If you vibe-coded a real app, the single highest-leverage thing you can do this week is put a scanner between your generated code and production. Semgrep is the one to reach for: it's free at the tier most solo founders need, it installs in minutes, and it exists to catch exactly the flaws AI generators leave behind.
Here's the stakes in one number. Veracode's 2025 study found AI-generated code shipped a security vulnerability in 45% of tasks — and that rate stayed flat across model sizes and generations. The model won't warn you, because it optimized for "does this run," not "is this safe." A static analyzer in CI is how you get the review that a codebase you didn't write will otherwise never receive.
What it is#
Semgrep is a SAST tool — static application security testing. It reads your source without executing it and flags patterns that signal a vulnerability: SQL injection, hard-coded secrets, unsafe deserialization, missing authorization checks, and thousands of other classes drawn from the OWASP Top 10 and beyond.
The trick that makes Semgrep different: a rule looks like the code it's matching. You don't learn a query language — you write a pattern that resembles the buggy code, and Semgrep finds every variant of it.
That readability is why it's a good fit for non-experts. You lean on the 3,000-plus maintained rules for coverage, and when you find a mistake specific to your app, you write a one-line rule so it can never come back.
What you get for free#
The open-source Community edition is free and unlimited: the full rule set, single-file scanning, IDE extensions, and CI/CD integration. Custom rule authoring works identically to the paid tiers — nothing about writing your own rules is gated.
The hosted AppSec Platform free tier adds the pieces that matter most for generated code, for up to 10 contributors and 10 private repos:
- Semgrep Code — cross-file (interfile) SAST, so a flaw that spans two modules doesn't slip through.
- Semgrep Supply Chain — SCA for vulnerable dependencies, with reachability analysis that tells you which CVEs are actually callable from your code, so you chase the handful that matter instead of every transitive alert.
- Semgrep Secrets — leaked-credential detection across 630+ credential types, which is precisely the "get secrets out of the client" control every generated app needs.
Three of the controls a vibe-coded app is missing — code scanning, dependency scanning, and secret detection — in one free tool.
Start in an afternoon#
# install
pip install semgrep # or: docker run --rm -v "$PWD:/src" semgrep/semgrep
# scan now, see findings immediately
semgrep --config auto
# then add one CI step that fails the build on new high-severity results
semgrep ciRun --config auto locally first to see where you stand; the number of findings on a freshly generated app is usually its own argument. Then wire semgrep ci into your pipeline and gate merges on it. The setup is quick — the real work is triaging that first batch, which is the review generated code was supposed to get and never did.
When to pay#
If you blow past the free tier's 10-contributor / 10-repo caps, the Team plan is $35 per contributor per month (billed annually) and adds unlimited repos, all engines, an AI triage assistant, and policy management. But be honest about when you need it: for a solo founder with a couple of repos, the free tier is not a teaser — it's the whole tool. Install it before your generated app takes its next real user.
