This talk was recorded at NDC Manchester in Manchester, England. 
#ndcmanchester #ndcconferences #developer #softwaredeveloper    

Attend the next NDC conference near you: 
https://ndcconferences.com
https://ndcmanchester.com/

Subscribe to our YouTube channel and learn every day:   
/            @NDC 

Follow our Social Media!

https://www.facebook.com/ndcconferences
https://twitter.com/NDC_Conferences
https://www.instagram.com/ndc_conferences/

#applicationsecurity #programming #security #genai 

As software systems become increasingly interconnected, protecting data confidentiality and integrity is more critical than ever. When traditional access control mechanisms fall short, we must turn to deeper, language-level solutions.

This talk introduces language-based security: leveraging programming languages and their type systems to enforce security policies at compile time. We’ll focus on taint analysis, a technique for tracking the flow of potentially harmful (or "tainted") data. In particular, we'll see how we can apply it statically to detect and prevent security vulnerabilities before they reach Production. Through practical examples in Java and Scala, we'll see how to model data sensitivity, propagate taint status and catch violations at compile time.

As more code is written or suggested by GenAI, the risk of subtle security flaws increases, making compiler-enforced security guarantees more valuable than ever.

By the end of the talk, you will see how language-based techniques can reduce reliance on dynamic checks and support building secure systems by construction.

NDC Conferences

Taint analysis tracks data flows from untrusted sources to security-sensitive contexts to prevent vulnerabilities. This talk demonstrates using Scala's type system to encode security properties at compile time, creating labeled boxes (tainted, pure, sanitized) that wrap values and enforce sanitization rules. The compiler blocks compilation when unsanitized values reach dangerous sinks, preventing vulnerabilities like HTML injection. This language-based security approach offers a middle ground between static and dynamic analysis, catching issues during development without runtime overhead. The technique is language-dependent—Scala's advanced type system enables compile-time enforcement, while Java requires runtime checks or annotations.

Trust No Input: Taint Analysis at Compile Time - Matteo Di Pirro - NDC Manchester 2025