OpenTaint
A data-flow-based, lightweight formal verification engine for application security, described as 'SAST++'. It provides deep enough analysis for real formal guarantees about a codebase (so zero findings actually mean something), runs fast enough to shift formal verification left and apply it to every feature during development (including agentic development sessions), and supports writing expressive, customizable specs for most OWASP Top 10 vulnerability types such as Broken Access Control and business logic flaws. Includes skills for writing specs.
What it addresses
Traditional SAST tools are shallow, so clean scans may just indicate a broken tool rather than a genuinely secure codebase, and they are too slow or inflexible to cover vulnerability classes like access control and business logic flaws during development.
Shared over time
Each entry reflects what was shared on that date. Details may have changed since then.
OpenTaint
A data-flow-based, lightweight formal verification engine for application security, described as 'SAST++'. It provides deep enough analysis for real formal guarantees about a codebase (so zero findings actually mean something), runs fast enough to shift formal verification left and apply it to every feature during development (including agentic development sessions), and supports writing expressive, customizable specs for most OWASP Top 10 vulnerability types such as Broken Access Control and business logic flaws. Includes skills for writing specs.
Problem: Traditional SAST tools are shallow, so clean scans may just indicate a broken tool rather than a genuinely secure codebase, and they are too slow or inflexible to cover vulnerability classes like access control and business logic flaws during development.
Audience: Developers applying security verification to every feature during development, including agentic development sessions.
Posted by @seqradev · Original comment ↗
“A data-flow-based, lightweight formal verification engine for application security. Basically, it's SAST++:”