Vendor education usually falls into one of two traps. Either it is a thinly disguised product demo wearing a course costume, or it is genuinely good and locked behind a customer login so the people who most need it cannot reach it. Semgrep Academy avoids both, and I want to give credit for that because it is rarer than it should be. The content is free, it is open to anyone, and the vendor-neutral material is clearly separated from the product material rather than blended together in the hope you will not notice.
The Secure Coding course is the centrepiece and the reason to come here. Seventy lessons, about two hours of video, structured around seventeen core practices covering input validation, output encoding, authentication, session management, access control, cryptographic practice, error handling and logging, data protection, and so on. This is the curriculum that most computer science degrees skip and that most developers therefore acquire by absorbing folklore from senior colleagues, incompletely and with gaps nobody notices. Having it laid out systematically is worth more than it sounds.
The pedagogical choice I appreciate is that it teaches the practice rather than the vulnerability. Plenty of security training walks you through SQL injection, shows you the attack, shows you the fix, moves on, and leaves you able to recognise exactly that pattern and nothing adjacent to it. Teaching input validation as a discipline generalises. You come out able to look at code you have never seen and ask the right question.
My main reservation, and it is a real one, is that the course is anchored to the OWASP Top Ten 2017. That is a notably old reference point now. The 2021 revision restructured things meaningfully, moving broken access control to the top and adding categories around insecure design and software integrity that reflect how attacks actually work now. A course teaching the 2017 list is not wrong, because the underlying practices have not changed, but it is dated in a field where being dated carries a cost.
I would like to see this refreshed. The second gap is AI security, which is a strange omission from a company selling static analysis in 2026. Prompt injection, insecure handling of model output, the supply chain risk of pulling weights and packages from open registries, agent tool permissions, none of this gets meaningful coverage. Given how much code now calls a model API, that is the most important missing chapter.
Semgrep 101 is the product track and it does what it says, teaching static analysis, supply chain scanning and secret scanning through the Semgrep tooling. It is competent and it is a product course, and the company is upfront about that rather than pretending otherwise. The Application Security Foundations track on building a programme is aimed at somebody standing up AppSec in an organisation for the first time, and it is a sensible practical treatment of tooling, activities and sequencing, which is territory not well served elsewhere. Production quality is functional.
Talking head with slides, clear audio, no distracting cleverness. That is the correct choice for free technical education and I would rather have accurate content shot plainly than a polished course that teaches less. Four point three. Free, substantial, honestly structured, and overdue a refresh on both OWASP and AI.