The open source taint analysis engine for the AI era

Formal inter-procedural taint analysis — finds what pattern matching engines miss, enacts what LLM agents discover as rules, scales where neither can alone.

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt

Supported technologies and integrations

                   

The most thorough taint analysis engine for Spring apps

Roadmap

                   

More screenshots

---

Why OpenTaint

AI generates production code faster than today's security tooling can keep up with.

LLM security agents find vulnerabilities humans miss, burn tokens on every file, and still can't guarantee they catch everything.

The more AI writes code, the more you need formal methods underneath.

• Find what pattern matching engines miss. The inter-procedural dataflow engine tracks untrusted data across function boundaries, persistence layers, aliases, and async code.
• One finding becomes total coverage. Code-native rules let you enact every uncovered vulnerability as a rule with the engine applying it across the entire codebase, deterministically, in minutes of CPU.
• Open source, batteries included. Engine, rules, CI integrations — the entire stack ships under Apache 2.0 and MIT. No paid tier to unlock taint tracking, no gates on writing your own rules.

Quick Start

Install script (Linux/macOS)

curl -fsSL https://raw.githubusercontent.com/seqra/opentaint/main/scripts/install/install.sh | bash

Install via Homebrew (Linux/macOS):

brew install --cask seqra/tap/opentaint

Install script (Windows PowerShell)

irm https://raw.githubusercontent.com/seqra/opentaint/main/scripts/install/install.ps1 | iex

Scan your project:

opentaint scan --output results.sarif /path/to/your/spring/project

Or use Docker:

docker run --rm -v $(pwd):/project -v $(pwd):/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --output /output/results.sarif /project

For more options, see Installation and Usage.

---

Documentation

Full guides — installation, usage, configuration, CI/CD integration: Documentation.

Support

• Issues: GitHub Issues
• Community: Discord
• Email: seqradev@gmail.com

License

The core analysis engine is released under the Apache 2.0 License. The CLI, GitHub Action, GitLab CI template, and rules are released under the MIT License.