# Semgrep vs TruffleHog

| Attribute | Semgrep | TruffleHog |
|---|---|---|
| **Vioscale score** | 64.7 (76% (high)) | 60.3 (48% (low)) |
| activity.commits_last_30d | 42 | 52 |
| adoption.dependent_repos | 375 | 519 |
| adoption.github_stars | 16,407 | 27,596 |
| adoption.package_downloads_weekly | 6,990,780 | - |
| deployment.options | `{"cloud":true,"hybrid":true,"on_prem":true,"self_hosted":true}` | `{"cloud":true,"on_prem":true,"self_hosted":true}` |
| description.long | A SaaS application security platform combining static code analysis, software composition analysis, and secrets detection in one tool. Uses AI to reduce false positives and prioritize exploitable vulnerabilities discovered during development. | A security tool that scans code repositories, chat systems, artifact storage, and other SDLC platforms for leaked credentials. It verifies which secrets remain active and provides continuous monitoring and remediation guidance. |
| features.capabilities | `{"sca":true,"dast":false,"sast":true,"sbom":true,"hosting":"both","ci_native":true,"iso_27001":false,"ide_plugin":true,"auto_fix_pr":true,"open_source":true,"iac_scanning":true,"reachability":true,"soc2_type_ii":false,"pricing_model":"per_developer_seat","secret_scanning":true,"deployment_model":"hybrid","container_scanning":false,"license_compliance":true,"slack_teams_jira_scanning":true,"compliance_audit_reporting":true,"custom_regex_rules_support":true,"pre_commit_developer_hooks":true,"high_entropy_regex_detection":true,"automated_key_revocation_apis":false,"ci_cd_pipeline_build_blocking":true,"active_token_validation_engine":true,"git_repository_historical_scanning":true}` | `{"sca":false,"hosting":"both","ci_native":true,"open_source":true,"reachability":true,"secret_scanning":true,"container_scanning":true}` |
| integrations.count | 20 | 23 |
| integrations.list | `[{"name":"GitHub"},{"name":"GitLab"},{"name":"Bitbucket"},{"name":"Jenkins"},{"name":"CircleCI"},{"name":"Azure"},{"name":"Buildkite"},{"name":"HackerOne"},{"name":"Slack"},{"name":"Email"},{"name":"Webhooks"},{"name":"VS Code"},{"name":"IntelliJ"},{"name":"Jira"},{"name":"Wiz"},{"name":"Palo Alto Networks Cortex"},{"name":"REST API"},{"name":"Cursor"},{"name":"Replit"},{"name":"Codacy"},{"name":"OpenID Connect"},{"name":"SAML"},{"name":"GitHub OAuth"},{"name":"GitLab OAuth"},{"name":"Azure AD"},{"name":"Azure DevOps"},{"name":"Jetbrains"},{"name":"OAuth2"}]` | `[{"name":"GitHub"},{"name":"GitLab"},{"name":"Bitbucket"},{"name":"Gerrit"},{"name":"Git"},{"name":"Docker"},{"name":"Artifactory"},{"name":"Jenkins"},{"name":"Buildkite"},{"name":"Azure Repos"},{"name":"Travis CI"},{"name":"Circle CI"},{"name":"Slack"},{"name":"Teams"},{"name":"Jira"},{"name":"Vector"},{"name":"Confluence"},{"name":"Google Drive"},{"name":"S3"},{"name":"SharePoint"},{"name":"Splunk"},{"name":"Webhook"},{"name":"Email"}]` |
| language.primary | OCaml | Go |
| license.spdx | LGPL-2.1 | AGPL-3.0 |
| market.availability | `{"hqCountry":"US","primaryMarkets":["US"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | `{"primaryMarkets":["US"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | `{"cli":true,"web":true}` | `{"cli":true,"web":true}` |
| pricing | `{"type":"subscription","plans":[{"free":true,"name":"Free Edition","summary":"Free","features":["Cross-file analysis with Pro rules","AI-powered detection, triage, and remediation","Code scanning","Supply Chain scanning","60 AI credits","Fast CI/CD deploy via Semgrep infrastructure","Authentication via GitHub/GitLab"],"components":[{"kind":"fixed","amount":0,"period":"month","currency":"USD"}],"description":"Get started with core scanning capabilities and AI credits","contactSales":false,"includedLimits":{"ai_credits":"60","contributors":"10 max","repositories":"10 max"}},{"free":false,"name":"Teams","summary":"$30/contributor/mo (Code or Supply Chain) or $15/contributor/mo (Secrets)","features":["One-click CI/CD deploy using Semgrep infrastructure","Single sign-on (SSO)","Award-winning support","Pro Engine with 35+ supported languages","Cross-function Taint Analysis","Cross-file Analysis","Reachability Analysis","Malicious Dependency Detection","SBOM Generation","License Compliance Checking","Semantic and Entropy Analysis","Secret Validation","Pre-Commit Hook","AI-powered detection and remediation","Slack and Email notifications","Jira Ticketing","REST API","OIDC + SAML","RBAC"],"components":[{"kind":"per_unit","unit":"contributor","amount":30,"period":"month","currency":"USD"},{"kind":"per_unit","unit":"contributor","amount":15,"period":"month","currency":"USD"}],"description":"Choose from Code (SAST), Supply Chain (SCA), or Secrets detection modules","contactSales":false,"includedLimits":{"public_repositories":"500 max","ai_credits_per_developer":"20 per month"}},{"free":false,"name":"Enterprise","summary":"Custom pricing. Starts at $30/contributor/mo with volume discounts","features":["Everything in Teams, plus:","Support for on-prem source code management","Support for custom CI/CD integrations","Optional deployment in dedicated infrastructure","Unlimited repositories and contributors","Dedicated account manager","Tailored onboarding","Volume pricing","AI coding agent plugin","Wiz Integration","Palo Alto Networks Cortex Integration"],"description":"Customized solution with dedicated support and flexible deployment options","contactSales":true,"includedLimits":{"contributors":"Unlimited","repositories":"Unlimited","ai_credits_per_developer":"50 per month"}}],"summary":"Free tier available. Teams start at $30/contributor/mo. Enterprise custom pricing with volume discounts.","currency":"USD","freeTier":true,"sourceUrl":"https://semgrep.dev/pricing/","retrievedAt":"2026-08-24T22:43:17.889Z","startingPrice":{"unit":"contributor","amount":15,"period":"month","currency":"USD"},"billingPeriods":["month"]}` | `{"type":"free","plans":[{"free":true,"name":"Open Source","summary":"Free","features":["GitHub, S3, directory, GCS, and Docker scanning","800+ secret detectors","GitHub actions, pre-commit, and pre-receive hooks","Custom regex and secrets verification","Automatic updates"],"description":"GitHub, S3, directory, GCS, and Docker scanning with 800+ secret detectors","contactSales":false,"includedLimits":{"sources":"GitHub, S3, GCS, Docker, directory","detectors":"800+"}}],"addOns":[{"name":"TruffleHog Analyze for SaaS"},{"name":"TruffleHog Analyze for Cloud"},{"name":"Forager (Public Dataset Monitoring)"}],"summary":"Free core product; enterprise features and add-ons available via contact sales","freeTier":true,"sourceUrl":"https://trufflesecurity.com/pricing","retrievedAt":"2026-08-14T15:25:30.270Z"}` |
| pricing.free_tier | yes | yes |
| pricing.model | freemium | commercial |
| pricing.price_level | mid | free |
| pricing.starting_price | `{"amount":15,"currency":"USD"}` | - |
| pricing.transparent | yes | no |
| release.cadence_days | 7 | 7 |
| release.history | `[{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.175.0","date":"2026-08-26T17:08:58Z","type":"stable","version":"v1.175.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.174.0","date":"2026-08-20T15:58:17Z","type":"stable","version":"v1.174.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.173.0","date":"2026-08-13T16:49:55Z","type":"stable","version":"v1.173.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.172.0","date":"2026-07-28T22:40:28Z","type":"stable","version":"v1.172.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.171.0","date":"2026-07-22T23:05:43Z","type":"stable","version":"v1.171.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.170.0","date":"2026-07-15T17:02:36Z","type":"stable","version":"v1.170.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.169.0","date":"2026-07-08T22:47:29Z","type":"stable","version":"v1.169.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.168.0","date":"2026-06-24T19:37:09Z","type":"stable","version":"v1.168.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.167.0","date":"2026-06-17T18:21:17Z","type":"stable","version":"v1.167.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.166.0","date":"2026-06-11T14:00:10Z","type":"stable","version":"v1.166.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.165.0","date":"2026-06-03T22:02:47Z","type":"stable","version":"v1.165.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.164.0","date":"2026-05-27T14:35:42Z","type":"stable","version":"v1.164.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.163.0","date":"2026-05-15T16:06:24Z","type":"stable","version":"v1.163.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.162.0","date":"2026-05-07T16:03:28Z","type":"stable","version":"v1.162.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.161.0","date":"2026-04-22T20:28:49Z","type":"stable","version":"v1.161.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.160.0","date":"2026-04-16T18:11:46Z","type":"stable","version":"v1.160.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.159.0","date":"2026-04-10T21:00:33Z","type":"stable","version":"v1.159.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.158.0","date":"2026-04-10T01:46:48Z","type":"stable","version":"v1.158.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.157.0","date":"2026-03-31T22:51:26Z","type":"stable","version":"v1.157.0"},{"url":"https://github.com/semgrep/semgrep/releases/tag/v1.156.0","date":"2026-03-17T21:18:25Z","type":"stable","version":"v1.156.0"}]` | `[{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.1","date":"2026-08-24T16:53:20Z","type":"stable","version":"v3.97.1"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.0","date":"2026-08-14T18:35:16Z","type":"stable","version":"v3.97.0"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.96.0","date":"2026-07-24T18:23:23Z","type":"stable","version":"v3.96.0"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.9","date":"2026-07-09T23:09:52Z","type":"stable","version":"v3.95.9"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.8","date":"2026-07-02T18:54:37Z","type":"stable","version":"v3.95.8"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.7","date":"2026-06-29T15:50:35Z","type":"stable","version":"v3.95.7"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.6","date":"2026-06-18T14:38:38Z","type":"stable","version":"v3.95.6"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.5","date":"2026-06-02T16:10:06Z","type":"stable","version":"v3.95.5"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.4","date":"2026-06-02T06:20:51Z","type":"stable","version":"v3.95.4"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.3","date":"2026-05-11T18:38:34Z","type":"stable","version":"v3.95.3"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.2","date":"2026-04-21T20:29:49Z","type":"stable","version":"v3.95.2"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.1","date":"2026-04-21T18:12:48Z","type":"stable","version":"v3.95.1"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.0","date":"2026-04-21T17:39:24Z","type":"stable","version":"v3.95.0"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.3","date":"2026-04-08T17:02:29Z","type":"stable","version":"v3.94.3"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.2","date":"2026-04-01T13:03:44Z","type":"stable","version":"v3.94.2"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.1","date":"2026-03-25T16:18:15Z","type":"stable","version":"v3.94.1"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.0","date":"2026-03-20T14:51:55Z","type":"stable","version":"v3.94.0"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.8","date":"2026-03-09T20:04:03Z","type":"stable","version":"v3.93.8"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.7","date":"2026-03-04T15:58:48Z","type":"stable","version":"v3.93.7"},{"url":"https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.6","date":"2026-02-27T15:09:47Z","type":"stable","version":"v3.93.6"}]` |
| reliability.sla_pct | - | 99 |
| reliability.status_page | yes | yes |
| security.disclosure_policy | yes | - |
| security.gdpr | yes | yes |
| security.scorecard | - | 7.4 |
| security.soc2 | yes | - |
| security.vulnerabilities | `{"count":0,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=pypi&package_name=semgrep&per_page=100","last_12m":0,"max_severity":null}` | - |

## Capabilities (DevSecOps Tools)

| Capability | Semgrep | TruffleHog |
|---|:--:|:--:|
| **Scan types** |  |  |
| SAST (static analysis) | ✓ | - |
| DAST (dynamic analysis) | ✗ | - |
| SCA / dependency scanning | ✓ | ✗ |
| Secret scanning | ✓ | ✓ |
| Container / image scanning | ✗ | ✓ |
| IaC misconfiguration scanning | ✓ | - |
| **Governance** |  |  |
| OSS licence compliance | ✓ | - |
| SBOM generation (SPDX/CycloneDX) | ✓ | - |
| **Remediation** |  |  |
| Automated fix / upgrade PRs | ✓ | - |
| **Prioritisation** |  |  |
| Reachability / exploitability prioritisation | ✓ | ✓ |
| **Deployment** |  |  |
| Hosting | Cloud + self-hosted | Cloud + self-hosted |
| **Integration** |  |  |
| First-class CI / pipeline integration | ✓ | ✓ |
| In-editor / IDE scanning | ✓ | - |
| **Licensing** |  |  |
| OSS engine available | ✓ | ✓ |

*Source: Vioscale. Generated 2026-09-01T17:30:58.302Z. "-" = undocumented, not absent.*