Hacktron vs Semgrep
Semgrep tells you what to fix. Hacktron Review shows how an attacker would exploit it, with a proof of concept on the vulnerable line. Hacktron Whitebox also pentests your application. Semgrep doesn’t.
Comparison
| Hacktron | Semgrep | |
|---|---|---|
| Scope | Red tests your whole organisation, Whitebox one application, and Review every pull request. | Semgrep Code for your own code, Supply Chain for dependencies and malware, and Secrets for credentials. |
| Analysis | Review reads each change with call graphs of your connected codebases, so it can report a vulnerability outside the changed lines. | Deterministic static analysis for classic issues, and AI analysis for complex flaws such as business logic. |
| Findings | An inline comment on the vulnerable line, with the attack path, a proof of concept, and a prompt to fix it. | Pull and merge request comments with step-by-step remediation instructions. |
| Learning | A threat model from your code, your rules file, and added documents. Developers reply to mark a finding false positive, accepted risk, valid, or fixed. | Learns from triage decisions. Memories tailor remediation guidance by project and rule. |
| Fixes | Every finding carries a prompt that opens the fix in Cursor, Claude, or Codex. Remediation has Hacktron’s agent test the finding, fix it, add tests, and open a pull request. | Generates code changes for Code and Supply Chain findings and opens a pull or merge request. |
| Pentests | Whitebox checks each candidate finding against your code, and against a running copy when there is one, with one free retest and an attestation letter. | None listed. |
Price
| Hacktron | Semgrep | |
|---|---|---|
| Plan | Review Pro, from $40 per developer a month, with a 14-day trial. | Teams, per contributor a month: Code $30, Supply Chain $30, and Secrets $15. |
| Includes | 50 pull requests per developer, pooled across your organisation, with unlimited scans per pull request. | 20 AI credits per developer a month and up to 500 private repositories. |
| Over the limit | $1 per additional pull request, off by default. | Not listed. |
| Pentest | Whitebox, $50 to $25,000, about $500 per 100,000 lines of code. | None listed. |
Questions
Should Hacktron replace Semgrep?
Not necessarily. Teams can keep Semgrep for dependency and secrets coverage, and add Review for exploitable flaws in each pull request.
What does Review look for?
Business logic flaws, broken access control, injection, prompt injection, memory safety bugs, infrastructure-as-code exposures, supply-chain risk, and leaked secrets.
Which git providers does Review work with?
GitHub, GitHub Enterprise Server, GitLab, Azure DevOps, and Bitbucket. Findings also go to Slack, Jira, and Linear.