Skip to content
SPECIFICTION
Get listed

DongTai IAST

iast.io

Free plan WebLinuxAPISelf-hosted
Visit iast.io
Spec score 8.4 #4 of 14 in Interactive Application Security Testing Software

What it is

DongTai IAST is an open-source tool for finding vulnerabilities in running Java applications and their third-party components. It examines application traffic as it runs, using method-call data and taint tracking across HTTP, HTTPS, and RPC requests; it does not rely on dedicated attack tests. The project lists Java, Python, PHP, and Go for detection, though the Python, PHP, and Go agents are beta and community-maintained beta agents may not deploy successfully. DongTai can analyze runtime data flows, prioritize verified findings by risk, and provide vulnerability tracing and reports. Its server also offers project and user management, notifications, a Web API, and custom vulnerability rules. Deployment options include SaaS, localized installation, Docker Compose, and Kubernetes. An IntelliJ IDEA plugin can run the Java probe and detect vulnerabilities in the IDE. The open-source self-hosted plan costs nothing. The project lists web runtime support and an Apache-2.0 license.

Spec sheet

Product
DongTai IAST analyzes application runtime data flows to identify exploitable security vulnerabilities and provide developers with risk-prioritized verified findings.Read 4 Oct 2026 · docs.dongtai.io
Deployment
The project supports SaaS and localized deployment, with Docker Compose for standalone installation and Kubernetes for cluster deployment.Read 3 Oct 2026 · github.com
Support
The project directs users with questions to its GitHub Discussions forum.Read 3 Oct 2026 · github.com
License
The repository lists an Apache-2.0 license.Read 3 Oct 2026 · github.com
Agent status
The agent guide marks Python, PHP, and Go agents as beta and says community-maintained beta agents are not guaranteed to deploy successfully.Read 3 Oct 2026 · docs.dongtai.io
Analysis
The project describes its engine as analyzing HTTP, HTTPS, and RPC requests using method-call data and taint tracking.Read 3 Oct 2026 · github.com
API and DevSecOps
The product site says API support enables integration into DevSecOps workflows.Read 4 Oct 2026 · dongtai.io
Collection and reporting
Its agent monitors and collects web application traffic data, sends it to DongTai Server for analysis, and the server reports identified vulnerabilities with full reports available in the management server.Read 4 Oct 2026 · docs.dongtai.io
Commercial deployment requirements
The commercial deployment guide says the user running iastctl needs sudo privileges and notes incompatibility for versions below 1.13.0 unless upgraded manually.Read 4 Oct 2026 · doc.dongtai.io
Deployment options
DongTai offers SaaS service and localized deployment, with Docker and Kubernetes deployment options.Read 4 Oct 2026 · github.com
Detection features
The product site lists application vulnerability testing, open-source component vulnerability detection, sensitive information detection, and hardcoded information detection.Read 4 Oct 2026 · dongtai.io
Detection languages
The documentation lists Java, Python, PHP, and Go as supported detection languages.Read 3 Oct 2026 · docs.dongtai.io
Development use
The project describes use in development pipeline testing, open-source software vulnerability discovery, and security testing before release.Read 4 Oct 2026 · github.com
Finding analysis
The product site says it provides automated vulnerability verification and tracing, with detailed vulnerability analysis and location.Read 4 Oct 2026 · dongtai.io
IAST method
The documentation identifies DongTai as passive IAST, using application test traffic to analyze vulnerabilities without running dedicated attack tests.Read 3 Oct 2026 · docs.dongtai.io
IDE integration
The product site says DongTai supports installation of an IntelliJ IDEA plugin.Read 4 Oct 2026 · dongtai.io
Runtime services
The project says its base image includes MySQL and Redis services.Read 3 Oct 2026 · github.com
Security policy
The GitHub security policy lists versions 1.8.5 and later as supported for security updates.Read 4 Oct 2026 · github.com
Server capabilities
The server provides a user management interface, vulnerability analysis and reports, vulnerability notifications, Web API, project management, and custom vulnerability rules.Read 3 Oct 2026 · docs.dongtai.io
Support and community
The project README directs questions to DongTai Discussions and welcomes code contributions.Read 4 Oct 2026 · github.com
Supported languages
The documentation lists Java, Python, PHP, and Go as supported detection languages.Read 4 Oct 2026 · docs.dongtai.io
Use cases
The project lists DevSecOps vulnerability detection, open-source vulnerability research, and security testing before release as use cases.Read 3 Oct 2026 · github.com
Vulnerability workflow
The overview says DongTai analyzes runtime application data flows, prioritizes verified vulnerabilities by risk, and helps developers fix code in real time.Read 3 Oct 2026 · docs.dongtai.io

Plans and prices

Open-source self-hosted deployment Free Docker Compose single-node or Kubernetes cluster deployment Read 4 Oct 2026 · github.com

Every DongTai IAST plan and price →

Strong points and limits

Strong points

  • Free open-source self-hosted plan at free
  • Analyzes HTTP, HTTPS, and RPC traffic
  • Lists Java, Python, PHP, and Go detection
  • Offers Docker Compose and Kubernetes deployment
  • Provides reports, notifications, and a Web API

Limits

  • Python, PHP, and Go agents are beta
  • Community beta agents are not guaranteed to deploy successfully
  • Self-hosted iastctl requires sudo privileges

Who it suits

DongTai IAST suits developers and security teams looking for passive vulnerability detection in application test traffic, including teams using DevSecOps workflows. Its Java probe and IntelliJ IDEA plugin may suit Java developers; users of the beta Python, PHP, or Go agents should account for their stated deployment uncertainty.

Verdict

DongTai IAST specifies its passive analysis method, deployment choices, server features, and language coverage. The beta status of three agents is an important qualification for teams planning deployments beyond Java.

Where Specifiction places it

Alternatives to DongTai IASTAll alternatives →