule about.

Muhammad HasanUpdated

Semgrep's rule syntax is closer to writing an example of the bad code than to writing a query. That lowers the barrier enough that application engineers, not just the security team, can add rules — which is the main reason custom rulesets tend to survive past the person who created them.

Where custom rules stop helping

Every rule encodes something you already suspected. That makes them excellent for enforcing decisions your team has made: a banned function, an internal API used the wrong way, a pattern you've been burned by before. It does nothing for the class of bug where the vulnerability is the absence of a check rather than the presence of a bad one.

Go deeper

Kolega vs Semgrep

See what your own repository returns

Connect a repo and run a scan. No credit card, no pipeline changes.

Get started for free