TraceTaint

TraceTaint is a web app + lightweight agent that gives application teams runtime taint tracking in staging (and optionally production) to catch real exploit paths that static scanners miss. It instruments popular runtimes (Node.js, JVM) to trace untrusted data from entry points (HTTP, queues) through code to dangerous sinks (SQL, OS commands, templating, SSRF, deserialization). Instead of dumping thousands of findings, it produces a small set of replayable traces: request payload, call chain, sink reached, and the exact sanitization (or lack of it) that occurred. It integrates with CI to gate releases based on “confirmed exploitable paths,” and with Jira/GitHub to open issues that include a minimal reproduction. This is not a silver bullet: it won’t cover every language, and it adds overhead. But it’s a practical way to turn “maybe vulnerable” into “provably exploitable” for the apps you actually run.