Four of fourteen models named Semgrep first on the direct prompt; two named Snyk. Semgrep was named by fourteen of the fourteen models and Snyk by seven and Semgrep carries 63 labels and Snyk 11, so the shares are not directly comparable.
Named in three categories this edition.
Named in eleven categories this edition.
Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the static application security testing page.
Across every category in the October 2026 Edition, Semgrep and Snyk were named in the same answer forty-two times, of the 208 answers naming Semgrep and the 177 naming Snyk. In those answers Snyk took the first choice ten times and Semgrep eight.
| Model | Direct | Paraphrase | Comparative | Budget-constrained | Scale-constrained | Negative |
|---|---|---|---|---|---|---|
| Claude Haiku 4.5 | ||||||
| GPT-5.4 mini | ||||||
| Gemini 3.5 Flash | ||||||
| Perplexity Sonar | ||||||
| Grok 4.1 Fast | ||||||
| Mistral Small | ||||||
| DeepSeek V4 Flash | ||||||
| Llama 4 Maverick | ||||||
| Qwen 3.7 Flash | ||||||
| Kimi K2 | ||||||
| GLM 4.7 FlashX | ||||||
| MiniMax M2.5 | ||||||
| GPT-6 Luna | ||||||
| Muse Glimmer 30B |
Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of seven in this category shown.
“Semgrep OSS and Bandit are fast and low false-positive for obvious patterns, but miss vulnerabilities that span multiple functions... insufficient as sole nightly security scanners” Muse Glimmer 30B · negative prompt · soft negative
“Semgrep Community Edition as your only deep security scanner: It can be useful for fast checks and custom rules, but its analysis is limited to a file/function context” GPT-6 Luna · negative prompt · soft negative
“Checkmarx, Veracode, and Semgrep have all struggled with this because their rule-based engines flag anything that could be a vulnerability” Claude Haiku 4.5 · negative prompt · soft negative
“Semgrep as the primary scanner across all languages... For most budget-constrained companies, Semgrep OSS + SonarQube Community Edition... is the most commonly recommended starting point” Muse Glimmer 30B · budget prompt · first choice
“Tools like Semgrep are generally preferred for modern CI/CD because they are lightweight, customizable, and run significantly faster.” GLM 4.7 FlashX · negative prompt · first choice
“look for developer-friendly alternatives like Semgrep, where rules are written in YAML and read like standard code” Gemini 3.5 Flash · negative prompt · first choice
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Two of two in this category shown.
“"We are forced to use Snyk–it's basically infuriating support and false positives... it's also insanely expensive"” Claude Haiku 4.5 · negative prompt · soft negative
“Snyk appears to be the most frequently recommended option for mid-market B2B companies running modern stacks” MiniMax M2.5 · direct prompt · first choice
Comparisons are drawn for the top eight products in each category, each against each. The output is the models' output; nothing here is a recommendation by the index.