Semgrep vs GitHub Advanced Security
Four of fourteen models named Semgrep first on the direct prompt; zero named GitHub Advanced Security. Semgrep was named by fourteen of the fourteen models and GitHub Advanced Security by eleven and Semgrep carries 63 labels and GitHub Advanced Security 16, so the shares are not directly comparable.
Named in three categories this edition.
Named in five categories this edition.
Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the static application security testing page.
By framing
SemgrepFirst choices, of fourteen modelsGitHub Advanced Security
Across every category in the October 2026 Edition, Semgrep and GitHub Advanced Security were named in the same answer forty-five times, of the 208 answers naming Semgrep and the 125 naming GitHub Advanced Security. In those answers GitHub Advanced Security took the first choice two times and Semgrep sixteen.
Every model, every framing
| Model | Direct | Paraphrase | Comparative | Budget-constrained | Scale-constrained | Negative |
|---|---|---|---|---|---|---|
| Claude Haiku 4.5 | | | ||||
| GPT-5.4 mini | | | ||||
| Gemini 3.5 Flash | | | | | | |
| Perplexity Sonar | | | ||||
| Grok 4.1 Fast | | | | | | |
| Mistral Small | | | | |||
| DeepSeek V4 Flash | | | | | | |
| Llama 4 Maverick | ||||||
| Qwen 3.7 Flash | | | | | | |
| Kimi K2 | | | | | | |
| GLM 4.7 FlashX | | | | | ||
| MiniMax M2.5 | | | | | ||
| GPT-6 Luna | | | | | | |
| Muse Glimmer 30B | | | | | |
Semgrep GitHub Advanced Security first choice named as an alternative argued againstblank: not namedEach cell is one answer, Semgrep on the left and GitHub Advanced Security on the right.The direct prompt
Semgrep first, GitHub Advanced Security an alternative
4 of 14 modelsGitHub Advanced Security was named in the answer but not as the choice, or not at all.Neither was the first choice, one was named
8 of 14 modelsThe answer put something else first and named one of the two as an alternative.Neither was named
2 of 14 modelsThe answer made no first choice from these two in this category.Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.
By buyer segment
Semgrep53%#1 of 13GitHub Advanced Security2%#6 of 13Semgrep36%#1 of 10GitHub Advanced Security2%#6 of 10Semgrep4%#5 of 10GitHub Advanced Security2%#8 of 10What the models said about Semgrep
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of seven in this category shown.
“Semgrep OSS and Bandit are fast and low false-positive for obvious patterns, but miss vulnerabilities that span multiple functions... insufficient as sole nightly security scanners” Muse Glimmer 30B · negative prompt · soft negative
“Semgrep Community Edition as your only deep security scanner: It can be useful for fast checks and custom rules, but its analysis is limited to a file/function context” GPT-6 Luna · negative prompt · soft negative
“Checkmarx, Veracode, and Semgrep have all struggled with this because their rule-based engines flag anything that could be a vulnerability” Claude Haiku 4.5 · negative prompt · soft negative
“Semgrep as the primary scanner across all languages... For most budget-constrained companies, Semgrep OSS + SonarQube Community Edition... is the most commonly recommended starting point” Muse Glimmer 30B · budget prompt · first choice
“Tools like Semgrep are generally preferred for modern CI/CD because they are lightweight, customizable, and run significantly faster.” GLM 4.7 FlashX · negative prompt · first choice
“look for developer-friendly alternatives like Semgrep, where rules are written in YAML and read like standard code” Gemini 3.5 Flash · negative prompt · first choice
What the models said about GitHub Advanced Security
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Three of three in this category shown.
“GHAS is sold as an add-on license that can be quite expensive for a mid-sized B2B budget.” Gemini 3.5 Flash · paraphrase prompt · soft negative
“Top Recommendation: GitHub Advanced Security (GHAS)” Kimi K2 · paraphrase prompt · first choice
“GitHub Advanced Security / CodeQL if your company is deeply GitHub-native and wants SAST in the same platform.” Muse Glimmer 30B · comparative prompt · alternative
Comparisons are drawn for the top eight products in each category, each against each. The output is the models' output; nothing here is a recommendation by the index.