Seqra. Formal methods advocate. Engineering @opentaint — the open-source taint analysis engine for the AI era.
Joined November 2025
- Tweets66
- Following86
- Followers21
- Likes112
Fun fact: you could start thinking about formally verifying that your application has no security issues of certain kinds, and eventually you'll end up doing a kind of formal data-flow analysis for that.
Good to know that we've already started doing it in OpenTaint for you!
I used Opus 5.5 to formally verify the Claude Agent SDK using Lean. A couple short prompts = 16 PRs fixing various bugs and race conditions. Video attached.
TLA+ also works well. I sometimes combine Lean and TLA+ to look for issues around data flow, concurrency, and state mgmt.
I don't know either language well, but Claude is excellent at both. This approach is super useful for formally modeling your code and finding bugs that a human probably wouldn't have spotted.
Is formal verification the future of coding (or at least, bug finding)?
"At a high level, the main recent change is not the machinery for proving these properties; it is the ease with which a person can specify "what" they want to be proven and receive a certificate that a property is true. Understanding how that interface should work and how it can be used will be an extremely interesting challenge over the next year."
I really, really like this take.
Lean Verified Transformers (srush.github.io/lean-transfo…)
In which we prove a bunch of Transformer invariants from scratch in Lean, and speculate about how hard it would be to do that for the rest of the world's code.
From the beginning, @opentaint primary goal has been to have as few missed findings as possible while staying within practical time and memory budgets and keeping false alarms comparatively low.
Multi-language support is still our weakest side, but we're working on it. Go support is in the alpha stage and getting closer and closer to release. Python is next on our radar, but that one is tricky from a deep taint analysis point of view :)
OpenTaint (@opentaint) leads recall. JVM-only, but that may be exactly the scope you need. A good reminder that language breadth and finding real flows are separate strengths.
There's a serious lack of public, independent benchmarks for taint analysis, so I was glad to hear @SDBakerEffendi is working on this. Thank you, David!
Which taint analyzer would you trust to check you code?
We tested eight across 852 frozen cases in 13 languages. Nobody swept the board: speed, precision, recall, and coverage pull in different directions.
Here.s the breakdown:
blog.brokk.ai/the-taint-anal…
Going forward, I'm gonna post more personal things here.
OpenTaint news lives at @opentaint from now on.
Ngl, "in seconds" is wishful thinking — but we're doing our best!
$20,000 spent across 1,000 security reviews.
One found something.
All expired.
That's what it costs when every review starts from scratch. The reviewer learns your trust boundaries, finds the vulnerability patterns, writes the report. Next sprint, new code ships. Different reviewer. Learns everything again. Finds the same categories of bugs. Maybe misses the ones the last reviewer caught.
Meanwhile, 44% of AI-generated code contains known security flaws. Vulnerability exploitation just became the #1 breach entry point for the first time in 19 years. And LLM-only security reviews reproduce only 14% of their findings across five runs on the same code.
The tools exist. The security knowledge doesn't stick.
OpenTaint just changed that math.
It's an open source taint analysis engine that turns one-off security reviews into unlimited reusable scans. The key: it combines the flexibility of model reasoning with the consistency of formal program analysis.
Here's the loop:
- Discover: An AI agent reviews your code. Learns trust boundaries and vulnerability patterns. Captures them as an informal specification in plain language.
- Enact: Converts that informal spec into formal taint rules and dependency models. Machine-readable. Deterministic. Repeatable.
- Scan: Runs formal program analysis across the ENTIRE project. Not just the files the agent looked at. Everything. In seconds.
- Triage: Confirms real findings. Tunes away false alarms. Every refinement improves the next scan.
Each cycle adds reusable knowledge. The first review costs $20. Every scan after that is essentially free. That's a 1,000x cost reduction on the same security coverage.
It already found CVE-2026-58138. A 182-step taint trace from an unauthenticated HTTP endpoint to remote code execution via GraalJS. Real vulnerability. Real CVE. Real production impact.
In head-to-head comparisons across five analysis depth levels (direct return, local dataflow, inter-procedural, field sensitivity, virtual dispatch), OpenTaint detected vulnerabilities at every level. Semgrep's pattern matching missed four of five. Even the taint engines of Semgrep and CodeQL fell short on the two deepest levels.
Supports Java, Kotlin, and Spring (deep framework support). Go in alpha. Python, C#, JavaScript, and TypeScript on the roadmap.
Fully open source. Apache 2.0 engine. MIT CLI. No vendor lock-in.
Install in one line:
npm install -g @seqra/opentaint
@seqradev
We're sharing our deep dive into CVE-2026-58138, a critical unauthenticated RCE in Conductor with a CVSS score of 9.8, where a single POST request can lead to arbitrary OS command execution on the server.
The post walks through how the vulnerability reaches GraalJS and GraalPy evaluators, how we reproduced it across multiple workflow task types, and how OpenTaint traced the complete path from HTTP input to code execution.
If you run Conductor, upgrade to version 3.30.2 or later, and take a look at the full technical analysis: opentaint.org/blog/conductor…
The time has come.
Next time you get access to Mythos/Fable — you know what to do: opentaint.org/blog/appsec-ag…
Our appsec agent discovered CVE-2026-58138, confirmed it with a dataflow trace from OpenTaint, and wrote a PoC.
Full write-up coming soon!
Anyone doing appsec on Java/Kotlin backends?
We work on open-source alternative to Semgrep Pro and CodeQL. It is full inter-procedural taint analysis engine, built to be configured. It ships with skills that teach AI agents to tune it to your codebase.
We'd love your feedback!
Next time you get access to Mythos/Fable — you know what to do: opentaint.org/blog/appsec-ag…
We are testing our skills teaching @claudeai Opus 4.8 to work with the OpenTaint, and the results are promising.
Codebase scale — 840 files / 131K LOC / 279 entry-surface files / ~200 sink sites.
$122 for cold scan with dynamic testing. 6 vulnerabilities with PoCs.
50 ⭐️ Thank you! 🙏
github.com/seqra/opentaint
star-history.com/?repos=seqr…
#starhistory #GitHub #OpenSource via @StarHistoryHQ
🌱 Introducing an in-browser taint-flow viewer for OpenTaint — the most thorough taint analysis engine for Spring app security.
Live demo, built from our open-source Java + Kotlin Spring Boot demo app:
viewer.opentaint.org/
The demo surfaces 13 findings:
• XSS across Spring controllers
• Server-side template injection
• SSRF through Kotlin coroutines
Click any finding, walk the flow end-to-end from untrusted input to the dangerous method call, and read the rule that fired alongside the code.
Engine + CLI: github.com/seqra/opentaint
Viewer: github.com/seqra/opentaint-v…
The viewer can produce a self-contained, offline HTML report for your own project.
Open source. Stars, issues, and rule PRs welcome.