January 2025 Summaries

Semgrep has shifted away from its open-source roots, restricting key features under proprietary licensing. This change reflects a broader trend in the industry where vendors prioritize monetization over community values, eroding trust and setting dangerous precedents. In response, Opengrep has launched as a fully open, community-driven alternative to ensure free and accessible code security tools, aiming to preserve openness, accessibility, and collaboration. With its focus on democratizing static code analysis, Opengrep seeks to create tools that serve the community, not just vendors, and help developers build more secure software without fear of vendor lock-in or sudden license changes.

Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) are two distinct approaches to application security testing that complement each other, with SAST analyzing source code for vulnerabilities before deployment and DAST simulating external attacks on running applications. While they can find some overlapping risks, SAST excels at detecting code-related issues and is typically deployed earlier in the development lifecycle, resulting in lower costs to fix. DAST, on the other hand, finds vulnerabilities that manifest in runtime environments and requires redeployment after fixes are made. Other security testing methodologies like Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) also offer complementary tools for application security testing.