OpenWrt is an open-source Linux-based firmware distribution for embedded devices, chiefly wireless routers, that replaces vendor firmware with a fully writable, user-controlled filesystem and package manager. The project has no company, account system, or cloud backend of its own; governance is by a member-based structure (active/inactive/non-member roles, no privileged core-developer group) documented on its own wiki. Fiscal sponsorship has changed since this batch's original vetting: OpenWrt is explicitly no longer associated with Software in the Public Interest (SPI) and is now a member project of the Software Freedom Conservancy (SFC), which lists and describes the project directly. The codebase is GPLv2-licensed (with bundled third-party components under their own licenses), security vulnerabilities are handled through a documented coordinated-disclosure process to a dedicated contact address, and the project runs weekly Coverity static-analysis scans plus a reproducible-builds verification pipeline specifically to prove released binaries match the published source with no backdoors introduced in the build process. No dedicated privacy-policy page was found live on the OpenWrt wiki (the site's own cookie-consent banner links to a stub that does not exist), and no third-party privacy/security audit of OpenWrt itself was found in this research.
TIMELINE
1 ENTRY
[2026-08-31] · NEW RECEIPTS
7 new sources on file for OpenWrt.
OpenWrt's file gained 7 new sourced claims since its last review.
OpenWrt's About page describes the project as providing a fully writable filesystem with optional package management, freeing users from the application selection and configuration a router vendor would otherwise impose, and allowing full customization of the device.
Software Freedom Conservancy's own current member-projects page lists and describes the OpenWrt Project directly as one of its member projects, confirming OpenWrt's current fiscal sponsorship.
OpenWrt's Project Rules page discloses its member-based governance structure: active members, inactive members, and non-members, with no core developer group or any other group of specially privileged members.
Software in the Public Interest's own project page for OpenWrt states plainly that OpenWrt is no longer associated with SPI and directs donors to Software Freedom Conservancy instead -- an independent, third-party-hosted correction to the project's prior fiscal-sponsorship arrangement.
OpenWrt's License page states the software is free, provided AS-IS and without warranty, under the GNU General Public License Version 2, with bundled third-party components available under their own separate open-source licenses.
OpenWrt's Security page documents a coordinated vulnerability-disclosure process: security bugs should be reported in confidentiality to a dedicated contact address, with an escalation path to a public administrative mailing list if severe or unanswered, and guidance to avoid publicly posting exploit details.
OpenWrt's developer-facing Security page describes a reproducible-builds verification process specifically intended to prove that produced releases really match the delivered source code and that no backdoors were introduced during the build process.