Awesome GitHub RepositoriesTaint Analysis Engines

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

Semgrep is a static analysis security testing tool designed to identify vulnerabilities and logic errors by matching source code against declarative patterns. It functions as an automated scanner that integrates into development workflows to detect insecure code patterns and enforce coding standards before deployment. The engine utilizes a language-agnostic intermediate representation and a modular parser architecture to normalize diverse programming languages into a unified format. This allows for consistent rule execution across different codebases, enabling users to perform custom structur

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph

Pyre is a high-performance static type checker and analysis tool for Python. It identifies type errors and ensures type safety without executing the program, utilizing a static type inference engine to maintain consistency across functions. The project is distinguished by an incremental type analysis engine that operates as a background daemon. This system monitors filesystem changes to re-validate only modified parts of a project, reducing the time required for repeated analysis. It also includes a static analysis security tool that uses taint analysis to track untrusted data flows and ident

re-frame este un framework funcțional pentru construirea de aplicații single-page în ClojureScript. Acesta oferă o bază de date centralizată și imutabilă care servește drept unică sursă de adevăr pentru întreaga stare a aplicației, impunând un flux de date unidirecțional strict, unde evenimentele declanșează tranziții de stare și actualizări ulterioare ale vizualizărilor. Framework-ul se distinge printr-un graf de semnale reactive și un pipeline de middleware bazat pe interceptoare. Tratând logica aplicației ca pe o secvență de evenimente bazate pe date și efecte secundare declarative, acesta decuplează logica de business de stratul de vizualizare. Această arhitectură permite dezvoltatorilor să gestioneze tranziții complexe de stare și operațiuni externe prin funcții pure, asigurându-se că efectele secundare sunt executate de un interpretor separat, nu prin apeluri imperative. Sistemul include o suită cuprinzătoare de capabilități pentru gestionarea arhitecturii aplicației, inclusiv derivarea reactivă a datelor, reconcilierea vizualizărilor bazată pe abonamente și gestionarea stării bazată pe evenimente. Suportă fluxuri de lucru avansate, cum ar fi trasarea evenimentelor, checkpoint-uri de stare și capacitatea de a simula (stub) efecte secundare pentru testare izolată. Proiectul este conceput pentru integrarea cu React, utilizând reconcilierea virtual DOM pentru a actualiza eficient interfețele utilizator. Oferă un set robust de utilitare pentru gestionarea problemelor transversale, gestionarea grafurilor complexe de flux de date și coordonarea operațiunilor asincrone într-un pipeline de evenimente secvențial și predictibil.

This project is a comprehensive Android reverse engineering suite that functions as a decompiler, bytecode deobfuscator, and malware analysis tool. It is designed to convert APK, DEX, and OAT binaries into human-readable source code using a native implementation that does not require a Java Virtual Machine. The platform is distinguished by its integration with Frida for dynamic analysis, allowing users to hook methods, inject custom JavaScript, and dump device memory in real time. It also features specialized security engines, including a taint propagation engine and a stack-state machine, to

Triton is a dynamic binary analysis framework designed to automate reverse engineering. It functions as a multi-architecture CPU emulator, an SMT-based symbolic execution engine, and a dynamic taint analysis tool. The framework translates raw machine instructions into abstract syntax trees, allowing it to represent binary program logic as a structured intermediate representation. This allows the system to map multiple hardware instruction sets to a single analysis framework and translate machine instructions into mathematical formulas for solving constraints. Its capabilities cover the simul

actionlint is a static analysis tool and linter specifically designed for GitHub Actions workflow files. It functions as a CI workflow validator and YAML configuration linter to ensure the syntax and logic of automation files are correct before deployment. The project distinguishes itself by performing deep security auditing and script analysis. It includes a shell script auditor to detect syntax bugs and script injection vulnerabilities in inline commands, and it scans for hardcoded credentials to prevent security leaks. The tool covers a broad range of validation capabilities, including ex

Bearer is a static analysis security testing tool and privacy compliance auditor. It identifies security vulnerabilities, hard-coded secrets, and privacy risks in source code through static analysis and data flow tracing. The tool distinguishes itself by tracking the movement of sensitive data through code to identify leaks and by mapping personal and health-related information flows to generate evidence for privacy impact assessments. It also provides differential scanning for pull requests and uses fingerprint-based suppression to exclude known false positives from reports. The platform co

Phasar is a static analysis framework designed for the inspection of software logic through the processing of compiler intermediate representations. It provides a modular pipeline for building program representations, including call graphs, control flow graphs, and type hierarchies, which serve as the foundation for deep structural analysis of software behavior. The framework specializes in interprocedural data flow analysis and pointer alias resolution, enabling the tracking of information movement across function boundaries and the identification of indirect memory access patterns. By lever

Tiramisu is a polyhedral C++ compiler framework designed to express and optimize data-parallel algorithms for diverse hardware accelerators. It provides a programming interface that allows developers to define mathematical expressions, manage loop iteration spaces, and organize functions targeting heterogeneous architectures. The system features an advanced compilation infrastructure that abstracts computations into a hardware-agnostic intermediate representation before lowering them into native machine code or hardware configuration bitstreams. It calculates exact data flow dependencies thro