taint-analysis
Safeguard articles tagged "taint-analysis" — guides, analysis, and best practices for software supply chain and application security.
14 articles
The One Line of Ordinary Code That Kills a Taint Engine
param = decode(param) is as common as code gets. In a dataflow engine that resolves variables by looking backwards, it can recurse forever — and in Go the resulting stack overflow cannot be caught.
What Tree-sitter Taint Analysis Actually Catches (and What It Cannot)
Following untrusted data from source to sink across a real codebase is a solved problem right up until reflection, dynamic dispatch and an ORM turn up. Knowing where the analysis stops is what makes it usable.
The three dimensions of Python static analysis, and where each one blinds itself
AST scanners, taint trackers, and type checkers each solve a different problem — and each has a documented blind spot that lets real bugs through untouched.
Source Code Analyzer: How Static Analysis Finds Real Vulnerabilities
A source code analyzer reads your code without running it to find bugs and security flaws early. Here is how it works, what it catches, and how to run one without drowning in noise.
How taint analysis works in Snyk Code: tracking data from...
Snyk Code traces untrusted data from source to sink using interprocedural static analysis and ML ranking. Here's how the taint-tracking mechanics work.
How Snyk Code performs interprocedural data-flow analysis...
How Snyk Code tracks tainted data across function and file boundaries using call-graph summaries, taint propagation, and hybrid symbolic AI rules.
How Snyk Code distinguishes sanitizers from insecure sour...
How Snyk Code's taint-tracking engine tells sanitizers apart from insecure sources and sinks, and where the source-sink-sanitizer model still needs human review.
How Snyk Code detects cross-site scripting (XSS) through ...
How Snyk Code's taint analysis traces untrusted input from source to sink to flag reflected, DOM-based, and stored XSS with fewer false positives.
Taint Analysis vs Reachability: What You Actually Need in 2026
Taint and reachability sound similar and answer different questions. Here is when each one matters, where vendors blur the line, and how to use both.
Zero-Day Discovery With LLM-Augmented Reachability: A Safeguard Engine Walkthrough
Pattern-matching scanners miss zero-days by definition. An engine that follows taint across package boundaries plus a model that hypothesizes exploit conditions can find what either would miss alone. Here is how that pipeline works end to end.
Deep Code Analysis: What It Is and How It Finds Bugs Shallow Scans Miss
Deep code analysis reads how data flows through your program instead of matching patterns line by line. Here is what that buys you over grep-style linting.
How Does SAST Work? Stages of SAST Scanning
A stage-by-stage breakdown of how SAST scanning actually works — parsing, taint analysis, false positives — with real CVEs and benchmark data.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.