Semgrep

Semgrep started as an open-source pattern engine and now sells a hosted AppSec platform with Pro taint analysis, supply-chain reachability, and secrets validation. Multimodal AI triages findings and writes memories so the same false positive is not re-reviewed next week.

Custom rules still read like the source language, which is why security engineers keep it when they outgrow a black-box scanner.