What you are evaluating
Community Edition versus paid rule quality, lockfile layout for supply-chain results, and interfile analysis on monorepos are the main tests. Community Edition is SAST patterns; composition reachability, secrets, and SBOM are platform features and should not be assumed in the free engine.
A useful evaluation context
A plausible evaluation context is a team that needs custom SAST rules and must decide whether Community Edition is enough or whether Pro, supply-chain, and secrets justify the platform.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Community Edition pattern-based static analysis with custom rules.
- A commercial Pro engine with documented analysis capabilities that should be evaluated separately from Community Edition on the same test corpus.
- Platform supply-chain reachability, secrets detection, and SBOM features that are not the Community Edition engine.
Where it fits in the work
- Run Community Edition or the Platform on a lab repository and write or import rules that match a seeded weakness in the local framework.
- If the Platform is entitled, enable supply-chain reachability and secrets on the same repository and keep those results labeled as paid features.
- Export an SBOM if the Platform produces one, and document lockfile or monorepo limits that blocked a scan.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Scan a lab repository you own with a seeded framework-specific weakness. First use Community Edition custom rules, then, if entitled, the AppSec Platform with supply-chain and secrets on the same repo.
Evidence to look for
The custom rule finds the seeded weakness, Platform-only findings are labeled as such, and any SBOM lists the seeded library or records why the lockfile could not be parsed.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which rules fire on Community Edition versus the Pro engine on this monorepo?
- Does lockfile layout support supply-chain reachability, or are package relationships missing?
- Is interfile analysis complete enough on the repository layout the team actually uses?
Names you may encounter: Semgrep Community Edition · Semgrep Code. Historical names do not establish current availability or feature equivalence.