diff --git a/docs/README.md b/docs/README.md index 90d4d1e7..74cf1339 100644 --- a/docs/README.md +++ b/docs/README.md @@ -48,7 +48,7 @@ The entire system is designed to work with AI agents. Formal analysis produces r ### Open source, batteries included -Engine, CLI, GitHub Action, GitLab CI, rules — the entire stack, including the deep analysis, is released under [Apache 2.0](../LICENSE.md) and [MIT](../cli/LICENSE). No paid tier to unlock taint tracking. No vendor lock-in on your rule library. Other tools make you pay for it — Semgrep gates taint tracking behind a paid Pro tier, CodeQL requires GHAS for private repos. The deep analysis should be free — and it is. +Engine, CLI, GitHub Action, GitLab CI, rules — the entire stack, including the deep analysis, is released under [Apache 2.0](../LICENSE.md) and [MIT](../cli/LICENSE). No paid tier to unlock taint tracking. No vendor lock-in on your rule library. Other tools make you pay for it — Semgrep gates inter-procedural taint tracking behind a paid Pro tier, CodeQL requires GHAS for private repos. OpenTaint doesn't. --- diff --git a/docs/faq.md b/docs/faq.md index c67d9042..366627ea 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -22,7 +22,7 @@ Java and Kotlin, analyzed at the bytecode level to precisely understand inherita **How does OpenTaint compare to Semgrep?** -Semgrep's open-source engine does pattern matching. Its Pro engine adds taint analysis behind a paid tier. OpenTaint ships full inter-procedural dataflow analysis — cross-endpoint flows, persistence layers, stored injections — under Apache 2.0. Rules use a code-native format that the engine translates into complete taint configurations. Semgrep rule syntax is supported as a migration path. +Semgrep's open-source engine includes intra-procedural taint analysis — it tracks data within a single function. Its Pro engine adds inter-procedural taint analysis behind a paid tier. OpenTaint ships full inter-procedural dataflow analysis — cross-endpoint flows, persistence layers, stored injections — under Apache 2.0. Rules use a code-native format that the engine translates into complete taint configurations. Semgrep rule syntax is supported as a migration path. **How does OpenTaint compare to CodeQL?**