trailmark

Static analysis with taint propagation across a polyglot codebase is performed by parsing source code into directed graphs to map how untrusted input reaches sensitive functions. This process traces potential attack surfaces from external entry points to database queries.

Yes, you can estimate the blast radius of a vulnerability in multi-language repositories by measuring downstream and upstream dependencies within the generated semantic code graph. This quantifies the impact of potential vulnerabilities by analyzing call paths across polyglot environments.

Yes, trailmark requires the trailmark Python package and uv to execute pre-analysis passes and query the resulting semantic code graph. These dependencies are necessary to parse source code and generate the security-focused analysis output.

The best way to identify privilege boundaries and entry points during a security audit is to map call paths in a directed code graph to detect where trust levels transition. This automatically identifies external entry points and traces paths to sensitive functions.

Taint analysis maps untrusted input to sensitive functions by parsing source code into directed graphs and tracing data flow along call paths. This reveals where trust levels transition and highlights security-critical hotspots that manual review often misses.

You should use code graph static analysis instead of manual review when dealing with complex, multi-language codebases where tracking call paths and taint propagation manually is unfeasible. It automates the creation of call graphs to identify security-critical paths and privilege boundaries.