Analysis & detection

What is Taint / Data-Flow Analysis?

Tracing untrusted input from where it enters the program (source) to where it could do damage (sink).

Taint analysis is what separates a serious SAST engine from a pattern matcher. It follows a value across assignments, function calls and files, asking whether attacker-controlled data can reach a dangerous operation without being sanitised along the way.

The payoff is precision: a hardcoded string passed to a SQL query is not a vulnerability, and taint analysis knows the difference. It costs build time and needs per-framework modelling to know which functions count as sources and sinks.

Top 10 Taint / Data-Flow Analysis tools

Every tool in the directory documented as supporting Taint / Data-Flow Analysis, 8 fully, 2 partially, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

  1. 1
    AikidoCode Security PlatformPro

    Data flow analysis inside AI Deep Review; credit-metered, Pro plan and above

  2. 2
    Checkmarx OneCode Security Platform

    Attack Vector shows source-to-sink tainted data flow; Best Fix Location is chosen within that data-flow graph.

  3. 3
    CodeRabbitPR Reviewadd-on

    AI Deep Scan traces untrusted input to sensitive sinks with call stacks; separately billed

  4. 4
    CorgeaCode Security Platform

    Cross-file source-to-sink taint tab in BLAST Full View

  5. 5
    GitHub Advanced SecurityCode Security PlatformFree on public repos; add-on: Code Security for private

    CodeQL taint tracking; model packs add taint-flow models and threat models add taint sources, both public preview

  6. 6
    SemgrepCode Security Platform

    Taint tracking with constant/symbolic propagation; cross-file interfile taint requires Pro Engine and full scans only.

  7. 7
    SnykCode Security Platform

    Source-to-sink data flow analysis with AI-learned sources, sinks and sanitizers; data-flow visualization.

  8. 8
    SonarQubeQuality Platform

    Tracks data flow from untrusted sources to dangerous sinks; Advanced SAST sold separately.

  9. 9
    ChatGPT / CodexAgent Coding ToolPartialPro/business/enterprise/edu (not plus); research preview

    Cloud finding pages show call-path and data-flow context 'when available'; no taint engine.

  10. 10
    Claude CodeAgent Coding ToolPartialEnterprise

    Managed Claude Security "traces data flows across files" per vendor docs; beta, Enterprise plan only.

What to look for

  • Whether analysis crosses file and function boundaries, or stops at one function
  • Framework coverage for your stack, since modelling is per-framework work
  • Whether the tool shows the full source-to-sink path in the finding
  • Scan-time impact on large repositories

Related terms

SASTSecrets DetectionSecrets ValidationSCA (Software Composition Analysis)Reachability AnalysisMalicious Package Detection

FAQ

What is Taint / Data-Flow Analysis?

Tracing untrusted input from where it enters the program (source) to where it could do damage (sink).

How many tools support Taint / Data-Flow Analysis?

10 of the 20 tools tracked in this directory support Taint / Data-Flow Analysis, 8 fully and 2 partially, including Aikido, Checkmarx One, CodeRabbit, Corgea, GitHub Advanced Security. Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you look for in Taint / Data-Flow Analysis?

Whether analysis crosses file and function boundaries, or stops at one function. Framework coverage for your stack, since modelling is per-framework work. Whether the tool shows the full source-to-sink path in the finding. Scan-time impact on large repositories.