https://opentaint.org/blog/sast-is-dead/

A data-flow-based, lightweight formal verification engine for application security. Basically, it's SAST++:

1. Deep enough that you really have some formal guarantees about the codebase (like zero findings actually means something, not just that the tool is broken).

2. Fast enough that you can shift the formal verification phase left and apply it to every feature during development (for example, during agentic development sessions to get fixes done within the same feature context).

3. Expressive and customisable enough that you can write specs for most vulnerability types from the OWASP Top 10 (even Broken Access Control and business logic flaws). Skills for writing specs included.

Here is the repo: https://github.com/seqra/opentaint/