Rajat R. to go on a rant from another community user/minor contributor over the last few years - This seems to be the model of most businesses to squeeze out as much revenue as possible, by offering something capable for free, and then walking it back while increasing cost. It's unfortunate organizations like OWASP do this. Could you imagine if the creator of Linux one day just decided to remove/paywall a bunch of free features that effectively drove the popularity/success of the tool itself? The very thing that made a technology popular - removed for percentages gained.
SSO & RBAC are effectively paywalled and has been stripped from the open source version. Unfortunately this renders the product as a competitor against several other tools/vendors in the space and although DefectDojo is great tool - it does not compete against vendors that have been offering SAST, SCA, etc. that are also starting to offer ASPM and Vulnerability Management. Although it is crowned as a 'new chapter', it feels like a step back for open source - and a step forward for corporate gain. I do not think this was a step in the right direction, but I am just a former contributor and have no involvement in the Project aside from minor parser additions and strategies shared for using DefectDojo in the community. I'm sure it will be great to funnel more sales and expand/continue funding the OWASP and DefectDojo platforms, but it's not so great for those of us that have been effectively using this tool on our own, and have to pay a massive bill if we want to continue.
We have removed all of our upgrade scripts and we're using it as a legacy 'as-is' set of infrastructure, locked to version 2.58.4 - before the SSO/RBAC was stripped out. I understand branding and even the introduction of the many links + plugs for upgrading away from open-source - but even after I tore all that out and customized, SSO/RBAC is the last step that marks it as a hostile takeover/regression from being a 'free helpful community tool' to now another subscription that is going to charge way too much - for a bit of DevOps and deploying source code. I understand it takes time and money, but the savvy portion of the community who is capable of doing this ourselves aren't likely to opt into a subscription model, and instead will just run it as internal end-of-life and migrate to something else, or write our own. Sprinkling in a new UI, dark theme, or promise of 'AI' and 'MCP' - is simply not enough to convince any capable engineer to be persuaded to consider paying for that alone.
Best of luck to you and all who read this, including those who are part of DefectDojo. Thank you for what you've done for the community, up to this unfortunate decision.
