Opengrep vs. Semgrep: Some Thoughts

Update, October 2026: This post was first published on 30 January 2025. Since then, things have moved on:

• Codacy now runs Opengrep. In February 2026, Codacy replaced Semgrep with Opengrep as a 1:1 replacement that kept existing patterns, issue history, and configuration. Codacy uses Opengrep but isn’t one of the backers named on opengrep.dev.
• Opengrep is shipping. It reached version 1.0.0 on 18 March 2025 and has released regularly since (version 1.31.0 came out on 15 October 2026), still under the LGPL-2.1 licence. Its site currently names Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security among its backers.
• Semgrep’s licensing today. The Semgrep Community Edition (CE) engine is still licensed under LGPL 2.1. Semgrep-maintained rules have been under the Semgrep Rules License v1.0 since December 2024; it limits them to internal use and bars vendors from using them in competing products or SaaS offerings. Semgrep’s commercial offerings include the Semgrep AppSec Platform, Semgrep Code, Semgrep Supply Chain, and Semgrep Secrets.
• ZAP is still open source. Now branded “ZAP by Checkmarx”, ZAP remains under the Apache 2.0 licence and continues to publish weekly releases.

I’ve been waiting to see if Semgrep themselves would react to the announcement, on 23 January 2025, of the formation of Opengrep, an open-source fork of the Semgrep engine:

We’re launching Opengrep, a fork of SemgrepCE (formerly SemgrepOSS), in response to recent changes by Semgrep that affect its open-source nature and shift focus to its paid offering, limiting access and innovation for the broader community.

Luke O’Malley, co-founder of Semgrep, responded here on 24 January 2025:

As maintainers, we’re glad to see commercial competitors using Semgrep’s Community Edition (CE), many of whom are excellent community members. However, last year [2024] we discovered a small number of companies distributing the semgrep-rules repository in violation of its existing Commons Clause license.

At launch, the Opengrep coalition included several application security startups who have ticked their “SAST” box by dropping in Semgrep (and presumably semgrep-rules): Aikido, Arnica, and Jit all apparently leveraged Semgrep for SAST scanning.

So did we, at Codacy, when this post was written in January 2025, under a commercial agreement with Semgrep that allowed us to continue to use semgrep-rules.

So, if you were a happy Codacy customer utilising Semgrep within the product, there was no need for alarm. (Since February 2026, Codacy uses Opengrep instead; see the update above.)

What’s Going On?

We find ourselves in a strange battleground. What were point scanners must now become application security posture management (ASPM) tools to survive, precisely because the point scanners that the commercial ASPMs rely upon are open-sourced.

Tooling will always flag more security vulnerabilities than it’s feasible to fix, so the value of commercial offerings has to be in adding a layer of intelligence to these basic results to enable triage and fixing to take place effectively.

If Semgrep want to get paid, they must compete for the same dollars as Jit, Aikido, et al., and therefore they must stop giving their new competitors their functionality for free!

Everyone is realising that maybe giving your IP away for free to gain traction in the market is a far more complex proposition than might have been thought between 2020 and 2023. (You can also see moves by our friends at Sonar to close source on some of their tools; SonarC# and SonarVB scanners are becoming decreasingly available for commercial use. In November 2024, Sonar moved the sonar-dotnet analyzers behind them to its source-available SONAR Source-Available License v1.0.)

Interestingly, the point scanners that stayed closed were bought instead.

Investors at Probely (acquired by Snyk) and Dazz (acquired by Wiz) cashed out in November 2024, whereas in September 2024 Checkmarx “bought” the open-source ZAP tool by hiring its three project leaders. We wait to see how much development effort will continue to go into the open-source flavour of ZAP versus whatever additions Checkmarx feels it needs for itself.

Is Open-Source Security Dead?

Fundamentally, I think giving away security tools for free is a losing game in a market that is increasingly willing to pay for access to code security tools. Startups like Privado, who have hung their hats on an open-source version to drum up business, will have to cross the same Rubicon as Semgrep in time.

We already leverage dozens of open-source scanners, largely developed by and for developer communities rather than as teaser rates for commercial offerings. Not much will change in Codacy-land. When forks like Opengrep come along, we’re in a great position to evaluate them and add them to our arsenal as appropriate.

But the real money in this game will still and always come from managing the outputs of these tools, allowing easy and rapid configuration and deployment, and tracking success metrics.

That’s the part of the problem we focus on at Codacy.