jppa is a pointer and purity analysis tool for Java programs. Mainly a purity analysis tool: given a full Java program, it detects pure JML-style methods, i.e., methods that do not mutate existing objects (they may mutate new ones).
There are no reported vulnerabilities