Trace Every Input
To Every Dangerous Sink.
AI-generated code can inadvertently pipe user input directly into dangerous functions. QWED's Taint Analyzer traces data flow paths from untrusted sources to sensitive sinks like eval(), exec(), and SQL queries.
What Taint Analysis Catches
AI code generators don't understand security context. They write functional code that often passes user input directly to dangerous operations.
Remote Code Execution
Detects when user-controlled data flows into eval(), exec(), subprocess, or system() calls without proper sanitization.
Cross-Site Scripting
Traces user input flowing into HTML templates, innerHTML assignments, or DOM manipulation without escaping.
SQL/NoSQL Injection
Identifies data paths from request parameters to database query construction without parameterized queries.
Security at the Data Flow Level
Static analysis finds dangerous functions. Taint analysis goes deeper—it proves whether untrusted data can actually reach those functions through the code's execution paths.
Beyond Pattern Matching
Traditional scanners use regex to find dangerous functions. QWED builds a complete data flow graph, tracking variable assignments, function returns, and object property access across the entire codebase.