Trust No Input - Taint Analysis at Compile Time

Explore language-based security through this 52-minute conference talk that demonstrates how to leverage programming languages and type systems to enforce security policies at compile time. Learn about taint analysis, a powerful technique for tracking the flow of potentially harmful or "tainted" data through software systems to detect and prevent security vulnerabilities before they reach production. Discover how to model data sensitivity, propagate taint status, and catch security violations at compile time through practical examples in Java and Scala. Understand why compiler-enforced security guarantees are becoming increasingly valuable as more code is written or suggested by GenAI, which introduces risks of subtle security flaws. Gain insights into how language-based techniques can reduce reliance on dynamic checks and support building secure systems by construction, moving beyond traditional access control mechanisms when they fall short in increasingly interconnected software systems.