Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Endor Labs and Allies Launch Opengrep, Reviving True OSS for SAST

Opengrep is a new consortium-backed fork of Semgrep, intended to be and remain a true genuine OSS SAST tool.

Open Source

In December 2024, Semgrep announced a change of name for its OSS static application security testing (SAST) tool from SemgrepOSS to Semgrep Community Edition. At the same time, it made changes to the licensing arrangements and moved some aspects of the free tool into its commercial offerings.

New community-contributed rules are restricted to Semgrep’s commercial product, and some important features (tracking ignores, fingerprinting, and meta-variables) are moved behind Semgrep’s SaaS platform. 

“The rebranding from ‘Semgrep OSS’ to ‘Semgrep Community Edition’ signals a shift away from open source principles,” suggests Endor Labs in a blog introducing a new response: Opengrep.

Opengrep is a new consortium-backed fork of Semgrep, intended to be and remain a true genuine OSS SAST tool. It has backing and resources from more than ten application security vendors, including Aikido Security, Amplify, Endor Labs, Jit, Legit, and Orca Security.

Endor describes this coming together of basic competitors as ‘a special moment’. “And we should address the elephant in the room – we all benefit from a standardized, open source SAST engine, and we all contribute community rules and improvements for it. But that is exactly the point.”

Opengrep’s new introductory web page explains the reasoning. It suggests that Semgrep has in recent years begun focusing on its SaaS management platform, and these new changes are part of that re-focus.

The new consortium uses the history of open source license changes to explain and justify its actions. “[License changes] are no small matter, often leading to disruption and uncertainty for contributors and users of those projects.” The subsequent continuance of true open source has sometimes been contingent on the intervention of outsiders.

“When Elasticsearch switched its licensing strategy, halting new open-source versions of Elasticsearch and Kibana, AWS stepped up to launch OpenSearch,” it explains. “When Hashicorp pulled the plug on Terraform open source, the community came together with Opentofu to ensure a home for Terraform that the community can unite behind, build on and depend on.”

Advertisement. Scroll to continue reading.

Opengrep promises developers three primary new features. Firstly, “A better and more capable scanning engine by not hiding essential metadata and new scanning capabilities behind a login.” It will also be backward compatible and support common JSON and SARIF outputs.

Secondly, “An improved engine means more capable community rules by unlocking previously pro-only capabilities.”

Thirdly, there is “Long-term assurance that rules won’t be locked into specific vendors, so you can take them easily between your jobs no matter which code security provider they use.”

Semgrep Community Edition will, at least for now, continue. Opengrep becomes a new and (on current promises) a genuine and continuing true OSS SAST project. Endor Labs adds, “The promise of Opengrep means that developers and application security teams will get a better baseline product, no matter who their AppSec vendor of choice is.”

Related: Cyber Insights 2025: Open Source and Software Supply Chain Security

Related: GitHub Launches Fund to Improve Open Source Project Security

Related: US, Allies Warn of Memory Unsafety Risks in Open Source Software

Related: CISA Outlines Efforts to Secure Open Source Software

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

Cyber exposure management firm Armis has promoted Alex Mosher to President.

Software giant Atlassian has named David Cross as its new CISO.

Dan Pagel has been named the new CEO of risk management and remediation firm Brinqa.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.