Platform Bundling Threatens Semgrep

This matters because bundling turns security scanning from a separate buying decision into a checkbox inside the repo and cloud tools teams already pay for. Semgrep is strongest when it wins on speed, rule flexibility, and lower noise, but GitHub, GitLab, and AWS can place similar scans directly in pull requests, CI pipelines, and security dashboards with far less procurement friction.

• GitHub is the clearest example. Code Security is sold at $30 per active committer per month, powered by CodeQL, and free for public repositories. That puts code scanning in the same pull request workflow Semgrep targets, while making adoption a platform setting rather than a new vendor rollout.
  2 github 3 github 4 github
• GitLab shows the squeeze from the other direction. Its Ultimate tier includes a Semgrep based SAST analyzer, so GitLab customers can get Semgrep style scanning at no extra line item. GitLab has also added its own Advanced SAST engine, which reduces the need to buy a standalone tool over time.
  5 gitlab 6 gitlab 7 sacra
• AWS expands the threat beyond source control platforms. Amazon Inspector code security, launched in June 2025, scans source code, dependencies, and IaC in GitHub, GitLab, and CI pipelines, then rolls findings into the broader AWS security console. For cloud native teams, that makes AppSec part of the AWS bill and workflow.
  1 sacra 8 amazon

The next phase is a market where baseline AppSec is bundled into developer and cloud platforms, and independents win only if they are obviously better at precision, coverage, and remediation speed. That pushes Semgrep toward higher value layers, especially noisy real world codebases, custom rules, AI generated code review, and workflows that bundled tools still handle less well.