Is Semgrep Free for Commercial Use? Yes, With Two Catches

The short answer

Yes, Semgrep is free for commercial use. There are two separate free paths and it helps to know which one you are on.

Semgrep Community Edition is the open-source engine under LGPL-2.1. Run it commercially, in CI, on proprietary code, with no contributor limit and no licence fee. No login required.

The hosted Semgrep platform is free for up to 10 contributors. That gets you the commercial features - Pro rules, cross-file analysis, supply chain scanning - at no cost, for small teams.

The catches are not licensing catches. They are about analysis depth and how contributors get counted.

Catch one: single-file analysis

This is the difference that actually matters, and it is easy to miss because it is a capability of the engine rather than a line item on a pricing page.

Community Edition analyses one file, or one function, at a time. It matches patterns within that scope. It is fast, deterministic, and genuinely good at what it does.

The paid engine does cross-file and cross-function analysis. It traces data flow from where untrusted input enters your application to where it reaches something dangerous, across module boundaries.

That distinction maps almost exactly onto which bugs you find. A hardcoded secret, a dangerous function call, a known-bad pattern in a single block - Community Edition catches these. A user-controlled value that enters through a request handler, gets passed through three helpers in two files, and lands in a SQL string - Community Edition does not see it, because it never has both ends in view at once.

The serious findings disproportionately live in the second category. So “are the free rules good enough” is slightly the wrong question. The rules are fine. The scope of analysis is the constraint.

You also get roughly 2,800 community rules free versus 20,000+ Pro rules paid, but the rule count is the less important number of the two.

Catch two: how contributors get counted

Pricing is $35 per contributor per month for the bundled Team plan, and free up to 10 contributors.

Contributors are counted from commit activity in connected repositories, not from seats you assign. This is a meaningfully different billing model from per-seat pricing and it surprises people in three ways:

• It moves on its own. Onboard three engineers and your count rises without anyone touching Semgrep’s settings.
• It counts people who never use the tool. A designer who commits a CSS change, a contractor who pushed once, a bot account committing dependency bumps - all potentially contributors.
• The 10-contributor free tier is easier to exceed than a 10-seat one. A team of eight engineers plus a couple of occasional committers is already at the line.

None of this is hidden, and the model has a logic to it - Semgrep scans the code, so it prices on who writes the code. But if you are budgeting against headcount, budget against commit history instead, and check what your actual contributor count is before assuming you fit in the free tier.

What each tier gets you

	Community Edition	Team (free ≤10 contributors)	Team (paid)
Licence	LGPL-2.1, open source	Commercial	Commercial
Cost	Free, unlimited contributors	Free	$35/contributor/mo
Analysis scope	Single file / function	Cross-file, cross-function	Cross-file, cross-function
Rules	~2,800 community	20,000+ Pro	20,000+ Pro
Supply chain (SCA)	No	Yes, with reachability	Yes, with reachability
Secrets detection	Pattern-based	Semantic	Semantic
AI triage (Assistant)	No	Yes	Yes
Dashboard / reporting	No	Yes	Yes
Login required	No	Yes	Yes

Individual products are also sold separately at roughly $20-40 per contributor per month. If you want two or more, the $35 bundle is the better deal, which is clearly the intent.

Is LGPL-2.1 a problem?

For the normal case, no, and this trips people up more than it should.

Running Semgrep as a scanner on your own code is unambiguously fine. LGPL obligations concern distribution of the library, particularly modified versions. Invoking a scanner in your CI pipeline is use, not distribution. No copyleft obligation attaches to the code being scanned - your proprietary source does not become LGPL because a GPL-family tool looked at it.

Where it needs a lawyer: if you plan to embed the Semgrep engine inside a product you ship, or distribute a modified version of it. Then LGPL’s terms about relinking and source availability actually engage. That is a genuine legal question and not one to resolve from a blog post.

For the overwhelming majority of teams - scan our repos in CI, fix what it finds - there is nothing to clear with legal.

When the free tier is genuinely enough

Community Edition is enough if: you want secret detection and well-known vulnerability patterns as a fast pre-commit or CI gate, you have security review elsewhere in the process, or you are writing custom rules for your own codebase conventions. Semgrep’s rule syntax looks like the code it matches, which makes custom rules unusually approachable - this is a real reason to run it even alongside another scanner.

The free Team tier is enough if: you are genuinely under 10 contributors and expect to stay there. You get the full commercial capability at no cost, which is a strong offer.

You need to pay when: you cross 10 contributors, or when single-file analysis stops being enough - which usually announces itself as a security incident traced to a data flow your scanner could not see.

How it fits with everything else

Semgrep is a security scanner, not a code reviewer, and the distinction matters when you are assembling a stack. It answers “does this match a known-dangerous pattern,” deterministically and fast. It does not evaluate whether your logic is correct or your architecture is sensible.

Most teams end up running it alongside something that does the other job - an AI reviewer like CodeRabbit for contextual feedback, or SonarQube for quality metrics and technical debt tracking. Our Semgrep review has the full evaluation, and Semgrep alternatives covers the comparison set if the contributor pricing does not work for you.

Bottom line

Free for commercial use, genuinely, with an open-source licence that will not cause you problems for normal use.

Plan around the two real constraints instead: Community Edition sees one file at a time, and the 10-contributor free tier counts commit history rather than seats. Both are knowable in advance, and both are cheaper to discover now than after you have built a security process on top of them.

Further Reading

• Is Semgrep Free? Understanding OSS vs Semgrep Cloud in 2026
• ripgrep vs grep: Performance Benchmarks and Why AI Agents Use rg