Opentaint

OpenTaint is an open source taint analysis engine for finding security vulnerabilities in application code. It pairs two approaches: an AI agent reasons about a codebase to discover trust boundaries and new vulnerability patterns, and a formal program analysis engine then searches the entire project for every instance of a pattern. The vendor describes the result as continuous, lean and agentic application security testing. The workflow has three stages. In discovery, an agent identifies trust boundaries and vulnerability patterns. In enactment, that knowledge is written as taint rules and dependency models in YAML. In scanning, the engine analyzes the full program model and emits dataflow traces from source through calls and returns to sink, which the agent can then triage as confirmed findings or false alarms. Because the same code and rule always produce the same findings, results are reproducible, and scans run on the user's own hardware at CPU cost, which keeps sensitive code private. The project ships the analysis engine, rules and models, agent skills, a command line interface, a report viewer and CI integrations, all open source. The example shown on the site is a Java template injection, and the site presents a CVE study alongside it. It is aimed at security engineers and development teams who want repeatable vulnerability checks on every pull request and CI build. The site publishes no pricing, and the engine is offered as free open source software with unlimited scans.