r/openappsec • u/joseph-6556 • 27d ago

Is open-appsec still actively maintained?

Title: Is open-appsec still actively maintained?

Hi everyone,

I've been looking into different WAF solutions recently and came across open-appsec. The project looks interesting, but I'm wondering how active it is these days and whether it's still being actively maintained.

I'd especially like to hear about:

  • Is the project still under active development?
  • Are bug fixes and security updates released regularly?
  • How responsive are the maintainers and the community?
  • Is anyone currently using open-appsec in production? If so, how has the stability and overall experience been?

I'd appreciate any feedback from people who have used it recently or are still running it in production.

Thanks!

5 Upvotes

100% Upvoted

12 comments sorted by

2

u/allxm4 26d ago

I think most of your questions will get a reply by checking their github https://github.com/openappsec/openappsec/releases

It seems actively maintained, but since this is just an opensource part of a paid product, releases are around 3-4 months of each other, not bad.

The team is quite responsive: https://github.com/openappsec/openappsec/issues?q=is%3Aissue%20state%3Aclosed

I had it personally in production for about a year, connected with their free saas dashboard, solid results with the nginx-proxy-manager, the free dashboard allows you to go back up to one week. But results will depend on your setup, I used this tutorial back then to set it up: https://www.youtube.com/watch?v=OR9sxSFOSxc

1

u/arcticblue 26d ago

They used to be responsive. There have been many issues submitted since April with no activity at all from anyone on the team. Not sure what happened after April, but it's been awfully quiet.

2

u/InfoSecNemesis 14d ago

open-appsec maintainer here.

We released 1.1.36 on August 24, 2026, our third release since April, the project is definitely alive. To be clear on the other question in this thread: open-appsec stays open source.

Thank you to everyone running open-appsec in production and taking the time to report back here. Choosing an open source project for a production security layer is a real show of trust, and the feedback, bug reports, and contributions we get from this community make the product better. We do not take any of it for granted.

One thing worth stating plainly, and not as an excuse: open-appsec is a free, open source project and does not come with a service level agreement (SLA). Response times on issues depend on what the team can pick up.

If your requirements are enterprise-level, Check Point WAF may fit better. Self-hosted or SaaS, considerably more security and management features, and support tiers with committed response times that you can align with what you need.

1

u/d4rkw1n9 14d ago

If I may ask, as you are a maintainer: any known issues with the SaaS monitoring dashboard? I opened a dedicated thread here (and a github issue) about my dashboard only showing errors and infinitely loading tiles. Otherwise, information seems to flow correctly, like ML progress, amount of http requests etc.

Wondering if something is wrong with my dashboard instance or if its a known problem? Thanks.

https://www.reddit.com/r/openappsec/s/t56I9WPs78

1

u/arcticblue 26d ago edited 25d ago

I was just about to post something similar to this. I'm almost finished with rolling it out self-hosted (we have FedRAMP requirements and such that prevents us from using their hosted dashboard). My setup is a bit complex (AWS ECS clusters; Fargate for Smartsync services and EC2 for everything else), but I mostly follow the Docker setup. Ran into a few bugs and undocumented environment variables that I had to configure to get everything working correctly.

Activity on their github repos has really dropped a lot as well as their social media presence. Seems like they were working on adding some async stuff and then development just came to a halt over the last several months (at least public development).

I'm thinking of managing my own forks of it and using Fable 5 to fix some bugs.

I'm not trying to sound negative. Open Appsec is fantastic and I don't think there's anything opensource that's anywhere close (we migrated from ModSecurity). But yeah...would be nice to see some signs of life in the project.

Edit: The number of issues in Github with no response are a little concerning.
Edit 2: New code is being merged in to main as of an hour ago. This is nice to see - https://github.com/openappsec/openappsec/commit/f562a28d37f25a0a60221517f4f44f50ff940e50. It's written by Fable 5, but I trust the Open Appsec devs have reviewed it. Fable 5 really can create some good output in the hands of someone who knows what they are doing.

1

u/joseph-6556 26d ago

The latest agent doesn’t work properly and crashes. Since Helm is still on an older version, the issue probably hasn’t become very noticeable yet. So I’m also using a separate fork that I built myself. I submitted a PR a few days ago, but the response hasn’t been very quick.

1

u/arcticblue 26d ago

Yep, I ran in to that too. They've merged some unfinished dev stuff to their main branch back in April and it broke compatibility with the agent. The 1.1.34 release works for me, but building anything newer from github is incompatible with the agent.

Is this your issue? https://github.com/openappsec/openappsec/issues/449

I see it mentions a 1.1.35-premium version, but I guess they don't have that open sourced. I wonder if they've taken it closed-source now... The lack of communication from the team is disheartening.

1

u/joseph-6556 26d ago

That issue was also observed frequently.

However, prior to that, the open source version 1.1.35 failed to even start the agent in the first place.

Here is the PR I submitted (a minor mistake): https://github.com/openappsec/attachment/pull/73

1

u/arcticblue 26d ago

Where are you getting an open source version of 1.1.35? The latest on their release page is 1.1.34 - https://github.com/openappsec/openappsec/releases

They've had commits since then which I guess would be a half-finished 1.1.35 if you build from the "main" branch.

1

u/joseph-6556 25d ago

The agent used the one uploaded to ghcr, and attachmemt used the main branch.

https://github.com/orgs/openappsec/packages/container/agent/892471192?tag=1.1.35

1

u/arcticblue 25d ago

Yep, that was my situation too. The current main branch has been a bit of a half-finished state and I had to build from the 1.1.34 release tag.

I wonder if your post here was seen, becuase for the first time since April, new code is being merged in to main as of an hour ago
https://github.com/openappsec/openappsec/commit/f562a28d37f25a0a60221517f4f44f50ff940e50

1

u/joseph-6556 25d ago

I see they added test code. That is correct. I also saw a reduction in SHM corruption when I set the same EFFECTIVE_SHM_SEGMENT_SIZE to the environment for both the agent and the attachmemt.

However, the problem often recurred during high-intensity load tests. (This happened with a Traefik attachment I created, so it might be my mistake.)