We Built the Only Java Static Analyzer That Finds What Semgrep, CodeQL, and the We Built the Only…

We Built the Only Java Static Analyzer That Finds What Semgrep, CodeQL, and the We Built the Only Java Static Analyzer That Finds What Semgrep, CodeQL, and the ICLR 2025 IRIS Paper All Miss

The problem nobody talks about

IDOR (Insecure Direct Object Reference) is the number one vulnerability class in OWASP Top 10 2025. It is responsible for some of the biggest data breaches of the last decade. Attackers simply change an ID in a URL and access another user's data. Simple. Devastating. Extremely common.

Every major Java security tool claims to protect you. We tested them.

We ran Semgrep's community Java ruleset on 8 real Spring Boot applications. It found zero IDOR vulnerabilities. We ran CodeQL. Zero again. We checked IRIS, the neurosymbolic static analysis tool published at ICLR 2025 that covers 49 CWEs. CWE-639, which is the official identifier for IDOR, is not one of them.

This is not a criticism of these tools. IDOR is structurally different from vulnerabilities like SQL injection. There is no dangerous function to flag. The vulnerability is the absence of an ownership check, and absence is extremely hard to detect statically. That is why every tool skips it.

So we built something specifically designed for it.

What we built

Chanakya is a static taint analysis engine for Java. The core technique is what we call dominance-based guard binding.

Most SAST tools ask one question: does user input reach a database call? Chanakya asks a harder question: is there a guard that dominates this specific database access AND binds to the same identifier the user controls?

The difference matters enormously in practice. Consider this Spring Boot endpoint:

@GetMapping("/orders/{id}")

public Order getOrder(@PathVariable Long id) {

return orderRepository.findById(id);

}

A role check somewhere else in the class does not protect this endpoint. A URL level permitAll rule means there is no authentication boundary at all. Chanakya's dominance analysis determines whether a guard actually controls this specific data access, not just whether guards exist somewhere in the codebase.

This is why we find real vulnerabilities that pattern matching tools miss entirely.

The numbers

On our labeled real world corpus of 59 cases across 8 production Java applications:

Precision: 0.719 Recall: 0.885 F1: 0.79

For SQL injection, on OWASP BenchmarkJava, the industry standard benchmark with 272 real vulnerable cases:

88.60% recall with zero false positives on 232 safe cases. Every finding we report is genuine. Scan time is under 5 seconds per repository.

What we found on real code

Running Chanakya on real Java applications:

shopizer, a production ecommerce platform with 30,000 GitHub stars: 7 access control findings in 2.6 seconds.

WebGoat, OWASP's official vulnerable application: 4 findings in 3.2 seconds.

JavaSecLab: 34 SQL injection findings in 2.6 seconds.

VulnerableApp: 11 SQL injection findings in 3.5 seconds.

Every finding was verified manually by reading the actual source code. When Chanakya reports a vulnerability, it is real.

Privacy first

Unlike LLM-based security tools that send your code to external APIs, Chanakya runs entirely on your machine. No code leaves your environment. Full analysis in seconds with zero external dependencies. For organizations with strict data policies, this is not a nice-to-have. It is a requirement.

Framework support

Chanakya works on Spring Boot with Spring Data JPA and Spring Security, Quarkus with Panache active record and JAX-RS, Jakarta EE applications including Helidon and Dropwizard, and applications using LLM libraries including LangChain4j and Spring AI where it detects prompt injection, insecure output handling, and PII exposure.

A gap in the research

When we searched for a Java IDOR benchmark to measure against, we found none. CWE-Bench-Java, published at ICLR 2025 and the most cited Java security benchmark, covers 49 CWEs. None of them are CWE-639.

We proposed contributing our 59 labeled cases to fill that gap. The maintainers accepted. This will be the first public Java IDOR ground truth dataset.

Why we named it Chanakya

Chanakya was an ancient Indian strategist and economist whose Arthashastra documented systematic intelligence gathering, risk analysis, and statecraft. The parallel to modern application security felt right. Security is not about reacting to threats. It is about systematic observation of your own systems before an adversary does it for you.

Try it free

We are offering free security scans to Java engineering teams. If you use Spring Boot or Quarkus, we will find what your current tools are missing, in under 5 seconds, with nothing leaving your machine.

Reply to this post or email us at sumanlamichhane45@gmail.com or sujanaacharya17@gmail.com

We are also happy to discuss the technical details of dominance-based guard binding with anyone interested in static analysis research.