Vigilance vs Semgrep
Semgrep. Reads source code and finds mistakes in it, with rules you can write. Vigilance finds the update that gained a hidden power, before you install it.
The Catch Semgrep Cannot Make
Semgrep finds mistakes your rules describe. A brand-new attack matches no rule you wrote. Vigilance needs no rule. It compares the version you trust with the version you install. It reports any file that can suddenly do more.
A real one: axios, March 2026
axios is one of the most-installed packages on the internet. In release 1.14.1, its package.json gained a hidden install step. That step pulls down a remote-control program. Semgrep had no rule that matched, so it stayed quiet. One command sees it:
vigi diff --old ./axios-1.14.0 --new ./axios-1.14.1
HEADS UP. 1 file changed. package.json can now run a hidden helper on install and reach the network.
Run both. Semgrep catches what a rule can describe. Vigilance catches the change no rule was written for. See them side by side below.
Side by Side
| Question | Semgrep | Vigilance |
|---|---|---|
| Finds a mistake in your own source code | Yes | No |
| Lets you write your own rules | Yes | No, there is nothing to set up |
| Covers a program with no source code | No | Yes |
| Covers a container or a zip | No | Yes |
| Spots a new file that can run other programs | Only if a rule matches | Yes |
| Runs on the machine after install, not just in CI | No | Yes |
Which One Do You Need?
Different jobs that connect. Semgrep finds mistakes in the code you wrote. Vigilance flags the file that gained a capability none of yours had before, so you can point Semgrep at what matters.
Known Risk versus New Risk
A bug or a bad package someone already reported, with a name and a number. Most tools work here.
A file that gained a capability it never had, that no report covers yet. Vigilance works here.
Common Questions
Is Vigilance a Semgrep Alternative?
Yes, for one job. Vigilance shows the file that gained a new capability, on your own machine. Many teams run it next to Semgrep.
What Does Vigilance Do That Semgrep Does Not?
Vigilance can spot a file that can do more than the version before, and look inside a package, installer or container.
What Does Semgrep Do That Vigilance Does Not?
Semgrep covers a different part of the chain. Vigilance shows the file that gained a new capability.
Does Vigilance Need the Internet or a Cloud Account?
The Free plan runs online. Pro runs fully offline, with no cloud account.
Try It on Your Own Software.
Show it the version you run today and the one you are about to install.
Talk to Us
A question, a pilot, or a bigger fleet? Send a note. It reaches a person.