:about

Apex* Bash C* C++* C#* Clojure* Crystal Dart* Dockerfile Elixir* Go* HTML Java* JavaScript* JSON Jsonnet JSX Julia* Kotlin* Lisp Lua* OCaml PHP* Python* R Ruby* Rust* Scala* Scheme Solidity Swift* Terraform TSX TypeScript* Visual Basic* XML YAML Generic (ERB, Jinja, …)

* supports cross-function taint analysis

Rules are written as code and matched against the syntax tree, so formatting and comments don't matter. Names are resolved too, so a function imported under another name still matches. Matching can also use type information that Opengrep infers during analysis, for example to flag stmt.execute(query) only when stmt is a database Statement, and not a thread pool that has an execute method too.

Values and expressions are tracked through assignments: a rule for shell=True also matches shell=flag when flag is True.

Declare where untrusted data comes from (sources), where it must not end up (sinks) and what makes it safe (sanitizers). Opengrep flags unsanitized flows from sources to sinks.

Taint is tracked per field: a tainted user.name doesn't make user.id tainted.

With the rule option taint_intrafile, Opengrep summarises how each function passes tainted data along, and follows it through calls, return values, lambdas and higher-order functions like map. Across a whole project, --enable-interfile builds a call graph, and rules with the interfile option follow data from a source in one file to a sink in another, for example from a request handler to a SQL query in a separate data-access module. Taint is also tracked through standard library functions and classes, so user input stored in a list or map and read back later is still tainted.

A desktop app for writing rules: edit a rule next to sample code, run it and see what it matches, and run the rule's tests. For Linux, macOS and Windows, from opengrep/opengrep-playground.

Teaches AI coding agents such as Claude Code, Codex and OpenCode to use Opengrep: to write new rules, scan for vulnerabilities, and find code by its structure where grep falls short. Install it with npx skills add opengrep/skills, or get it from opengrep/skills.

opengrep ci reports only the findings a pull request introduces, and --baseline-commit compares against any commit.

SARIF, JSON, JUnit XML, GitLab SAST and GitLab Secrets, plus Emacs and Vim formats. Several at once from a single run.

Every finding in JSON and SARIF carries a fingerprint built from the rule, the file path and the matched code, not line numbers, so findings can be tracked across commits as code moves.

Rules can carry a fix that replaces vulnerable code with a safe equivalent, for example el.innerHTML = comment with el.textContent = comment. Use the --autofix flag to apply fixes in place, and --dryrun to preview them without touching files.

opengrep lsp runs a language server for your editor.

OCaml 5 with shared-memory parallelism across all cores.

Timeouts scale with file size (--dynamic-timeout), and rules can set their own.

Caps on memory and file size, and an option to skip minified files.

Self-contained and Cosign-signed, for Linux, macOS and Windows.