Update, October 2026: This post was first published on 30 January 2025. Since then, things have moved on:

Codacy now runs Opengrep. In February 2026, Codacy replaced Semgrep with Opengrep as a 1:1 replacement that kept existing patterns, issue history, and configuration. Codacy uses Opengrep but isn’t one of the backers named on opengrep.dev .

Opengrep is shipping. It reached version 1.0.0 on 18 March 2025 and has released regularly since (version 1.31.0 came out on 15 October 2026), still under the LGPL-2.1 licence. Its site currently names Aikido Security, Amplify, Endor Labs, Kodem, and Orca Security among its backers.

Semgrep’s licensing today. The Semgrep Community Edition (CE) engine is still licensed under LGPL 2.1 . Semgrep-maintained rules have been under the Semgrep Rules License v1.0 since December 2024 ; it limits them to internal use and bars vendors from using them in competing products or SaaS offerings.…