# Composal vs Semgrep Code

Semgrep analyzes source code for security issues. Composal checks a running web application against user requirements and records browser evidence; functional QA does not replace SAST.

## Composal

Composal sends AI browser agents to use your running web app and check the outcomes you care about. Define journeys as plain-English Scenarios, map existing flows with Discovery, or explore for bugs with Deep Scan. Runs keep recordings and reproduction steps so your team or coding agent can investigate a Finding.

[Verify documentation](https://composal.com/docs/verify)

## Semgrep Code

SAST and customizable code security analysis

Semgrep Code scans repositories and CI changes for security vulnerabilities using inspectable rules and data-flow analysis. Its current platform also includes AI-supported detection, triage, and remediation workflows.

## What each tool does

| Workflow | Composal | Semgrep Code |
| --- | --- | --- |
| [Run browser journeys](https://composal.com/product/scenarios) | ✓ Yes: Run saved browser Scenarios and return recordings and reproducible Findings. | × No: The documented product reviews or analyzes source changes; it does not execute browser journeys. |
| [Map application workflows](https://composal.com/product/discovery) | ✓ Yes: Discovery maps key application areas and user journeys. | – Not confirmed: Check whether this product includes this workflow in your intended plan and setup. |
| [Explore for unexpected issues](https://composal.com/product/deep-scan) | ✓ Yes: Deep Scan explores the running application and reports reproducible issues. | – Not confirmed: Check whether this product includes this workflow in your intended plan and setup. |
| [Describe checks in plain English](https://composal.com/product/scenarios) | ✓ Yes: Author Scenarios around the intended user outcome, then review the steps and expected results. | – Not confirmed: Check whether this product includes this workflow in your intended plan and setup. |
| [Run or inspect from a terminal](https://composal.com/product/cli) | ✓ Yes: Use the CLI to start and inspect verification runs and their Findings. | – With setup: Connect its specialist checks to your development workflow using supported integrations. |
| Source code review and analysis | × No: Use a dedicated tool for this specialist workflow alongside Composal’s browser verification. | ✓ Yes: Semgrep Code scans repositories and CI changes for security vulnerabilities using inspectable rules and data-flow analysis. Its current platform also includes AI-supported detection, triage, and remediation workflows. |

With setup means you supply code or configuration. Not confirmed means support for this workflow needs checking with the vendor.

## Where each fits

Choose Semgrep for configurable source scanning and security workflows. Choose Composal for hosted browser Scenarios, Discovery, and exploratory testing. Use separate gates for security and runtime behavior.

## Try this evaluation

Scan a change to authorization code with Semgrep and run its preview through Composal. Compare security findings with observed allowed and denied journeys, keeping remediation and QA evidence distinct.

### Coverage

Which user outcomes must this release prove, and which specialist checks must stay in your existing stack?

### Setup

Who prepares accounts, test data, permissions and access to the deployment being tested?

### Evidence

Can the engineer reproduce a reported failure from the recording and steps, without asking the tester to investigate again?

### Ownership

Who updates the checks when the product changes, and can the team review what a passing result actually proves?

## Related comparisons

- [Composal vs Trunk Check](https://composal.com/compare/composal-vs-trunk-check.md)
- [Composal vs SonarQube](https://composal.com/compare/composal-vs-sonarqube.md)
- [Composal vs Snyk Code](https://composal.com/compare/composal-vs-snyk-code.md)

[All comparisons](https://composal.com/compare.md)