Semgrep

Tracked because Semgrep has a strong research-based baseline (extensive vendor docs, multiple independent SAST comparisons, third-party case studies via InfoQ/Gartner Peer Insights, G2 4.6/55) but no internal hands-on testing has been performed — and an unresolved, publicly-claimed (Qilin, unverified by Semgrep) ransomware/data-exfiltration listing is itself a reason not to elevate until clarified. Rating 71 with evidence grade B (depth=thorough full-research pass, handsOn=not_tested).

Re-baselined under evalModel claude-opus-4-8. Upgrade to Assessed when WWT pilots Semgrep on a sample codebase and independently validates the Multimodal accuracy claims (which remain vendor-reported), or when an internal evaluation captures real-world false-positive rates against our code patterns — and after the breach claim is resolved with no confirmed customer-data exposure.

Upgrade if: Semgrep confirms the May 2026 breach claim was contained with no customer source-code/scan-data exposure (post-mortem published) and trust signals recover; Custom Workflows exits gating with documented enterprise adoption; SCIM ships; IntelliJ extension reaches Pro/Supply-Chain/Secrets parity; EU data residency launches; independent (non-vendor) benchmark validates the 8x TP / 50% FP Multimodal claims; named Fortune 500 customer goes on-record with deployment metrics. Downgrade if: Qilin leak materializes with confirmed customer data/source-code exposure (would trigger critical-security-vuln cap → compliance ≤5 and cap signal to Tracked); Opengrep captures additional named platform/enterprise migrations beyond Codacy; AI Detection accuracy complaints surface in community; a second material outage within 90 days; GitHub Advanced Security closes the feature gap with bundled AI detection.