Opengrep

Opengrep is an open-source static application security testing (SAST) engine, forked from Semgrep v1.100.0 and released under the LGPL 2.1 license. It is backed by a consortium of AppSec organizations including Aikido, Amplify, Endor Labs, Kodem, and Orca Security. The project was created in December 2024 in response to Semgrep moving critical features behind a commercial license.

What It Is

Opengrep is a command-line static analysis tool that searches code for security vulnerabilities and bug patterns using semantic grep-style rules. It supports 30+ programming languages and is fully compatible with existing Semgrep rules and rulesets, making migration straightforward. The tool outputs results in standard JSON and SARIF formats for easy integration into CI/CD pipelines and security toolchains.

Why It Was Forked

The README states that Opengrep was created when Semgrep moved critical features behind a commercial licence. The project's manifesto at opengrep.dev frames the fork as a commitment to keeping advanced static analysis open and accessible. Key governance principles include accepting contributions on merit rather than commercial interest and a long-term commitment to the LGPL 2.1 license.

Key Technical Improvements Over Semgrep CE

Since the fork, Opengrep has introduced several capabilities not available in Semgrep Community Edition:

• Superior taint analysis via --taint-intrafile: constructor and field assignment tracking, inter-method taint flow, higher-order function support across 12 languages, and collection method tainting (map, filter, reduce, etc.)
• Visual Basic support — not available in Semgrep CE or Pro
• Apex and Elixir support — not in Semgrep CE
• Improved language support: Clojure (tainting), PHP 8.4, C# 14
• Self-contained binaries built with Nuitka (no Python runtime required)
• Signed releases with Cosign for supply chain security

Language and Integration Coverage

Opengrep supports over 30 languages including Apex, Bash, C, C++, C#, Clojure, Crystal, Dart, Dockerfile, Elixir, Go, HTML, Java, JavaScript, JSON, Jsonnet, JSX, Julia, Kotlin, Lisp, Lua, OCaml, PHP, Python, R, Ruby, Rust, Scala, Scheme, Solidity, Swift, Terraform, TSX, TypeScript, Visual Basic, XML, YAML, and generic templating formats like ERB and Jinja. Standard SARIF output enables direct integration with GitHub Advanced Security, Azure DevOps, and other SARIF-compatible platforms.

Setup Path

Installation is designed to be frictionless. A one-line curl script handles Linux and macOS installs, and a PowerShell equivalent covers Windows. Pre-built self-contained binaries are available on the GitHub releases page, requiring no Python environment. Users write YAML rule files specifying patterns, messages, and severity levels, then run opengrep scan against a codebase.

Update: v1.28.0

The latest release is v1.28.0, published on August 25, 2026, according to the GitHub repository metadata. The project has been actively maintained since its creation in December 2024, with the repository showing regular pushes and a growing issue tracker. The open roadmap sessions hosted on lu.ma and the Reddit community at r/opengrep indicate an active contributor and user base.