Paralegal: A Privacy and Security Bug Finder for Rust Applications.

Paralegal is a static analyzer for Rust code that enforces privacy and security policies on programs.

For example, developers have used Paralegal to find problems such as:

• Failing to delete user data upon request
• Missing authorization checks before privileged actions
• Forgetting to encrypt sensitive data before storage

Paralegal's user guide and documentation is available at https://brownsys.github.io/paralegal, which includes a step-by-step walkthrough of an example application and policy.

See also our paper from OSDI 2025.

Example

Take the following policy for a social media application, which checks that the user is not banned or deleted before executing an action on their behalf (e.g., posting, commenting):

Scope:
Everywhere

Policy:
1. For each "action" marked write:
  A. There is a "deleted user check" marked delete_check where:
    a. "deleted user check" affects whether "action" happens
  and
  B. There is a "banned user check" marked ban_check where:
    a. "banned user check" affects whether "action" happens

Developers connect policies to application code by defining markers, which denote high-level concepts such as write, encrypts or user_data. Developers apply markers to types, function arguments, or function return values using lightweight annotations, e.g.:

#[paralegal::marker(ban_check, return)]
fn is_user_banned(user: &User) -> bool { ... }

impl Database {
  #[paralegal::marker(write, argument = [0])]
  fn insert_post(&mut self, user: &User, post: String) { ... }
}

Paralegal directly integrates with cargo and rustc, so running it is as easy as building your project (cargo paralegal-flow).

Performance

Paralegal is a fast cargo and rustc plugin that developers can run frequently (in CI for example) to find potential bugs as they develop their application.

Here is a performance breakdown plot of Paralegal running end-to-end on realistic web applications.

Installation and Usage

Install the latest release from source with:

curl -fsSL https://raw.githubusercontent.com/brownsys/paralegal/main/install.sh | sh

This builds Paralegal against the nightly toolchain pinned in rust-toolchain.toml (provisioned automatically by rustup), so the first install compiles the analyzer and may take a few minutes. See install.sh --help for options (specific version, custom install dir, building from a local checkout).

For a full walkthrough of installation and writing your first policy, see the step-by-step guide in our online documentation.