wtf is taintflow?

TaintFlow is a security scanner that looks for common vulnerability patterns in Python and Java source code. It combines a Rust based analysis engine with a machine learning model to decide how likely a finding is to be a real problem rather than a false alarm. The core engine parses source code into a syntax tree, builds a control flow graph, and traces how data moves from risky entry points, such as user input, through the program to sensitive operations, such as a database query or a shell command. This kind of tracing is called taint analysis. The tool looks specifically for seven categories of vulnerability defined by the industry standard CWE list: SQL injection, operating system command injection, path traversal, server side request forgery, unsafe deserialization, hardcoded credentials, and weak cryptographic algorithms. On top of the pattern matching, a LightGBM machine learning model, trained on thousands of before and after code patches, scores each finding by comparing features of the code before and after a fix would be applied, and the trained model can be exported to the ONNX format so it can run in different environments. You can install it locally by building the Rust engine with Cargo and installing a handful of Python packages for the machine learning part, or you can run it as a ready made container image pulled from Docker Hub or GitHub's container registry. Once installed, you scan a single file or an entire folder from the command line, and results can be printed as plain text, exported as JSON, or turned into an HTML report. Each finding includes a CWE code, a severity level, a confidence score, the file and line number, a description of the tainted data flow, and a suggested fix. There is also a companion VS Code extension that runs the same scanner inside the editor, underlining risky code directly in red or yellow depending on severity, linking each CWE code to its official definition, and offering an optional automatic scan whenever a file is saved. The README reports benchmark results on cross validated and external test data, and the project is released under the MIT license.