Seqra builds formal program analysis for security agents.
Security agents inspect a codebase and save what they learn as taint rules and dependency models. On later scans, static analysis applies those files instead of asking an LLM to rediscover the same behavior. This makes agentic application security testing continuous and lean.
OpenTaint is the static-analysis part of this workflow. It is an open source taint analysis engine that tracks untrusted data across methods, fields, aliases, asynchronous code, persistence layers, and framework boundaries.
During a security review, the agent creates two kinds of files:
- Taint rules define vulnerability classes using sources, sinks, and sanitizers.
- Dependency models describe how data moves through library and framework code that OpenTaint does not analyze directly.
OpenTaint applies both across the whole codebase. When a scan misses a flow, the agent adds or corrects a rule or dependency model. When a scan reports a safe flow, the agent adds a sanitizer. These changes remain in the project, so every later scan uses them. The agent learns a behavior once, and OpenTaint checks it continuously.
The demo below shows this workflow — an agent runs OpenTaint, follows the reported flows, and triages the results.
Reusable rules and models help only if the engine can apply them deeply without making scans too slow or noisy. Every static-analysis engine must balance three goals:
- Accuracy — find real vulnerabilities and avoid false negatives.
- Precision — report real issues and avoid false positives.
- Performance — finish with reasonable time and memory on large codebases.
Improving one goal by simplifying the analysis often weakens another. For example, merging all fields of an object can make analysis faster, but it may report safe fields or lose a dangerous flow.
OpenTaint propagates taint to a fixpoint instead of stopping at a fixed depth, avoiding false negatives caused by arbitrary cutoffs. It tracks fields separately, resolves aliases and pointers, and keeps calling contexts separate. These distinctions improve accuracy and precision by letting the engine follow real flows without merging unrelated ones. Extended IFDS, abductive inference, and compact taint representations control the time and memory required for that analysis.
Today, this analysis supports Java and Kotlin, with deep modeling for Spring applications.
The engine, CLI, rules, and CI integrations are available under Apache 2.0 and MIT licenses.
Python and Go are next on the roadmap.
The broader language roadmap also includes C#, JavaScript, and TypeScript.
Run a scan without installing anything:
npx @seqra/opentaint scanRead the quick-start guide, or install the agent skills for an end-to-end application-security review.
To report false positives or missed flows, improve rules, submit dependency models, or help extend the engine, open an issue or join us on Discord.
