HXSecurity/DongTai
Dongtai IAST is an open-source Interactive Application Security Testing (IAST) tool that enables real-time detection of common vulnerabilities in Java applications and third-party components through passive instrumentation. It is particularly suitable for use in the testing phase of the development pipeline. observed · 2026-08-28
Health v2 · maintenance only
33/100
- Activity 22
- Release rhythm 8
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-02. Adoption (stars, forks) is never an input.
- gap_med: n/a
- age_days: 1990
- days_rel: n/a
- days_push: 468
- n_releases_24m: 0
Adoption not part of the score
1312 stars · 154 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
DongTai IAST is an open-source Interactive Application Security Testing platform that detects vulnerabilities in Java (and some Python) applications in real time via passive instrumentation agents and taint-tracking analysis. It consists of a Django-based server, web UI, analysis engine, and Java/Python agents, deployable via Docker or Kubernetes and suited to the testing phase of a DevSecOps pipeline.
Use cases
- detect vulnerabilities in java applications during testing
- find vulnerable third-party dependencies and components
- integrate security testing into ci/cd devsecops pipeline
- self-host an interactive application security testing tool
- trace detected vulnerabilities back to source code lines
- detect hardcoded secrets and sensitive information leaks
- test api endpoints for security flaws automatically
When to choose
- you need runtime, low-false-positive vulnerability detection for Java web applications
- you want an open-source IAST to embed in QA or DevSecOps workflows
- you need software composition analysis alongside application vulnerability detection
- you prefer self-hosted deployment with Docker or Kubernetes
When to avoid
- you need static analysis of code without running it (use a SAST tool)
- your applications are primarily in languages other than Java or Python
- you only need simple dependency CVE scanning without runtime instrumentation
- you cannot modify the runtime environment to attach an agent
Facets
service · maturity active
security vulnerability-scanning monitoring self-hosted api-framework security testing developer-tools python self-hosted jvm iast dast sast taint-tracking devsecops java-agent software-composition-analysis vulnerability-detection devops docker kubernetes web-server
8 sources
- readme: https://github.com/HXSecurity/DongTai · fetched 2026-08-28 · 43a044fe5580
- homepage: https://dongtai.io · fetched 2026-08-29 · 3740a1fb8b75
- site_page: https://doc.dongtai.io/docs/changelog/release-note · fetched 2026-08-29 · ae058d27029b
- site_page: https://dongtai.io/about · fetched 2026-08-29 · 5121c90065fd
- site_page: https://doc.dongtai.io/docs/getting-started/start-project · fetched 2026-08-29 · 6ddca896ae14
- site_page: https://doc.dongtai.io/docs/operation/application-management · fetched 2026-08-29 · 4475465a1fb1
- site_page: https://doc.dongtai.io/docs/category/%E5%B8%B8%E8%A7%81%E9%97%AE%E9%A2%98 · fetched 2026-08-29 · 5178177889ee
- site_page: https://doc.dongtai.io · fetched 2026-08-29 · a62d7fa8705b
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| HXSecurity/DongTai | main | 33 |
For agents
markdown · JSON · MCP: product_card(name="HXSecurity/DongTai")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem