pysa-false-negative-debugger

To debug Pysa false negatives, compare two Pysa analysis output directories to identify exactly where taint propagation diverges. You need to provide an issue URL and two result directories to pinpoint the precise call chain where taint flow breaks.

A static analysis issue may be missing in another Pysa run due to divergent taint propagation between configurations. By extracting and correlating issue handles from the analysis URL, you can trace the call graph to locate the exact step where taint flow is dropped.

To compare Pysa output directories for taint analysis, you need an issue URL and two result directories. You must also load the pysa-json-models skill to use the Pysa model explorer for inspecting traces during the investigation.

To trace taint flow in Pysa, load the pysa-json-models skill and use the Pysa model explorer to inspect traces. This provides guided steps for conducting forward, backward, and root analysis to locate where taint propagation breaks between two runs.

The best way to locate divergence in taint propagation is to compare two Pysa output directories directly. This structured workflow surfaces the precise call chain where taint flow is lost, enabling precise remediation of the false negative.

The Pysa model explorer is used within this workflow to inspect traces across two Pysa result directories. It requires an issue URL and both directories to provide guided steps for forward, backward, and root analysis to find where taint flow is lost.