Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,7 @@ Included skills cover the common security-analysis loop:

- **Scan and triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Coverage expansion:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Dataflow modeling:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Dataflow modeling:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ opentaint summary --show-findings --verbose-flow --show-code-snippets results.sa
| `opentaint summary` | View SARIF results |
| `opentaint health` | Show resolved analyzer, autobuilder, rules, and runtime paths |
| `opentaint test rule` | Scaffold, test, and debug detection rules |
| `opentaint test approximation` | Scaffold and test dataflow approximations |
| `opentaint test model` | Scaffold and test dataflow models |
| `opentaint pull` | Download dependencies |
| `opentaint update` | Update to latest version |
| `opentaint prune` | Remove stale artifacts and cached models |
Expand Down
2 changes: 1 addition & 1 deletion docs/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Java and Kotlin today. The engine works on bytecode, which gives it precise reso

**Why is OpenTaint the most thorough taint analyzer for Spring apps?**

It does inter-procedural data-flow analysis, following tainted data across method boundaries and through async constructs — Reactor, Spring WebFlux, and Kotlin coroutines are all modeled via data-flow approximations. Out of the box, it also models JPA persistence layers, so it catches stored injections where untrusted input arrives at one endpoint, gets saved to the database, and reappears in a completely different request later. Most engines treat the persistence layer as an opaque boundary; OpenTaint models it as part of the flow, linking writes in one request to reads in another.
It does inter-procedural data-flow analysis, following tainted data across method boundaries and through async constructs — Reactor, Spring WebFlux, and Kotlin coroutines are all modeled via data-flow models. Out of the box, it also models JPA persistence layers, so it catches stored injections where untrusted input arrives at one endpoint, gets saved to the database, and reappears in a completely different request later. Most engines treat the persistence layer as an opaque boundary; OpenTaint models it as part of the flow, linking writes in one request to reads in another.

**How does OpenTaint compare to Semgrep?**

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.ar.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **الفحص والفرز:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **توسيع التغطية:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **نمذجة تدفق البيانات:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **نمذجة تدفق البيانات:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.bn.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **স্ক্যান ও ট্রায়াজ:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **কভারেজ সম্প্রসারণ:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **ডেটাফ্লো মডেলিং:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **ডেটাফ্লো মডেলিং:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.br.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ As skills incluídas cobrem o ciclo comum de análise de segurança:

- **Varredura e triagem:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Expansão de cobertura:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Modelagem de fluxo de dados:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Modelagem de fluxo de dados:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.bs.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Uključene vještine pokrivaju uobičajenu petlju sigurnosne analize:

- **Skeniranje i trijaža:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Proširenje pokrivenosti:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Modeliranje toka podataka:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Modeliranje toka podataka:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.da.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ De inkluderede skills dækker den almindelige sikkerhedsanalyse-løkke:

- **Scan og triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Udvidelse af dækning:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Dataflow-modellering:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Dataflow-modellering:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.de.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Die enthaltenen Skills decken den gangigen Sicherheitsanalyse-Zyklus ab:

- **Scannen und Triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Erweiterung der Abdeckung:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Datenfluss-Modellierung:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Datenfluss-Modellierung:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.es.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Las habilidades incluidas cubren el ciclo habitual de analisis de seguridad:

- **Escaneo y triaje:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Ampliacion de cobertura:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Modelado de flujo de datos:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Modelado de flujo de datos:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.fr.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Les skills inclus couvrent le cycle habituel d'analyse de sécurité :

- **Analyse et triage :** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Extension de la couverture :** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Modélisation des flux de données :** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Modélisation des flux de données :** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.gr.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **Σάρωση και διαλογή:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Επέκταση κάλυψης:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Μοντελοποίηση ροής δεδομένων:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Μοντελοποίηση ροής δεδομένων:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.hi.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **स्कैन और triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **कवरेज विस्तार:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **डेटा फ़्लो मॉडलिंग:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **डेटा फ़्लो मॉडलिंग:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.id.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Keterampilan yang disertakan mencakup siklus analisis keamanan umum:

- **Pemindaian dan triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Perluasan cakupan:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Pemodelan aliran data:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Pemodelan aliran data:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.it.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Le skill incluse coprono il ciclo comune di analisi della sicurezza:

- **Scansione e triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Espansione della copertura:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Modellazione del dataflow:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Modellazione del dataflow:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.ja.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **スキャンとトリアージ:** `build-project`、`run-scan`、`analyze-findings`、`generate-poc`
- **カバレッジ拡張:** `triage-dependencies`、`discover-attack-surface`、`create-test-project`、`create-rule`、`assemble-lib-rules`
- **データフローモデリング:** `analyze-external-methods`、`create-pass-through-approximation`、`create-dataflow-approximation`、`debug-rule`、`report-analyzer-issue`
- **データフローモデリング:** `analyze-external-methods`、`create-pass-through-model`、`create-dataflow-model`、`debug-rule`、`report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.ko.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **스캔 및 분류:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **커버리지 확장:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **데이터플로우 모델링:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **데이터플로우 모델링:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.no.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ De inkluderte ferdighetene dekker den vanlige sikkerhetsanalysesyklusen:

- **Skanning og triagering:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Utvidet dekning:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Dataflytmodellering:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Dataflytmodellering:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.pl.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Dołączone umiejętności obejmują typowy cykl analizy bezpieczeństwa:

- **Skanowanie i selekcja:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Rozszerzanie pokrycia:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Modelowanie przepływu danych:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Modelowanie przepływu danych:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.ru.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **Сканирование и триаж:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Расширение покрытия:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Моделирование потоков данных:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Моделирование потоков данных:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.sv.md
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ Inkluderade färdigheter täcker den vanliga säkerhetsanalysloopen:

- **Skanning och triage:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Utökad täckning:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Dataflödesmodellering:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Dataflödesmodellering:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.th.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **สแกนและคัดแยก:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **ขยายการครอบคลุม:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **การสร้างแบบจำลอง dataflow:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **การสร้างแบบจำลอง dataflow:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.tr.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **Tarama ve önceliklendirme:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Kapsam genişletme:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Veri akışı modelleme:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Veri akışı modelleme:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.ua.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **Сканування та тріаж:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Розширення покриття:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Моделювання потоків даних:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Моделювання потоків даних:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.vi.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ Các kỹ năng đi kèm bao phủ vòng lặp phân tích bảo mật thông d

- **Quét và phân loại:** `build-project`, `run-scan`, `analyze-findings`, `generate-poc`
- **Mở rộng phạm vi bao phủ:** `triage-dependencies`, `discover-attack-surface`, `create-test-project`, `create-rule`, `assemble-lib-rules`
- **Mô hình hóa luồng dữ liệu:** `analyze-external-methods`, `create-pass-through-approximation`, `create-dataflow-approximation`, `debug-rule`, `report-analyzer-issue`
- **Mô hình hóa luồng dữ liệu:** `analyze-external-methods`, `create-pass-through-model`, `create-dataflow-model`, `debug-rule`, `report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.zh.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **扫描与分诊:** `build-project`、`run-scan`、`analyze-findings`、`generate-poc`
- **覆盖范围扩展:** `triage-dependencies`、`discover-attack-surface`、`create-test-project`、`create-rule`、`assemble-lib-rules`
- **数据流建模:** `analyze-external-methods`、`create-pass-through-approximation`、`create-dataflow-approximation`、`debug-rule`、`report-analyzer-issue`
- **数据流建模:** `analyze-external-methods`、`create-pass-through-model`、`create-dataflow-model`、`debug-rule`、`report-analyzer-issue`

---

Expand Down
2 changes: 1 addition & 1 deletion docs/translations/README.zht.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ npx skills add https://github.com/seqra/opentaint

- **掃描與分級:** `build-project`、`run-scan`、`analyze-findings`、`generate-poc`
- **覆蓋範圍擴展:** `triage-dependencies`、`discover-attack-surface`、`create-test-project`、`create-rule`、`assemble-lib-rules`
- **資料流建模:** `analyze-external-methods`、`create-pass-through-approximation`、`create-dataflow-approximation`、`debug-rule`、`report-analyzer-issue`
- **資料流建模:** `analyze-external-methods`、`create-pass-through-model`、`create-dataflow-model`、`debug-rule`、`report-analyzer-issue`

---

Expand Down
Loading
Loading