Single-file static analysis is broken by design in modern service architectures. If your scanner evaluates code line by line within isolated files, it is completely blind to how enterprise applications actually run. User input enters through a public controller, gets transformed across multiple data transfer objects, traverses service boundaries, and eventually executes inside an unescaped database call three packages away. To a shallow linter, every individual file looks clean. To an attacker, the execution path is an open door.
To tackle this exact visibility gap, Indian fintech engineering giant PhonePe open-sourced Nika, a dedicated static application security testing (SAST) tool engineered specifically for Java microservices.
Nika focuses squarely on interprocedural, cross-file taint analysis. Instead of generating noisy, context-free warnings, it models the entire data flow path to prove whether untrusted inputs can physically reach critical execution sinks.
Why Single-File Scanners Fail Modern Codebases
The fundamental vulnerability pattern in backend engineering is not bad syntax; it is unvalidated state propagation.
Consider an attacker-controlled parameter entering an application:
[ HTTP Request ]
│
▼
[ Controller Layer ] ──> (Untrusted Source)
│
▼
[ DTO / Serialization ]
│
▼
[ Domain Service ] ──> (Business Logic & Transformations)
│
▼
[ Persistence / Sink ] ──> (SQL, File System, Network Execution)
If an analyzer treats each file as an isolated unit:
- It inspects the Controller and finds no direct dangerous operations.
- It inspects the Service Layer and sees clean business logic.
- It inspects the Data Access Layer and sees a dynamic query, but cannot verify whether the parameter originates from a trusted internal state or external input.
The result is either an explosion of false positives (forcing engineers to ignore the tool) or catastrophic false negatives (silent omissions). Nika addresses this by building an interprocedural control-flow and data-flow model across the entire repository before issuing a single alert.
The Nika Engine Pipeline
Nika executes an end-to-end static analysis pipeline structured to separate structural parsing from semantic data tracking.
┌─────────────────────────────────────────────────────────┐
│ Target Repository │
└────────────────────────────┬────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────┐
│ Code Structure, Control Flow & Data Flow Model │
└────────────────────────────┬────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────┐
│ Source & Sink Identification │
│ (Track inputs, OpenGrep sinks, validation chains) │
└────────────────────────────┬────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────┐
│ Cross-File Taint Propagation │
│ (Interprocedural path validation) │
└────────────────────────────┬────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────┐
│ Optional LLM False-Positive Triage │
│ (Configurable token, iteration & call limits) │
└────────────────────────────┬────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────┐
│ HTML / JSON Reports │
└─────────────────────────────────────────────────────────┘
1. Ingestion and Structural Modeling
Nika consumes the codebase and constructs an internal representation capturing:
- Code structure and class hierarchies.
- Control flow graphs (CFGs) representing possible execution branches.
- Data flow graphs mapping variable lifecycles across scopes.
2. Sources, Sinks, and Validation Chains
The engine matches nodes against predefined inputs and execution boundaries:
- Sources: Entry points where external, untrusted input enters the application.
- Sinks: Sensitive functions that perform operations vulnerable to exploitation.
- Call Sequence Tracking: Validation chains to verify whether security-critical call sequences were violated in sensitive paths.
3. Cross-File Taint Tracking
Nika maps connections between sources and sinks across class and file boundaries. A vulnerability is flagged only if an unauthenticated or untrusted input path successfully resolves to a critical sink without satisfying required validation sequences.
Attack Surface Coverage
Nika targets eleven distinct classes of cross-file vulnerabilities common in enterprise Java:
| Vulnerability Category | Risk Mechanism Analyzed by Nika |
|---|---|
| SQL Injection | Tainted strings propagating into dynamic database queries. |
| SSRF | Attacker-governed parameters reaching outbound network requests. |
| Path Traversal | Unsanitized file paths reaching direct file system operations. |
| Command Injection | Untrusted inputs passed to underlying host process executions. |
| Code Injection | Execution of dynamic code payloads through untrusted sources. |
| Template Injection | Input values resolving directly into server-side template engines. |
| Deserialization Flaws | Object streams accepting unvalidated incoming data. |
| XXE (XML External Entity) | XML parsers processing untrusted payloads with external entity resolution. |
| Cryptographic Failures | Misconfigured or broken cryptographic implementations. |
| Unsafe Reflection | Arbitrary class or method instantiation via variable inputs. |
| Call Sequence Violations | Bypasses in mandatory security check sequences. |
Teams can extend this detection profile directly by introducing custom sources, custom OpenGrep sinks, and modular vulnerability plugins. It also natively supports branch-aware scanning, allowing it to hook cleanly into pull-request and code-review pipelines.
Slashing Noise: The Optional AI Triage Pass
The persistent failure mode of static analysis is alert fatigue. Even high-precision taint trackers can flag paths that are technically reachable in the graph but practically benign due to surrounding domain constraints.
Nika introduces an optional AI review pass to address this bottleneck.
Static Taint Engine (Flags Raw Paths)
│
▼
[ Optional LLM Triage Layer ]
│
┌────────┴────────┐
▼ ▼
[Drop Noise] [True Finding]
│
▼
HTML / JSON Report
How the AI Pass Operates
- Disabled by Default: The core static analyzer runs entirely standalone without any external dependencies.
- Targeted Second Pass: When enabled, raw findings from the deterministic taint engine are piped to a Large Language Model (LLM).
- Granular Resource Controls: The configuration interface provides explicit knobs to manage operational overhead:
- Token cost ceilings.
- Iteration count limits.
- Maximum call count limits.
This hybrid model ensures that static analysis handles the heavy structural lifting, while the LLM acts strictly as a secondary triage filter to drop false positives before findings hit developer dashboards.
Empirical Benchmarking
To prove detection accuracy, the Nika team benchmarked the platform against the standardized OWASP Java Benchmark suite.
Project maintainer Praveen Kanniah outlined the evaluation criteria:
"We used the OWASP Java Benchmark project to benchmark our tool. That codebase has intentionally vulnerable files, measured against parameters like True Positives, False Positives, Recall (total true positives identified out of what exists in the code), etc."
By evaluating the tool against seeded test cases, the team quantified:
- True Positives: Real vulnerabilities accurately traced from source to sink.
- False Positives: Non-exploitable paths incorrectly marked as critical.
- Recall: The absolute proportion of total seeded security flaws discovered by the engine.
Deployment and Ecosystem Status
Nika is packaged for rapid adoption into existing CI/CD environments:
- Runtime Options: Available as a standalone Docker image or as a local source build.
- Output Formats: Exports structured findings to JSON (for programmatic pipeline gates) and HTML (for human audit workflows).
- Language Support: Java is currently the only supported language, with multi-language capabilities planned on the public roadmap.
If you are running complex, multi-layered Java microservices, you can review the documentation and pull the open-source repository directly from GitHub to audit your cross-file attack surfaces.