PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Launching Opengrep | Why we forked Semgrep

aikido.dev | blog | #open-source | #sast | #semgrep | #code-analysis | #opengrep | #fork | #license
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Aikido and ten rivals launched Opengrep, a fork of Semgrep CE, after Semgrep locked community rules under restrictive licenses—echoing Elasticsearch/OpenSearch and Terraform/OpenTofu splits.
Published
Collected

Related coverage

blog · aikido.dev
One year of Opengrep: What we built and what’s next
A year after ten security vendors forked Semgrep into Opengrep, the project reports 25-74% faster scans, 2x faster taint analysis, OCaml 5 parallelism, Windows support, and 1.74M binary downloads.
blog · wiz.io
AI Threat Readiness Pillar 3: Perform AI Code Analysis Natively in Wiz
Pillar 3 of the AI Threat Readiness framework: why traditional SAST misses AI-era logic flaws, and how Wiz uses repo prioritization, AI code scans and agentic workflows to fix them at source.
blog · aikido.dev
Finding vulnerabilities at every stage: what to run, and when
Aikido maps four complementary ways to find vulnerabilities — traditional SAST, deep PR review, AI code analysis and AI pentesting — explaining what each catches and where it fits in the lifecycle.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
blog · blog.trailofbits.com
Uncovering memory corruption in NVIDIA Triton (as a new hire)
In my first month at Trail of Bits as an AI/ML security engineer, I found two remotely accessible memory corruption bugs in NVIDIA's Triton Inference Server during a routine onboarding practice.
Back