From 52506da4ae018bc93d408ce398f61233cf2e349d Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Mon, 3 Aug 2026 09:28:33 +0300 Subject: [PATCH 01/11] docs: position OpenTaint for security agents --- README.md | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index fb6352e60..c1affa89d 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,11 @@

The open source taint analysis engine for the AI era

- Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. + Formal program analysis for security agents. +

+ +

+ A customizable, self-hosted dataflow analysis tool built so AI agents can drive application security without burning tokens on every scan.

@@ -102,18 +106,15 @@ ## Why OpenTaint? -> OpenTaint is an open-source alternative to *Semgrep Pro* and *CodeQL* — a formal inter-procedural taint engine you can customize and self-host, built so AI agents drive your security analysis without burning tokens on every scan. - -AI generates production code faster than security teams can keep up with, and the two kinds of tooling built to catch what it gets wrong each force a bad trade-off: - -- **AST-pattern matchers** (Semgrep OSS, ast-grep, linters) are free and fast, but they match syntax, not data flow — untrusted input that crosses a function boundary or a persistence layer slips right past. The deeper, inter-procedural analysis that *does* catch it has long been locked inside proprietary tools. -- **LLM security agents** find what pattern matchers miss, but they re-read your code on every run. The tokens add up with every file, every commit, every CI build — and a probabilistic model still can't promise it caught everything. +> The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint gives you the depth of an LLM agent at the cost of a static analyzer: +OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent enacts what it learns as durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. -- **Find what AST-pattern matchers miss.** A formal inter-procedural dataflow engine tracks untrusted data across function boundaries, persistence layers, aliases, and async code. -- **Pay the model once, not on every scan.** Let an agent distill a single finding into a taint rule. The deterministic engine then replays that rule across the entire codebase — and every commit after it — in minutes of CPU, at zero token cost. -- **Open source, batteries included.** Engine, rules, and CI integrations come as one stack under Apache 2.0 and MIT. +- **Learn on demand. Search on every scan.** Learning is expensive and unpredictable, searching cheap and deterministic — so the agent learns the code on demand, the engine searches it on every scan, and the security review becomes lean and continuous. +- **Enact what the agent learns.** Vulnerability patterns become readable AST-pattern taint rules that define forbidden dataflow traces. Code behavior becomes dataflow summaries that let the engine trace through code it never analyzed. +- **Fast scans. Fewer false alarms. Fewer missed findings.** OpenTaint is built to hold all three corners of the classic static-analysis trilemma. Its formal inter-procedural dataflow analysis tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. +- **Find what AST-pattern matchers miss.** Whole-program dataflow analysis follows tainted values across function boundaries and through deep object graphs rather than stopping at syntactic matches. +- **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. ## Quick Start From b64ffee3c89d79cf5c7ab945a5dc077d7c3c124e Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Mon, 3 Aug 2026 09:34:30 +0300 Subject: [PATCH 02/11] docs: explain continuous AppSec workflow --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index c1affa89d..59388e574 100644 --- a/README.md +++ b/README.md @@ -110,7 +110,7 @@ OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent enacts what it learns as durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. -- **Learn on demand. Search on every scan.** Learning is expensive and unpredictable, searching cheap and deterministic — so the agent learns the code on demand, the engine searches it on every scan, and the security review becomes lean and continuous. +- **Learn on demand. Search on every scan.** Learning an application's attack surface, trust boundaries, vulnerability patterns, and opaque code behavior is expensive and unpredictable. The agent does that work on demand and records what it learns in taint rules and dataflow summaries. Searching for those patterns is cheap and deterministic, so OpenTaint applies them on every scan and turns a deep security review into lean, continuous application security coverage. - **Enact what the agent learns.** Vulnerability patterns become readable AST-pattern taint rules that define forbidden dataflow traces. Code behavior becomes dataflow summaries that let the engine trace through code it never analyzed. - **Fast scans. Fewer false alarms. Fewer missed findings.** OpenTaint is built to hold all three corners of the classic static-analysis trilemma. Its formal inter-procedural dataflow analysis tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Find what AST-pattern matchers miss.** Whole-program dataflow analysis follows tainted values across function boundaries and through deep object graphs rather than stopping at syntactic matches. From 636421dfdd0e2f7786d0578d82be301a83bada75 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Mon, 3 Aug 2026 09:54:29 +0300 Subject: [PATCH 03/11] docs: sharpen customer security messaging --- README.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 59388e574..4ca56fa8c 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@

- A customizable, self-hosted dataflow analysis tool built so AI agents can drive application security without burning tokens on every scan. + A customizable, self-hosted dataflow analysis tool that turns every security review into coverage for every future commit.

@@ -108,14 +108,22 @@ > The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent enacts what it learns as durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. +OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, AppSec engineers, developers, and agents enact what they learn as durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. -- **Learn on demand. Search on every scan.** Learning an application's attack surface, trust boundaries, vulnerability patterns, and opaque code behavior is expensive and unpredictable. The agent does that work on demand and records what it learns in taint rules and dataflow summaries. Searching for those patterns is cheap and deterministic, so OpenTaint applies them on every scan and turns a deep security review into lean, continuous application security coverage. -- **Enact what the agent learns.** Vulnerability patterns become readable AST-pattern taint rules that define forbidden dataflow traces. Code behavior becomes dataflow summaries that let the engine trace through code it never analyzed. +- **Learn on demand. Search on every scan.** Learning an application's attack surface, trust boundaries, vulnerability patterns, and opaque code behavior is expensive and unpredictable. An AppSec engineer or agent does that work on demand and records what the review learns in taint rules and dataflow summaries. Searching for those patterns is cheap and deterministic, so OpenTaint applies them on every scan and turns a deep security review into lean, continuous application security coverage. +- **Make every security review executable.** Vulnerability patterns become readable AST-pattern taint rules that define forbidden dataflow traces. Code behavior becomes dataflow summaries that let the engine trace through code it never analyzed. - **Fast scans. Fewer false alarms. Fewer missed findings.** OpenTaint is built to hold all three corners of the classic static-analysis trilemma. Its formal inter-procedural dataflow analysis tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Find what AST-pattern matchers miss.** Whole-program dataflow analysis follows tainted values across function boundaries and through deep object graphs rather than stopping at syntactic matches. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. +## Application security is the new tech debt + +AI helps teams create code faster than anyone can review it. The security work does not disappear. It moves downstream into review queues, remediation backlogs, and incident response. Every unmodeled trust boundary and missed dataflow becomes invisible debt. Attackers automate discovery too. They will probe the paths your team misses whether or not your backlog is ready. Security debt is tech debt an attacker can force you to repay. OpenTaint turns security knowledge into versioned checks that run on every commit, so problems are found while the code is still fresh. + +- **For AppSec: make expert judgment outlive the review.** You are accountable for what reaches production, not for how many alerts a scanner found. Generic backlogs consume triage while project-specific knowledge remains in one expert's head. Capture attack surfaces, trust boundaries, and vulnerability patterns as rules and summaries the whole team can inspect, refine, and rerun. +- **For DevSecOps: keep the security gate on.** A control that makes builds slow or red for noise gets retried, suppressed, or moved out of the blocking path. OpenTaint runs deterministically on CPU with stable behavior, explainable traces, and self-hosted control. Every build gets the same analysis without waiting for a model to reread the repository. +- **For developers: fix security while you still remember the code.** A late finding steals time from the work in front of you. An incident makes you rediscover old code under pressure. OpenTaint shows which untrusted input reaches which dangerous operation and the full path through the program, so you can fix the flow in the pull request and keep the same bug class from returning. + ## Quick Start **Install script (Linux/macOS)** From bd9cc390ccc911d605584c3a6d148259408c28c1 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Mon, 3 Aug 2026 11:49:52 +0300 Subject: [PATCH 04/11] docs: sharpen AI-era security messaging --- README.md | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 4ca56fa8c..c123d6a0e 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@

- A customizable, self-hosted dataflow analysis tool that turns every security review into coverage for every future commit. + Runs standalone. Agents teach it your application. Every security review becomes coverage for every future commit.

@@ -108,22 +108,13 @@ > The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, AppSec engineers, developers, and agents enact what they learn as durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. +OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent enacts what it learns as durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. -- **Learn on demand. Search on every scan.** Learning an application's attack surface, trust boundaries, vulnerability patterns, and opaque code behavior is expensive and unpredictable. An AppSec engineer or agent does that work on demand and records what the review learns in taint rules and dataflow summaries. Searching for those patterns is cheap and deterministic, so OpenTaint applies them on every scan and turns a deep security review into lean, continuous application security coverage. -- **Make every security review executable.** Vulnerability patterns become readable AST-pattern taint rules that define forbidden dataflow traces. Code behavior becomes dataflow summaries that let the engine trace through code it never analyzed. -- **Fast scans. Fewer false alarms. Fewer missed findings.** OpenTaint is built to hold all three corners of the classic static-analysis trilemma. Its formal inter-procedural dataflow analysis tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. -- **Find what AST-pattern matchers miss.** Whole-program dataflow analysis follows tainted values across function boundaries and through deep object graphs rather than stopping at syntactic matches. +- **Learn on demand. Search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when that context is needed. OpenTaint reuses the resulting rules and summaries on every scan without spending model tokens again. +- **Make every security review executable.** The agent enacts what it learns. Vulnerability patterns become AST-pattern taint rules, while opaque code behavior becomes dataflow summaries the engine can search deterministically. +- **Fast scans. Fewer false alarms. Fewer missed findings.** Formal inter-procedural dataflow analysis tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. It finds what AST-pattern matchers miss without giving up deterministic scan time. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. -## Application security is the new tech debt - -AI helps teams create code faster than anyone can review it. The security work does not disappear. It moves downstream into review queues, remediation backlogs, and incident response. Every unmodeled trust boundary and missed dataflow becomes invisible debt. Attackers automate discovery too. They will probe the paths your team misses whether or not your backlog is ready. Security debt is tech debt an attacker can force you to repay. OpenTaint turns security knowledge into versioned checks that run on every commit, so problems are found while the code is still fresh. - -- **For AppSec: make expert judgment outlive the review.** You are accountable for what reaches production, not for how many alerts a scanner found. Generic backlogs consume triage while project-specific knowledge remains in one expert's head. Capture attack surfaces, trust boundaries, and vulnerability patterns as rules and summaries the whole team can inspect, refine, and rerun. -- **For DevSecOps: keep the security gate on.** A control that makes builds slow or red for noise gets retried, suppressed, or moved out of the blocking path. OpenTaint runs deterministically on CPU with stable behavior, explainable traces, and self-hosted control. Every build gets the same analysis without waiting for a model to reread the repository. -- **For developers: fix security while you still remember the code.** A late finding steals time from the work in front of you. An incident makes you rediscover old code under pressure. OpenTaint shows which untrusted input reaches which dangerous operation and the full path through the program, so you can fix the flow in the pull request and keep the same bug class from returning. - ## Quick Start **Install script (Linux/macOS)** @@ -165,6 +156,20 @@ docker run --rm -v $(pwd):/project -v $(pwd):/output \ For more options, see [Installation](docs/README.md#installation) and [Usage](docs/README.md#usage). +## Application security is the new tech debt + +AI makes code cheaper to produce, but moves security work downstream into review queues, remediation backlogs, and incident response. Attackers automate discovery too. Security debt is tech debt an attacker can force you to repay. OpenTaint turns each review into versioned checks that protect future commits. + +- **For AppSec: make expert judgment outlive the review.** You are accountable for what reaches production, not for how many alerts a scanner found. Capture project-specific attack surfaces, trust boundaries, and vulnerability patterns as coverage the whole team can inspect and rerun. **Stop reviewing the same risk twice. Make expertise compound, not the review queue.** +- **For DevSecOps: keep the security gate on.** A slow or noisy gate gets suppressed or moved out of the blocking path. OpenTaint runs deterministically on CPU with explainable traces and self-hosted control, without waiting for a model to reread the repository. **Keep security fast enough to stay in CI and dependable enough to enforce.** +- **For developers: fix security while you still remember the code.** A late finding steals time from the work in front of you. OpenTaint shows which untrusted input reaches which dangerous operation and the full path through the program, so you can fix the flow in the pull request. **Pay down security debt while the code is still fresh.** +- **For vibe coders: the agent can write the vulnerability before you notice the code path.** The output can look finished and pass its tests while an unsafe flow crosses helpers, fields, or libraries you never read. OpenTaint traces that dataflow deterministically before the change becomes invisible security debt. **Generate fast. Verify before merge.** + +### Proof, not promises + +- **[Detection depth, compared](https://opentaint.org/blog/semgrep-vs-codeql-vs-opentaint).** See Semgrep, CodeQL, and OpenTaint run against five progressively harder Java XSS cases, from direct returns to builders with virtual dispatch. +- **[A real unauthenticated RCE, from endpoint to exploit](https://opentaint.org/blog/conductor-rce-cve-2026-58138).** Follow CVE-2026-58138 through Conductor and GraalVM, see why four stock scans missed it, and how the agent turned the review into a tested rule and reusable dataflow model. + --- ## AI Agent Workflows From 22662cd31d78f2d845de9c7edda0f5562e940601 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Mon, 3 Aug 2026 18:08:05 +0300 Subject: [PATCH 05/11] docs: frame security analysis around durable context --- README.md | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index c123d6a0e..e9e416b25 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@

- Runs standalone. Agents teach it your application. Every security review becomes coverage for every future commit. + AI agents learn your application on demand. OpenTaint scans it on every change.

@@ -108,11 +108,11 @@ > The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent enacts what it learns as durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. +OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent turns what it learns into durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. This creates a repeatable loop: -- **Learn on demand. Search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when that context is needed. OpenTaint reuses the resulting rules and summaries on every scan without spending model tokens again. -- **Make every security review executable.** The agent enacts what it learns. Vulnerability patterns become AST-pattern taint rules, while opaque code behavior becomes dataflow summaries the engine can search deterministically. -- **Fast scans. Fewer false alarms. Fewer missed findings.** Formal inter-procedural dataflow analysis tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. It finds what AST-pattern matchers miss without giving up deterministic scan time. +- **Learn on demand. Search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine reuses that knowledge on every scan without spending model tokens again. +- **Make every security review executable.** The agent turns vulnerability patterns into AST-pattern taint rules and opaque code behavior into dataflow summaries. Both become versioned, reviewable analysis artifacts. +- **Fast scans. Fewer false alarms. Fewer missed findings.** The engine applies those artifacts with formal inter-procedural dataflow analysis, tracking tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. ## Quick Start @@ -158,12 +158,14 @@ For more options, see [Installation](docs/README.md#installation) and [Usage](do ## Application security is the new tech debt -AI makes code cheaper to produce, but moves security work downstream into review queues, remediation backlogs, and incident response. Attackers automate discovery too. Security debt is tech debt an attacker can force you to repay. OpenTaint turns each review into versioned checks that protect future commits. +AI makes code cheaper to produce and harder to fully review. Security work moves downstream into review queues, remediation backlogs, and incident response, while attackers automate discovery too. Application security becomes tech debt an attacker can force you to repay. You start paying for that debt long before an incident. -- **For AppSec: make expert judgment outlive the review.** You are accountable for what reaches production, not for how many alerts a scanner found. Capture project-specific attack surfaces, trust boundaries, and vulnerability patterns as coverage the whole team can inspect and rerun. **Stop reviewing the same risk twice. Make expertise compound, not the review queue.** -- **For DevSecOps: keep the security gate on.** A slow or noisy gate gets suppressed or moved out of the blocking path. OpenTaint runs deterministically on CPU with explainable traces and self-hosted control, without waiting for a model to reread the repository. **Keep security fast enough to stay in CI and dependable enough to enforce.** -- **For developers: fix security while you still remember the code.** A late finding steals time from the work in front of you. OpenTaint shows which untrusted input reaches which dangerous operation and the full path through the program, so you can fix the flow in the pull request. **Pay down security debt while the code is still fresh.** -- **For vibe coders: the agent can write the vulnerability before you notice the code path.** The output can look finished and pass its tests while an unsafe flow crosses helpers, fields, or libraries you never read. OpenTaint traces that dataflow deterministically before the change becomes invisible security debt. **Generate fast. Verify before merge.** +- **Did the agent write a vulnerability into code you never reviewed?** The output can look finished and pass its tests while an unsafe flow crosses helpers, fields, or libraries you never read. OpenTaint traces that dataflow before the change becomes invisible security debt. **Generate fast. Verify before merge.** +- **Is the feature done if a vulnerability ships with it?** A feature that passes its tests can still carry security debt into production, where the fix competes with roadmap work and incident response. OpenTaint traces risky dataflow in the pull request, before that debt becomes an emergency. **Make secure part of done.** +- **Will your security agent find tomorrow what it found today?** An agent can discover a vulnerability pattern once, then miss it on the next nondeterministic review. OpenTaint turns what the agent learns into versioned AST-pattern taint rules and dataflow summaries the engine searches on every scan. **Turn every discovery into deterministic coverage.** +- **How many times will you pay an agent to review the same risk?** Your last security review already paid to uncover the application’s trust boundaries and dangerous flows. Every scan that starts from zero spends tokens rebuilding security context you already owned. OpenTaint preserves that knowledge as reusable rules and summaries, then searches them deterministically on CPU. **Spend tokens only when new context must be learned. Keep every scan fast enough to enforce.** + +OpenTaint breaks that cycle by separating learning from searching. The agent learns the application when new context is needed. The engine searches what the agent learned on every scan, turning each review into coverage for every future commit. ### Proof, not promises From 27cc0b95426bb52592853b283a44191bb11cdf08 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Mon, 3 Aug 2026 18:55:27 +0300 Subject: [PATCH 06/11] docs: align taint and dataflow terminology --- README.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index e9e416b25..c78bf4cb3 100644 --- a/README.md +++ b/README.md @@ -106,13 +106,13 @@ ## Why OpenTaint? -> The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. +> The open source taint analysis engine for the AI era. Powered by formal inter-procedural dataflow analysis. Customizable and self-hosted, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent turns what it learns into durable, reviewable analysis artifacts. The engine then searches for the resulting dataflow patterns across the whole codebase. This creates a repeatable loop: +OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent records vulnerability patterns as AST-pattern taint rules and the behavior of opaque code as dataflow summaries. On every scan, the engine applies those rules and consults those summaries while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: -- **Learn on demand. Search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine reuses that knowledge on every scan without spending model tokens again. +- **Learn on demand. Search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and consults the resulting dataflow summaries on every scan without spending model tokens again. - **Make every security review executable.** The agent turns vulnerability patterns into AST-pattern taint rules and opaque code behavior into dataflow summaries. Both become versioned, reviewable analysis artifacts. -- **Fast scans. Fewer false alarms. Fewer missed findings.** The engine applies those artifacts with formal inter-procedural dataflow analysis, tracking tainted values across procedures, fields, aliases, async code, and persistence layers at scale. +- **Fast scans. Fewer false alarms. Fewer missed findings.** The engine runs formal inter-procedural dataflow analysis, applying taint rules and consulting dataflow summaries as it tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. ## Quick Start @@ -160,17 +160,17 @@ For more options, see [Installation](docs/README.md#installation) and [Usage](do AI makes code cheaper to produce and harder to fully review. Security work moves downstream into review queues, remediation backlogs, and incident response, while attackers automate discovery too. Application security becomes tech debt an attacker can force you to repay. You start paying for that debt long before an incident. -- **Did the agent write a vulnerability into code you never reviewed?** The output can look finished and pass its tests while an unsafe flow crosses helpers, fields, or libraries you never read. OpenTaint traces that dataflow before the change becomes invisible security debt. **Generate fast. Verify before merge.** -- **Is the feature done if a vulnerability ships with it?** A feature that passes its tests can still carry security debt into production, where the fix competes with roadmap work and incident response. OpenTaint traces risky dataflow in the pull request, before that debt becomes an emergency. **Make secure part of done.** -- **Will your security agent find tomorrow what it found today?** An agent can discover a vulnerability pattern once, then miss it on the next nondeterministic review. OpenTaint turns what the agent learns into versioned AST-pattern taint rules and dataflow summaries the engine searches on every scan. **Turn every discovery into deterministic coverage.** -- **How many times will you pay an agent to review the same risk?** Your last security review already paid to uncover the application’s trust boundaries and dangerous flows. Every scan that starts from zero spends tokens rebuilding security context you already owned. OpenTaint preserves that knowledge as reusable rules and summaries, then searches them deterministically on CPU. **Spend tokens only when new context must be learned. Keep every scan fast enough to enforce.** +- **Did the agent write a vulnerability into code you never reviewed?** The output can look finished and pass its tests while an untrusted value crosses helpers, fields, or libraries you never read before reaching a dangerous operation. OpenTaint reports the complete source-to-sink taint trace before the change becomes invisible security debt. **Generate fast. Verify before merge.** +- **Is the feature done if a vulnerability ships with it?** A feature that passes its tests can still carry security debt into production, where the fix competes with roadmap work and incident response. OpenTaint finds forbidden source-to-sink flows in the pull request and reports the taint trace before that debt becomes an emergency. **Make secure part of done.** +- **Will your security agent find tomorrow what it found today?** An agent can discover a vulnerability pattern once, then miss it on the next nondeterministic review. OpenTaint records that pattern as a versioned AST-pattern taint rule that the engine applies on every scan. **Turn every discovery into deterministic coverage.** +- **How many times will you pay an agent to review the same risk?** Your last security review already paid to understand the application’s trust boundaries, vulnerability patterns, and opaque code behavior. Every scan that starts from zero spends tokens rebuilding security context you already owned. OpenTaint records that context as taint rules and dataflow summaries, then applies the rules and consults the summaries on every change. **Spend tokens only when new context must be learned. Keep every scan fast enough to enforce.** -OpenTaint breaks that cycle by separating learning from searching. The agent learns the application when new context is needed. The engine searches what the agent learned on every scan, turning each review into coverage for every future commit. +OpenTaint breaks that cycle by separating adaptive learning from deterministic analysis. The agent investigates new security context when needed. The engine applies the resulting taint rules, consults the dataflow summaries, and runs taint analysis on every scan. Each review becomes coverage for every future commit. ### Proof, not promises - **[Detection depth, compared](https://opentaint.org/blog/semgrep-vs-codeql-vs-opentaint).** See Semgrep, CodeQL, and OpenTaint run against five progressively harder Java XSS cases, from direct returns to builders with virtual dispatch. -- **[A real unauthenticated RCE, from endpoint to exploit](https://opentaint.org/blog/conductor-rce-cve-2026-58138).** Follow CVE-2026-58138 through Conductor and GraalVM, see why four stock scans missed it, and how the agent turned the review into a tested rule and reusable dataflow model. +- **[A real unauthenticated RCE, from endpoint to exploit](https://opentaint.org/blog/conductor-rce-cve-2026-58138).** Follow CVE-2026-58138 through Conductor and GraalVM, see why four stock scans missed it, and how the agent turned the review into a tested taint rule and reusable dataflow summary. --- @@ -182,13 +182,13 @@ OpenTaint includes agent skills that turn static analysis into an end-to-end app npx skills add https://github.com/seqra/opentaint ``` -The `appsec-agent` skill orchestrates a full project assessment: build the project, run OpenTaint, discover the attack surface, add targeted rules, model missing library data flows, triage findings, and optionally generate dynamic proof-of-concept checks for confirmed vulnerabilities. +The `appsec-agent` skill orchestrates a full project assessment: build the project, run OpenTaint, discover the attack surface, add targeted taint rules, create summaries for opaque library code, triage findings, and optionally generate dynamic proof-of-concept checks for confirmed vulnerabilities. Included skills cover the common security-analysis loop: - **Scan and triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc` - **Coverage expansion:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules` -- **Dataflow modeling:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue` +- **Dataflow summaries:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue` --- From 47963d7e2109c9e605a7e2042f8bc6863718b4eb Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Mon, 3 Aug 2026 19:08:18 +0300 Subject: [PATCH 07/11] docs: simplify learning thesis punctuation --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index c78bf4cb3..dd15f743a 100644 --- a/README.md +++ b/README.md @@ -110,7 +110,7 @@ OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent records vulnerability patterns as AST-pattern taint rules and the behavior of opaque code as dataflow summaries. On every scan, the engine applies those rules and consults those summaries while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: -- **Learn on demand. Search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and consults the resulting dataflow summaries on every scan without spending model tokens again. +- **Learn on demand, search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and consults the resulting dataflow summaries on every scan without spending model tokens again. - **Make every security review executable.** The agent turns vulnerability patterns into AST-pattern taint rules and opaque code behavior into dataflow summaries. Both become versioned, reviewable analysis artifacts. - **Fast scans. Fewer false alarms. Fewer missed findings.** The engine runs formal inter-procedural dataflow analysis, applying taint rules and consulting dataflow summaries as it tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. From 6e72ea26fa63df146dfff946d48981c982fa8290 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Tue, 4 Aug 2026 16:08:41 +0300 Subject: [PATCH 08/11] docs: rename dataflow summaries to dependency models --- README.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index dd15f743a..8a7344494 100644 --- a/README.md +++ b/README.md @@ -108,11 +108,11 @@ > The open source taint analysis engine for the AI era. Powered by formal inter-procedural dataflow analysis. Customizable and self-hosted, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent records vulnerability patterns as AST-pattern taint rules and the behavior of opaque code as dataflow summaries. On every scan, the engine applies those rules and consults those summaries while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: +OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent records vulnerability patterns as AST-pattern taint rules and the behavior of opaque code as dependency models. On every scan, the engine applies those rules and dependency models while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: -- **Learn on demand, search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and consults the resulting dataflow summaries on every scan without spending model tokens again. -- **Make every security review executable.** The agent turns vulnerability patterns into AST-pattern taint rules and opaque code behavior into dataflow summaries. Both become versioned, reviewable analysis artifacts. -- **Fast scans. Fewer false alarms. Fewer missed findings.** The engine runs formal inter-procedural dataflow analysis, applying taint rules and consulting dataflow summaries as it tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. +- **Learn on demand, search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and applies the resulting dependency models on every scan without spending model tokens again. +- **Make every security review executable.** The agent turns vulnerability patterns into AST-pattern taint rules and opaque code behavior into dependency models. Both become versioned, reviewable analysis artifacts. +- **Fast scans. Fewer false alarms. Fewer missed findings.** The engine runs formal inter-procedural dataflow analysis, applying taint rules and dependency models as it tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. ## Quick Start @@ -163,14 +163,14 @@ AI makes code cheaper to produce and harder to fully review. Security work moves - **Did the agent write a vulnerability into code you never reviewed?** The output can look finished and pass its tests while an untrusted value crosses helpers, fields, or libraries you never read before reaching a dangerous operation. OpenTaint reports the complete source-to-sink taint trace before the change becomes invisible security debt. **Generate fast. Verify before merge.** - **Is the feature done if a vulnerability ships with it?** A feature that passes its tests can still carry security debt into production, where the fix competes with roadmap work and incident response. OpenTaint finds forbidden source-to-sink flows in the pull request and reports the taint trace before that debt becomes an emergency. **Make secure part of done.** - **Will your security agent find tomorrow what it found today?** An agent can discover a vulnerability pattern once, then miss it on the next nondeterministic review. OpenTaint records that pattern as a versioned AST-pattern taint rule that the engine applies on every scan. **Turn every discovery into deterministic coverage.** -- **How many times will you pay an agent to review the same risk?** Your last security review already paid to understand the application’s trust boundaries, vulnerability patterns, and opaque code behavior. Every scan that starts from zero spends tokens rebuilding security context you already owned. OpenTaint records that context as taint rules and dataflow summaries, then applies the rules and consults the summaries on every change. **Spend tokens only when new context must be learned. Keep every scan fast enough to enforce.** +- **How many times will you pay an agent to review the same risk?** Your last security review already paid to understand the application’s trust boundaries, vulnerability patterns, and opaque code behavior. Every scan that starts from zero spends tokens rebuilding security context you already owned. OpenTaint records that context as taint rules and dependency models, then applies both on every change. **Spend tokens only when new context must be learned. Keep every scan fast enough to enforce.** -OpenTaint breaks that cycle by separating adaptive learning from deterministic analysis. The agent investigates new security context when needed. The engine applies the resulting taint rules, consults the dataflow summaries, and runs taint analysis on every scan. Each review becomes coverage for every future commit. +OpenTaint breaks that cycle by separating adaptive learning from deterministic analysis. The agent investigates new security context when needed. The engine applies the resulting taint rules and dependency models, and runs taint analysis on every scan. Each review becomes coverage for every future commit. ### Proof, not promises - **[Detection depth, compared](https://opentaint.org/blog/semgrep-vs-codeql-vs-opentaint).** See Semgrep, CodeQL, and OpenTaint run against five progressively harder Java XSS cases, from direct returns to builders with virtual dispatch. -- **[A real unauthenticated RCE, from endpoint to exploit](https://opentaint.org/blog/conductor-rce-cve-2026-58138).** Follow CVE-2026-58138 through Conductor and GraalVM, see why four stock scans missed it, and how the agent turned the review into a tested taint rule and reusable dataflow summary. +- **[A real unauthenticated RCE, from endpoint to exploit](https://opentaint.org/blog/conductor-rce-cve-2026-58138).** Follow CVE-2026-58138 through Conductor and GraalVM, see why four stock scans missed it, and how the agent turned the review into a tested taint rule and reusable dependency model. --- @@ -182,13 +182,13 @@ OpenTaint includes agent skills that turn static analysis into an end-to-end app npx skills add https://github.com/seqra/opentaint ``` -The `appsec-agent` skill orchestrates a full project assessment: build the project, run OpenTaint, discover the attack surface, add targeted taint rules, create summaries for opaque library code, triage findings, and optionally generate dynamic proof-of-concept checks for confirmed vulnerabilities. +The `appsec-agent` skill orchestrates a full project assessment: build the project, run OpenTaint, discover the attack surface, add targeted taint rules, model opaque library code, triage findings, and optionally generate dynamic proof-of-concept checks for confirmed vulnerabilities. Included skills cover the common security-analysis loop: - **Scan and triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc` - **Coverage expansion:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules` -- **Dataflow summaries:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue` +- **Dependency models:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue` --- From f0220584b064f17995e89530e6acc43ec5c64903 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Wed, 5 Aug 2026 11:17:25 +0300 Subject: [PATCH 09/11] docs: align README with landing page --- README.md | 37 ++++++++++--------------------------- 1 file changed, 10 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 8a7344494..54943725d 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@

- AI agents learn your application on demand. OpenTaint scans it on every change. + AI agents review your application on demand. OpenTaint scans it on every change.

@@ -37,17 +37,11 @@

-

Supported technologies and integrations

+

Supported languages and frameworks

Java     Kotlin     Spring     - - - - GitHub -      - GitLab

The most thorough taint analysis engine for Spring apps

@@ -108,10 +102,10 @@ > The open source taint analysis engine for the AI era. Powered by formal inter-procedural dataflow analysis. Customizable and self-hosted, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, the agent records vulnerability patterns as AST-pattern taint rules and the behavior of opaque code as dependency models. On every scan, the engine applies those rules and dependency models while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: +OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, a security agent finds vulnerabilities. The OpenTaint agent enacts versioned AST-pattern taint rules from those vulnerabilities and captures opaque code behavior as dependency models. On every scan, the engine applies those rules and dependency models while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: -- **Learn on demand, search on every scan.** The agent learns the attack surface, trust boundaries, vulnerability patterns, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and applies the resulting dependency models on every scan without spending model tokens again. -- **Make every security review executable.** The agent turns vulnerability patterns into AST-pattern taint rules and opaque code behavior into dependency models. Both become versioned, reviewable analysis artifacts. +- **Review on demand. Scan every change.** A security agent reviews the attack surface, trust boundaries, vulnerabilities, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and dependency models on every scan without spending model tokens again. +- **Make every security review executable.** The OpenTaint agent enacts AST-pattern taint rules from vulnerabilities and captures opaque code behavior as dependency models. Both become versioned, reviewable analysis artifacts. - **Fast scans. Fewer false alarms. Fewer missed findings.** The engine runs formal inter-procedural dataflow analysis, applying taint rules and dependency models as it tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. @@ -156,22 +150,6 @@ docker run --rm -v $(pwd):/project -v $(pwd):/output \ For more options, see [Installation](docs/README.md#installation) and [Usage](docs/README.md#usage). -## Application security is the new tech debt - -AI makes code cheaper to produce and harder to fully review. Security work moves downstream into review queues, remediation backlogs, and incident response, while attackers automate discovery too. Application security becomes tech debt an attacker can force you to repay. You start paying for that debt long before an incident. - -- **Did the agent write a vulnerability into code you never reviewed?** The output can look finished and pass its tests while an untrusted value crosses helpers, fields, or libraries you never read before reaching a dangerous operation. OpenTaint reports the complete source-to-sink taint trace before the change becomes invisible security debt. **Generate fast. Verify before merge.** -- **Is the feature done if a vulnerability ships with it?** A feature that passes its tests can still carry security debt into production, where the fix competes with roadmap work and incident response. OpenTaint finds forbidden source-to-sink flows in the pull request and reports the taint trace before that debt becomes an emergency. **Make secure part of done.** -- **Will your security agent find tomorrow what it found today?** An agent can discover a vulnerability pattern once, then miss it on the next nondeterministic review. OpenTaint records that pattern as a versioned AST-pattern taint rule that the engine applies on every scan. **Turn every discovery into deterministic coverage.** -- **How many times will you pay an agent to review the same risk?** Your last security review already paid to understand the application’s trust boundaries, vulnerability patterns, and opaque code behavior. Every scan that starts from zero spends tokens rebuilding security context you already owned. OpenTaint records that context as taint rules and dependency models, then applies both on every change. **Spend tokens only when new context must be learned. Keep every scan fast enough to enforce.** - -OpenTaint breaks that cycle by separating adaptive learning from deterministic analysis. The agent investigates new security context when needed. The engine applies the resulting taint rules and dependency models, and runs taint analysis on every scan. Each review becomes coverage for every future commit. - -### Proof, not promises - -- **[Detection depth, compared](https://opentaint.org/blog/semgrep-vs-codeql-vs-opentaint).** See Semgrep, CodeQL, and OpenTaint run against five progressively harder Java XSS cases, from direct returns to builders with virtual dispatch. -- **[A real unauthenticated RCE, from endpoint to exploit](https://opentaint.org/blog/conductor-rce-cve-2026-58138).** Follow CVE-2026-58138 through Conductor and GraalVM, see why four stock scans missed it, and how the agent turned the review into a tested taint rule and reusable dependency model. - --- ## AI Agent Workflows @@ -190,6 +168,11 @@ Included skills cover the common security-analysis loop: - **Coverage expansion:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules` - **Dependency models:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue` +## Show, don't tell + +- **[Detection depth, compared](https://opentaint.org/blog/semgrep-vs-codeql-vs-opentaint).** See Semgrep, CodeQL, and OpenTaint run against five progressively harder Java XSS cases, from direct returns to builders with virtual dispatch. +- **[A real unauthenticated RCE, from endpoint to exploit](https://opentaint.org/blog/conductor-rce-cve-2026-58138).** Follow CVE-2026-58138 through Conductor and GraalVM, see why four stock scans missed it, and how the agent turned the review into a tested taint rule and reusable dependency model. + --- ## Documentation From 287add07795c6b5795dd42b19c3dd355cb6ac2e4 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Wed, 5 Aug 2026 11:30:46 +0300 Subject: [PATCH 10/11] docs: align review and scan phrasing --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 54943725d..b6279c960 100644 --- a/README.md +++ b/README.md @@ -104,7 +104,7 @@ OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, a security agent finds vulnerabilities. The OpenTaint agent enacts versioned AST-pattern taint rules from those vulnerabilities and captures opaque code behavior as dependency models. On every scan, the engine applies those rules and dependency models while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: -- **Review on demand. Scan every change.** A security agent reviews the attack surface, trust boundaries, vulnerabilities, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and dependency models on every scan without spending model tokens again. +- **Review on demand, scan on every change.** A security agent reviews the attack surface, trust boundaries, vulnerabilities, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and dependency models on every scan without spending model tokens again. - **Make every security review executable.** The OpenTaint agent enacts AST-pattern taint rules from vulnerabilities and captures opaque code behavior as dependency models. Both become versioned, reviewable analysis artifacts. - **Fast scans. Fewer false alarms. Fewer missed findings.** The engine runs formal inter-procedural dataflow analysis, applying taint rules and dependency models as it tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT. From 3316dfc5c9bf5eb216cc422b1c3288229633f6c0 Mon Sep 17 00:00:00 2001 From: Aleksandr Misonizhnik Date: Wed, 5 Aug 2026 13:37:47 +0300 Subject: [PATCH 11/11] docs: align README with reusable scan message --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b6279c960..99a1819b8 100644 --- a/README.md +++ b/README.md @@ -102,10 +102,10 @@ > The open source taint analysis engine for the AI era. Powered by formal inter-procedural dataflow analysis. Customizable and self-hosted, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to *Semgrep Pro* and *CodeQL*. -OpenTaint is an open source taint analysis engine designed to work with AI agents. During a security review, a security agent finds vulnerabilities. The OpenTaint agent enacts versioned AST-pattern taint rules from those vulnerabilities and captures opaque code behavior as dependency models. On every scan, the engine applies those rules and dependency models while formal inter-procedural dataflow analysis tracks tainted values across the codebase. This creates a repeatable loop: +OpenTaint lets you turn what agents learn during a probabilistic security review into reusable, deterministic scans. A security agent reviews the application and finds vulnerabilities. The OpenTaint agent enacts versioned AST-pattern taint rules from those vulnerabilities and captures opaque code behavior as dependency models. On every scan, the engine uses those rules and dependency models to perform formal inter-procedural dataflow analysis across the codebase. -- **Review on demand, scan on every change.** A security agent reviews the attack surface, trust boundaries, vulnerabilities, and opaque code behavior when new context is needed. The engine applies the resulting taint rules and dependency models on every scan without spending model tokens again. - **Make every security review executable.** The OpenTaint agent enacts AST-pattern taint rules from vulnerabilities and captures opaque code behavior as dependency models. Both become versioned, reviewable analysis artifacts. +- **Turn what agents learn into reusable search.** A security agent reviews the attack surface, trust boundaries, vulnerabilities, and opaque code behavior when new context is needed. OpenTaint preserves that knowledge as AST-pattern taint rules and dependency models, then applies both on every scan without spending model tokens again. - **Fast scans. Fewer false alarms. Fewer missed findings.** The engine runs formal inter-procedural dataflow analysis, applying taint rules and dependency models as it tracks tainted values across procedures, fields, aliases, async code, and persistence layers at scale. - **Open source, batteries included.** Engine, AST-pattern rules, agent skills, and CI integrations ship as one stack under Apache 2.0 and MIT.