Semgrep

As MIT undergraduates, Isaac Evans, Luke O’Malley and Drew Dennison lived next to each other in Simmons Hall and all studied electrical engineering and computer science. During the 2011 Independent Activities Period they won a contract to help Army personnel use Android phone apps more securely, with Dennison as CTO, Evans as CEO and O’Malley on product, the roles they later took at r2c.⁠[1]

All three took part in the Gordon-MIT Engineering Leadership (GEL) Program. Evans earned his bachelor’s degree in 2013 and a master’s in 2015 with a thesis on advanced software security techniques; Dennison graduated in 2013 and O’Malley in 2014, and the three first joined different companies after graduation.⁠[1]

In 2016 the three began exploring opportunities in software security; Evans and Dennison had been entrepreneurs-in-residence at Redpoint, and between them the founders had worked at PalantirPalantirPalantir is a U.S. enterprise software company founded in 2003 that provides data and artificial intelligence platforms including Gotham, Foundry, Palantir Apollo, and AIP, serving government and commercial organizations. The company went public through a direct listing in 2020 and now trades on Nasdaq under the ticker PLTR.Open the full entry, in the intelligence community and at Fortune 500 companies. The company was founded as r2c in 2017, with Evans as CEO and O’Malley as head of product.⁠[1][2][3]

Evans recalled that the company initially struggled to build a product for developers until Yoann Padioleau, a former Facebook engineer hired in 2018, pointed out that he had built a similar open-source tool at Facebook. The tool originally supported only PHP; at an internal hackathon in 2019 the team decided to revive the project and added support for languages such as Python.⁠[3][1]

r2c released the open-source version of Semgrep at the end of 2020 and built a software service around what it called the “canonical” Semgrep fork, sold as a monthly per-developer subscription that packages security rules across programming languages.⁠[3][4]

In October 2020 r2c raised a $13 million Series A from Satish Dharmaraj of Redpoint and Jim Goetz of Sequoia CapitalSequoia CapitalSequoia Capital is a venture capital firm founded by Don Valentine in 1972, investing from the seed stage through the growth stage. Its historical investments include Apple, Cisco, Google, YouTube, Airbnb, and Stripe; in 2021 it introduced the Sequoia Capital Fund structure, which can continue to hold public securities, and in 2023 its regional businesses became independent brands and partnerships.Open the full entry, both of whom had also backed the company in an earlier, unannounced seed round.⁠[2][4]

On July 7, 2021, r2c announced a $27 million Series B led by FelicisFelicisFelicis (whose funds and earlier brand use the name Felicis Ventures) is a venture capital firm based in Menlo Park, California, founded in 2006 by former Google product manager Aydin Senkut; it has invested in companies including Shopify, Canva and Adyen.Open the full entry, which the company described as a pre-emptive deal; Redpoint and Sequoia Capital also participated.⁠[4]

As of February 2022, Semgrep offered more than 1,500 prewritten rules and worked with over 25 programming languages, and users could write their own rules and contribute them to the database. Large customers included SlackSlackSlack is a team communication and collaboration platform developed from an internal tool at Tiny Speck. It organizes work through channels, direct messages, searchable history and integrations, with features including Huddles, Clips, Canvas and AI assistance. Its paid service launched in February 2014, and Salesforce completed its acquisition in July 2021.Open the full entry, Dropbox and Snowflake. After the Log4Shell vulnerability was exposed, members of r2c’s community Slack channel quickly shared rules for detecting its variants.⁠[1]

O’Malley said: “If you know how to program in a language, you can now write rules and extend Semgrep.”⁠[1]

On April 18, 2023, the company announced a $53 million Series C led by Lightspeed Venture PartnersLightspeed Venture PartnersLightspeed Venture Partners backs companies from seed through late-stage financing. Its website distinguishes Lightspeed Management Company (LSVP) from Lightspeed India Partners (LSIP): the two are separately operated investment advisers, with the U.S., European, and Israeli offices belonging to LSVP and the India and Southeast Asia offices belonging to LSIP.Open the full entry, with Felicis, Redpoint and Sequoia Capital participating, bringing total funding to $93 million, and changed its name from r2c to Semgrep. Evans said the company had not planned to raise until the summer but received a pre-emptive offer.⁠[5][3]

At the time Semgrep’s open-source tooling had around two million users, and the company’s revenue-producing products had grown 7.5-fold in 2022.⁠[3]

On December 13, 2024, Semgrep renamed its open-source engine and rules Semgrep Community Edition and moved Semgrep-maintained rules to the Semgrep Rules License v.1.0, limiting them to internal, non-competing and non-SaaS use, with a grace period until January 31, 2025 for vendors using them in competing products; some JSON and SARIF output fields and experimental features moved to the logged-in commercial engine. The company said the engine itself remained under LGPL 2.1.⁠[6]

Endor Labs subsequently forked Semgrep into Opengrep, with security companies including Aikido Security, Arnica, Jit and Orca Security backing the project. Semgrep’s documentation states that Opengrep was forked from Semgrep Community Edition at v1.100.0, is licensed under LGPL 2.1 and is not affiliated with Semgrep, Inc.⁠[7][8]

On February 5, 2025, Semgrep announced a $100 million Series D led by Menlo Ventures, with existing investors Felicis, Harpoon Ventures, Lightspeed Venture Partners, Redpoint and Sequoia Capital participating. Former Palo Alto NetworksPalo Alto NetworksPalo Alto Networks is an American cybersecurity company that offers network security, cloud security, security operations, identity security, and artificial intelligence security products, and provides threat intelligence, assessment, and incident response services through Unit 42.Open the full entry CEO Mark McLaughlin joined as a board observer and angel investor, and Garrett Souza joined as VP of worldwide sales.⁠[9][10]

In the announcement Evans described “Semgrep 2.0,” a hybrid engine combining the rule-based engine with large language models, and said it identified true positives with a 96% agreement rate among security researchers.⁠[9]

On June 23, 2026, Semgrep launched Semgrep Guardian, which scans and fixes vulnerabilities, malicious packages and hardcoded secrets in code written by AI coding agents directly in the developer’s IDE and ships with an MCP server, Hooks integrations and Skills; the company said it was an official partner of Cursor and Claude Code.⁠[11]

Semgrep: Official website: https://semgrep.dev/ (opens in a new window).⁠[10]

X: Public account: https://x.com/semgrep (opens in a new window).⁠[10]

LinkedInLinkedInLinkedIn is a social networking platform for professionals. It was founded in 2002 by Reid Hoffman and others, launched in 2003, and listed on the New York Stock Exchange in 2011; after Microsoft acquired it for approximately $26.2 billion in 2016, it became a wholly owned Microsoft subsidiary. Its revenue comes from membership subscriptions, advertising, and recruitment solutions.Open the full entry: Public profile: https://www.linkedin.com/company/semgrep/ (opens in a new window).⁠[10]

YouTubeYouTubeYouTube is Google’s video-sharing and creator platform, founded in 2005 by Steve Chen, Chad Hurley, and Jawed Karim and acquired by Google in 2006. Built around video uploading, viewing, and creator earnings, the platform has developed Shorts, YouTube Music, Premium, YouTube TV, and products for children, and is headquartered in San Bruno, California, United States.Open the full entry: Public channel: https://www.youtube.com/c/semgrep (opens in a new window).⁠[10]