OccupySaaS Rebuilds Auth0 and Salesforce From Public Docs
A group of engineers is building open source replacements for the subscription software most companies rent, using AI to rebuild the products from public documentation, and the first two targets are identity and customer records.
The project, OccupySaaS, pitches itself as a protest movement in code. Launched last month under the Apache 2.0 licence, it aims at clean room reimplementations that existing code can point at without changes, starting with ZeroAuthy for Auth0 and SalesCompel for Salesforce.
And the method is the part that matters legally. The rules forbid decompiled binaries, leaked source, anything confidential from a former employer and copied interface assets, so every project is rebuilt from published API references, open standards such as OAuth 2.0 and OIDC, and the observed behaviour of the vendors' own software development kits. The separation is enforced rather than promised, with spec writers working apart from builders, a clean room policy in every repository, the API contract written before the code, and a human reviewing every merge.
ZeroAuthy is the furthest along, with a first release candidate that runs a self hosted identity server speaking the Auth0 APIs, covering hosted login, multi factor and passwordless authentication, the management API and an admin console. It is OpenID certified for basic, configuration and form post flows, and the project says it has been tested against the Auth0 SDKs for Node and React, the Auth0 command line tools, and the vendor's Next.js integration.
But the gaps are listed rather than hidden. WebAuthn, passkeys, SAML, enterprise directories, token exchange and several other features are not in that release, and SalesCompel, the Salesforce replacement, is earlier still, with account and contact records, object describe calls and limited queries working and much else absent.
And Go was chosen over Rust for a specific reason rather than taste. A Go project compiles to one self contained binary that drops onto a server or into a container with no installer and no runtime, which is what someone leaving a subscription needs, and the project says Rust ports are welcome and would be checked against the same compatibility tests.
The roadmap reaches past those two. Document and wiki management, issue tracking, feature flagging, observability and customer support are named as future occupations, which Tom's Hardware reads as Confluence, Jira, LaunchDarkly, Datadog and Zendesk.
The motivation is stated as economics. Per seat pricing is called a tax on growth, and the project's line is that the software built by the 99 per cent belongs to the 99 per cent. Tom's Hardware reports the effort is the work of Thomas Meadows, a software engineer with two decades of experience.
So the honest read is that two early projects with a few hundred stars each are not yet a threat to companies selling identity and customer records, and the real test is whether a security team will put an unproven identity server in front of its staff, because one authentication bug costs more than years of the subscription it replaces.
OccupySaaS is building open source replacements for commercial subscription software
ZeroAuthy targets Auth0 and SalesCompel targets Salesforce, both under Apache 2.0
The project forbids decompiled code, leaked source and copied interface assets
ZeroAuthy has a release candidate that is OpenID certified but lacks passkeys, SAML and enterprise directories
Neither project is described as production ready, and further targets include issue tracking, feature flagging and observability
Source: Tom's Hardware, OccupySaaS
