OpenTaint

Formal methods advocate. Seqra.
Engineering OpenTaint — the open source taint analysis engine for the AI era.

[OpenTaint @seqradev]

🚨Seqra just open-sourced a security analyzer that your agents will love to work with.

It's called OpenTaint.
The open source taint analysis engine for the AI era.

https://t.co/EXgiy1C08e

Here is why you need it:

[OpenTaint @seqradev]

50 ⭐️ Thank you! 🙏
https://t.co/429EC0pYmg

https://t.co/PlZr2IjB5Q

#starhistory #GitHub #OpenSource via @StarHistoryHQ

[OpenTaint @seqradev]

Engine + CLI: https://t.co/EXgiy1C08e
Viewer: https://t.co/M98W5eEqxL

The viewer can produce a self-contained, offline HTML report for your own project.

Open source. Stars, issues, and rule PRs welcome.

[OpenTaint @seqradev]

🌱 Introducing an in-browser taint-flow viewer for OpenTaint — the most thorough taint analysis engine for Spring app security.

Live demo, built from our open-source Java + Kotlin Spring Boot demo app:
https://t.co/ngvb3AdjAX

[OpenTaint @seqradev]

The demo surfaces 13 findings:
• XSS across Spring controllers
• Server-side template injection
• SSRF through Kotlin coroutines

Click any finding, walk the flow end-to-end from untrusted input to the dangerous method call, and read the rule that fired alongside the code.

[OpenTaint @seqradev]

@IceSolst Even useful products get lost amidst this flood. It’s sad

[OpenTaint @seqradev]

@FlorianCaesar @SebAaltonen Taint analysis is really a way to control AI, can confirm it. We are building a customisable taint analyser to find security issues, and it works even better with custom project-specific rules.

[OpenTaint @seqradev]

@francescofaenzi Java/Kotlin
- OpenTaint

[OpenTaint @seqradev]

🚀 OpenTaint v0.3.0 is out — the most thorough taint analysis for Spring apps security!

A release focused on detection precision: content-type-aware XSS rule with type-argument matching and analyzer precision fixes.

🌟 Star the repo: https://t.co/EXgiy1C08e

#Java #Spring #SAST

[OpenTaint @seqradev]

@LiveOverflow It allows us to transform LLM agents' findings into a deterministic, cheap, reproducible, and scalable workflow.

The link: https://t.co/EXgiy1C08e

[OpenTaint @seqradev]

@LiveOverflow We are building this kind of tool to find deeply hidden vulnerabilities in applications, using taint analysis as a powerful, configurable search engine, so that an LLM can express the vulnerability pattern it found as a config for the engine.

[OpenTaint @seqradev]

@JinjingLiang @cursor_ai @semgrep @AquaTrivy @gitleaks Also take a look at OpenTaint – a super powerful open source taint analyser with dedicated Spring support https://t.co/EXgiy1C08e

[OpenTaint @seqradev]

opentaint scan

[OpenTaint @seqradev]

Full notes: https://t.co/8rfFxFHZgX

How to get it 👇

1/ curl:
curl -fsSL https://t.co/J52pHYgE7j | bash

2/ brew:
brew install --cask seqra/tap/opentaint

3/ upgrade anytime:
opentaint update

[OpenTaint @seqradev]

🚀 OpenTaint 0.2.0 is out — the most thorough taint analysis engine for Spring apps.

A release focused on day-1 experience, safe concurrency, and a faster analysis core.

Star the repo to follow along: https://t.co/XinxIz692C

#appsec #java #spring #sast #opensource

[OpenTaint @seqradev]

Opus 4.7 is quite good at writing rules for OpenTaint. Right now it's writing tests for XSS taint rules, checking if XSS is real at runtime using Playwright, and tuning rules to reduce false positives.

[OpenTaint @seqradev]

This is a taint rule.

[OpenTaint @seqradev]

Meanwhile, static taint analysis costs nothing, runs on the CPU in minutes, and works deterministically.

[Dan ⚡️ @d4m1n]

$20,000 to scan one codebase

that's what anthropic says it cost Mythos to find those zero days.
per repo.

except API tokens are currently sold at a LOSS. That "$20,000 scan" probably cost closer to $100,000+ in real gpu time

ffmpeg couldn't afford the subsidized price let alone the real one...

if the cost doesn't come down by a huge factor this just doesn't make sense.

It's Anthropic's marketing week 💀