SlopGrade vs Semgrep
Semgrep is an excellent open engine: you (or its registry) author patterns and tune them to your code. SlopGrade is the opposite trade-off — a curated rulepack you turn on, where the gate blocks only what the pull request introduces (on 52,089 ordinary open-source pull requests it blocked 59, 0.11 %), returning a deterministic pass/block instead of a findings list to tune.
Semgrep gives you total control: write any rule, match any pattern, run locally or in the Semgrep AppSec Platform. The cost is ownership — someone authors and maintains the ruleset, tunes false positives, and keeps it current. SlopGrade removes that job: the rulepack is curated and calibrated for you, including the cross-tenant leak most teams never write a rule for, and the output is a hard gate, not a queue.
SlopGrade vs Semgrep
Pick Semgrep when you have the appetite to own and tune a ruleset and want maximal control. Pick SlopGrade when you'd rather turn on a calibrated gate — especially for cross-tenant isolation — and get a hard pass/block instead of a list to manage.
Can I use both?
Yes. Some teams keep Semgrep for bespoke, org-specific patterns and add SlopGrade as the turnkey, calibrated gate for the universal high-severity classes — including cross-tenant leaks — with a hard block.
Is SlopGrade's client open source?
Yes — MIT, zero npm dependencies, pin the SHA. You audit exactly what runs in your CI, like you would a Semgrep rule.