Documentation

June 28, 2026 · View on GitHub

Contents

Guides

About OpenTaint

AI generates production code faster than today's security tooling can keep up with. The code looks production-ready — yet it buries vulnerabilities in data flows that are fundamentally hard to catch. These include untrusted input winding through framework abstractions, cross-controller interactions with persistence layers, and async code. At the rate AI produces it, humans can't review this code at the depth it requires.

The tools meant to help aren't keeping up either — AST-pattern matchers catch surface-level issues but struggle to follow data flow across function and file boundaries, LLM agents burn tokens on every file and still produce inconsistent results, and enterprise analyzers that go further gate their analysis behind a paywall, with rule sets that rarely cover your stack.

The more AI writes code, the more you need formal methods underneath.

Find what AST-pattern matchers miss

The engine runs IFDS-with-abduction — formal inter-procedural dataflow analysis. It tracks untrusted data from HTTP inputs to dangerous APIs across endpoints, persistence layers, object fields, aliased references, and async code. That includes multi-hop attack paths — cross-endpoint flows, stored injections, data through object fields and aliases — at monorepo scale. 100+ rules across 20+ vulnerability classes.

Models Spring data flow and the full Boot ecosystem, analyzing Java and Kotlin at bytecode level. More languages and frameworks ahead.

One finding becomes total coverage

LLM security agents find things — but at token cost per file, with results that shift each run, and no guarantee of complete coverage. AST-pattern rules turn their findings into leverage. For every vulnerability an agent uncovers, it can enact a rule — a source, a sink, and the data flow between them — which the agent can write itself. The engine applies that rule across the entire codebase, deterministically, in minutes of CPU. When a finding is a false positive, a sanitizer can be added to the rule — the refinement propagates to every match, permanently. One discovery compounds across the entire codebase.

The entire system is designed to work with AI agents. Formal analysis produces reproducible results agents can act on without introducing uncertainty. Rules read like code, not a proprietary DSL — so agents write and tune them the same way humans do.

Open source, batteries included

Engine, CLI, GitHub Action, GitLab CI, rules — the entire stack, including the deep analysis, is released under Apache 2.0 and MIT. No paid tier to unlock taint tracking. No vendor lock-in on your rule library. Other tools make you pay for it — Semgrep gates inter-procedural taint tracking behind a paid Pro tier, CodeQL requires GHAS for private repos. OpenTaint doesn't.

What OpenTaint Catches

The engine tracks data from controller parameters through your web application to dangerous sinks.

Consider a search endpoint that concatenates user input into SQL:

// UserController.java
@GetMapping("/users/search")
public List<User> searchUsers(@RequestParam String name) {
    String sql = "SELECT * FROM users WHERE name = '" + name + "'";
    return jdbcTemplate.query(sql, userRowMapper);
}

OpenTaint reports: sql-injection-in-spring-app at GET /users/search — untrusted input flows to SQL query.

Consider a greeting endpoint that reflects user input without escaping:

// GreetingController.java
@GetMapping("/greet")
@ResponseBody
public String greet(@RequestParam String name) {
    return "<h1>Hello, " + name + "!</h1>";
}

OpenTaint reports: xss-in-spring-app at GET /greet — user input returned without HTML escaping.

Consider a proxy endpoint that passes a user-controlled URL directly to an HTTP client:

// ProxyController.java
@GetMapping("/fetch")
public String fetchUrl(@RequestParam String url) {
    return restTemplate.getForObject(url, String.class);
}

OpenTaint reports: ssrf-in-spring-app at GET /fetch — user-controlled URL passed to HTTP client.

Each finding includes the HTTP endpoint, making it easy to map your application's attack surface.

Installation

MethodCommand
Homebrew (Linux/macOS)brew install --cask seqra/tap/opentaint
npm / npx (Linux/macOS/Windows)npm install -g @seqra/opentaint — or npx @seqra/opentaint scan to run without installing (needs Node.js)
Install script (Linux/macOS)curl -fsSL https://opentaint.org/install.sh | bash
Install script (Windows PowerShell)irm https://opentaint.org/install.ps1 | iex
Install script (Windows CMD)curl -fsSL https://opentaint.org/install.cmd -o install.cmd && install.cmd && del install.cmd
DockerSee Docker docs
BinaryDownload from releases

Release archives come in three variants: opentaint-full (binary + JARs + rules + JRE), opentaint (binary + JARs + rules), and opentaint-cli (binary only). Homebrew and install scripts default to full.

For detailed instructions, see Installation Guide.

Usage

opentaint scan                                            # Scan current directory
npx @seqra/opentaint scan                                 # Run without installing (needs Node.js)
opentaint scan --output results.sarif                     # Scan with explicit output path
opentaint summary --show-findings results.sarif           # View results
opentaint summary --show-findings --verbose-flow --show-code-snippets results.sarif  # Full detail
CommandDescription
opentaint scanAnalyze projects (auto-detects Maven/Gradle)
opentaint compileBuild project model separately
opentaint projectCreate model from precompiled JARs
opentaint summaryView SARIF results
opentaint healthShow resolved analyzer, autobuilder, rules, and runtime paths
opentaint test ruleScaffold, test, and debug detection rules
opentaint test approximationScaffold and test dataflow approximations
opentaint pullDownload dependencies
opentaint updateUpdate to latest version
opentaint pruneRemove stale artifacts and cached models

Options: --max-memory 16G, --timeout 5m, --severity error, --recompile, --config config.yaml

For detailed usage, see Usage Guide.

Configuration

scan:
  timeout: 15m
  max_memory: 16G
output:
  debug: false   # true to enable debug output
  color: auto    # auto, always, never

Or use environment variables: OPENTAINT_SCAN_TIMEOUT=30m, OPENTAINT_SCAN_MAX_MEMORY=16G

For detailed configuration, see Configuration Guide.

CI/CD Integration

Troubleshooting

IssueSolution
Build failsEnsure mvn compile or gradle build works; set JAVA_HOME
Out of memoryUse --max-memory 16G
TimeoutUse --timeout 20m
Re-download depsopentaint prune --yes && opentaint pull
Stale cached modelUse --recompile to force recompilation
DebugUse --debug

For detailed troubleshooting, see Troubleshooting Guide.

Support

License

The core analysis engine is released under the Apache 2.0 License. The CLI, GitHub Action, GitLab CI template, and rules are released under the MIT License.