borrowsanitizer.com

What It Is

BorrowSanitizer is a dynamic analysis tool focused on Rust-specific aliasing bugs, targeting multilingual applications where Rust interoperates with languages such as C and C++. The Rust compiler relies on aliasing and mutability rules to provide static safety guarantees, but unsafe code can bypass these restrictions. If Rust’s aliasing model is violated, compiler optimizations may produce incorrect behavior and introduce security vulnerabilities. The project aims to detect these issues in the form of an LLVM sanitizer.

Core Capabilities and Ecosystem

Compared with Miri, the article emphasizes that Miri can detect violations of the latest Tree Borrows model, but cannot cover foreign code. It is also slower because it uses interpretation, making it less suitable for large-scale fuzzing or property-based testing. BorrowSanitizer aims to run closer to native execution speed and support interoperability between Rust, C, and C++, allowing it to fit into security testing pipelines. It is open source and hosted on GitHub, uses Zulip as its main community communication channel, and has already been presented in public contexts such as LLVM memory safety and Rust Verification Workshop events.

Pricing and License

The website does not provide commercial pricing or paid plans. The project is explicitly open source and uses dual Apache and MIT licensing, making it closer to a research/infrastructure-oriented free tool. The article provides no information about commercial support, SLAs, hosted services, or an enterprise edition.

Pros and Cons

Its main strength is that it defines the problem very precisely, targeting an area in Rust unsafe code and FFI where traditional sanitizers and Miri each have limitations. Its LLVM sanitizer-based approach also offers potential performance advantages. The drawbacks are equally clear: the article explicitly states that the project is still at an early stage and that BorrowSanitizer is not yet usable. The current documentation mainly consists of an introduction, setup notes, status updates, and an About section, with no verifiable detection results, stable release, or complete integration case studies yet.

Who It’s For and Access from China

It is best suited for Rust unsafe library authors, cross-language FFI projects, security testing teams, fuzzing engineers, and programming language researchers who want to follow or contribute to the project. It is not yet suitable as a direct production dependency. Regarding access from China, the article provides no information about network availability, mirrors, or payments, and actual accessibility may depend on local access to GitHub and Zulip, so this is marked as unknown. Current alternatives or complementary tools include Miri, AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer.