Opengrep

Opengrep began as a fork of Semgrep, created when features that security teams relied on moved behind a commercial license. It keeps advanced static code analysis open under LGPL 2.1, backed by a consortium of application security companies including Aikido, Amplify, Endor Labs, Kodem and Orca Security.

The engine works like a semantic grep. You write a rule describing a code pattern, and Opengrep matches it across a large codebase. Existing Semgrep rules and rulesets run unchanged, and findings come back as JSON or SARIF, so they drop into a pipeline that already consumes those formats.

The fork has added work of its own since splitting off.

• Taint analysis: intrafile tracking follows constructors, field assignments, inter-method flow and higher-order functions across twelve languages.
• Language reach: more than thirty languages are covered, among them Visual Basic, Apex and Elixir, which Semgrep CE does not support.
• Self-contained binaries: releases are built with Nuitka, so no Python installation is needed, and signed with Cosign.
• Open governance: contributions are judged on merit rather than commercial interest.
• Long-term assurance: the project is committed to staying open source under LGPL 2.1.

Installation is a shell script on Linux and macOS, a PowerShell command on Windows, or a binary from the releases page. Point the scanner at a rules directory and a source tree and it prints each match inline with the offending line. It suits teams that want their scanner to stay open.