r2c has built a commercial SaaS around the Semgrep open-source project, offering a monthly per-developer subscription that packages security-focused rules across multiple programming languages. The company maintains what its CEO Isaac Evans calls the “canonical” Semgrep fork and provides tooling to help teams pick and apply rules. Semgrep itself is a code-aware search tool (related to grep) originally developed inside Facebook and distributed under an LGPL license. r2c positions its product as an "application security in a box," aimed at helping companies find potential security issues in their code. Historically the company underinvested in marketing, but it plans to bolster go-to-market efforts and staffing to expand enterprise adoption and land-and-expand within customers. The product emphasizes customizability and wide language support rather than focusing narrowly on a single language. r2c commercializes Semgrep, an open-source static code-analysis tool that scans code for security holes, logic errors, and style problems. The product offers on-demand scans and CI integration, ships curated rule packs, and allows teams to add custom rulesets. r2c supports eight programming languages, including JavaScript and Python, and is actively expanding compatibility. The company emphasizes developer adoption by keeping its core technology open source so developers can modify and test rules. It is focused on delivering actionable results — its key metric is the number of bugs found that developers actually fix — and has explored automatically patching obvious issues. The team has grown to more than a dozen employees and is using recent funding to scale development and adoption.

Total raised

$40M

Funding rounds

2

Latest round

Series B

Latest activity

Jul 2021