We rolled out Semgrep across all our repos a year ago. Goal was to shift security left without grinding velocity to a halt. Here's where it landed.
The good: It's fast. Engineers actually run it pre-commit because it doesn't slow them down. The custom rule syntax is straightforward, which let our senior devs write project-specific rules in an afternoon. Found some legit credential-in-code issues early. Monorepo support works as advertised.
The bad: The noise. False positives are a constant battle, especially in our JS/TS services. The default rulesets are blunt instruments. We spent significant time tuning them down to avoid alert fatigue. The dependency scanning (SCA) feels like an afterthought compared to dedicated tools—we still use Dependabot alongside it.
Verdict: It's a decent first-pass SAST tool for the price, especially for custom rules. But it's not a "set and forget" solution. You will need to invest in tuning and maintain a secondary SCA workflow. For a team our size, the ROI is positive, but only because we dedicated eng time to manage it.