OccupySaaS announces open-source drop-in replacements for Auth0 and Salesforce

OccupySaaS describes itself as a protest movement written in code. Its site says laid-off engineers, armed with AI and public documentation, are building clean-room, open-source, drop-in replacements for the platforms that, in its words, rent the industry back to its own workers one seat at a time. The pitch borrows from Occupy Wall Street: the software built by the 99% belongs to the 99%. The site claims that a million engineers were let go while the platforms kept growing, but gives no source or period for the figure.

The method has five steps. First, the public record (public API references, open standards such as OAuth 2.0, OIDC and REST, and published SDK behaviour) becomes a written specification. Second, spec writers and builders are kept apart behind a firewall; each repo carries a CLEAN_ROOM.md policy and records provenance for every fixture and reference. Third, AI agents implement from the spec alone, contracts first (openapi.yaml), then code, then tests, under human review at every merge. Fourth, a compatibility laboratory runs the vendors' own public client SDKs against the new server, and if existing code does not work unchanged, the project is not done. Fifth, the result is released under Apache-2.0, self-hostable, with pluggable storage, no telemetry you did not ask for and no seat counter. The site lists what is allowed in (public API docs, open standards and RFCs, public SDK behaviour, black-box test results) and what is never allowed (leaked or proprietary source, decompiled binaries, former-employer confidential information, copied UI assets or trademarks).

Two projects exist so far. ZeroAuthy is a self-hostable identity server that speaks the Auth0 Authentication API. The site says pointing an existing Auth0 SDK at a ZeroAuthy tenant domain works with no code changes. Listed features: OIDC discovery, JWKS and multi-tenant domains; hosted login with authorization code plus PKCE; client_credentials, rotating refresh tokens, revoke and logout; and verification with auth0-spa-js, auth0-react and nextjs-auth0. It builds with Go (go build -o bin/zeroauthy ./cmd/zeroauthy) and starts with a config file.

SalesCompel is a free, open-source Salesforce replacement with a tenant-isolated Go/PostgreSQL core, a Vue record editor and a compatibility laboratory that checks behaviour against Salesforce's public API contract. Its listed features are narrow: persistent Account and Contact CRUD, object describe and limited queries, external-ID upsert and bearer authentication, plus an OpenAPI 3.2 REST contract and an offline test lab run through npm.

The site floats further targets: docs and wikis, issue tracking, feature flags, observability and customer support. It calls these open for discussion, not commitments, and invites people to propose targets by opening an issue.

In its FAQ the movement addresses the obvious questions. On legality, it says clean-room reimplementation is a long-established method and interoperating with an API is not the same as copying a product, but adds that the page is not legal advice and businesses should talk to their own counsel. It says it is not affiliated with, endorsed by or sponsored by Auth0, Okta, Salesforce or any other vendor named. Former employees of those companies may contribute, but never with confidential knowledge; those with inside knowledge should stay on the public-spec side or sit the project out. AI is used, it says, because the giants had thousands of engineers and the movement does not; humans write the specs, review every change and own the result. Go was chosen for single-binary, container-friendly portability; Rust ports are welcome but none exist yet. Asked whether it is production-ready, the site answers: not yet. Both first projects are early and say so in their READMEs. The cost is nothing, and the movement asks only that users contribute back what they can. It stresses that it is nonviolent: no marches, no property damage, just published software.

Key facts

OccupySaaS, a self-described protest movement, says laid-off engineers are using AI and public documentation to build clean-room, open-source drop-in replacements for SaaS products.
Two projects exist: ZeroAuthy, an Auth0-compatible identity server, and SalesCompel, a Salesforce-compatible CRM with a Go/PostgreSQL core. Both are Apache-2.0.
Compatibility is tested by running vendors' own public client SDKs against the new servers; the site says that if existing code does not work unchanged, a project is not done.
The site says both projects are not production-ready yet, and SalesCompel currently lists only Account and Contact CRUD, object describe, limited queries, external-ID upsert and bearer authentication.
The site says AI agents implement from the spec alone under human review at every merge, with spec writers and builders kept separate.

Why it matters

The project targets two of the most common paid subscriptions, identity and CRM, with free, self-hostable software that aims to accept the same client calls as Auth0 and Salesforce. The site frames this as a response to per-seat pricing, proprietary APIs, export walls and surprise price hikes, and ties it to the wave of tech layoffs. The approach combines an old method, clean-room reimplementation, with AI agents doing the building. Whether that combination produces software people can actually swap in is the open question; so far the site only claims early projects.

Who it affects

Companies paying per-seat fees for identity and CRM are the stated audience, along with developers who already use the Auth0 SDKs (auth0-spa-js, auth0-react, nextjs-auth0) and engineers looking for open-source projects to join. The movement also invites spec writers, self-hosters willing to test against their real SDKs, and people who want to propose the next target. The named vendors (Auth0, Okta, Salesforce) are affected only if the projects mature; the site says it has no affiliation with any of them.

How to use it

Both projects are Apache-2.0 and free to run, fork or build services around. To try ZeroAuthy, build it with Go (go build -o bin/zeroauthy ./cmd/zeroauthy), start it with ./bin/zeroauthy serve --config config.yaml, and point an Auth0 SDK at the tenant domain. For SalesCompel, the site shows a compatibility lab run with npm ci and an npm check script under compat/clients/node. The site invites contributions in four forms: write code by picking an open issue and following the clean-room policy, self-host a release and report where it breaks, write testable specs from public docs, or spread the word. It advises reading each project's CLEAN_ROOM.md and README before starting.

How solid is it

Everything here comes from the movement's own site. It names no founders, authors or contributors, gives no launch dates, and reports no test results, benchmarks or compatibility pass rates. The 'million engineers' figure has no source or period. It does not say which AI models or tools are used. No vendor response or legal opinion is reported. The ZeroAuthy claim of working with no code changes and the verification with three Auth0 SDKs are the site's statements, not independently confirmed. The site itself says both projects are early and not production-ready.

Risks and caveats

The site admits the projects are not production-ready, and SalesCompel's listed feature set is small compared with Salesforce as a whole. Legal risk is not settled by the site: it calls clean-room work established but says the page is not legal advice and tells businesses to consult their own counsel. The clean-room claim rests on the movement's own policies and recorded provenance, and on former employees keeping confidential knowledge out; those are process promises that outsiders can check but the site does not prove. The proposed future targets are explicitly not commitments, and no timeline is given for production readiness or for the next projects.

“The software built by the 99% belongs to the 99%.”

— OccupySaaS site