The UnboundCompute blog

Writing on web security

Taint Analysis Explained

Taint analysis marks untrusted input, tracks it through your code, and alerts when it reaches a sink unclean. A plain guide with…
Missing Authorization Check: The Handler That Skips It

A missing authorization check can hide between two near-identical handlers. Follow the value through a code graph to find the one that…
Sources and Sinks in Security Explained

Sources and sinks are the core vocabulary of injection bugs. Learn what a source, a sink, and a sink specific sanitizer are,…
Data Flow Analysis Explained

Data flow analysis tracks how values move and what facts hold at each program point. Learn forward and backward analyses, may versus…
Control Flow Graphs Explained

A control flow graph models a function as basic blocks joined by edges. Learn paths, loops, feasible branches, and why a bug…
What Is a Code Property Graph?

A code property graph merges syntax, control flow, and data dependence into one queryable graph so you can prove attacker input reaches…
Security Agent Skills: Testing Method, Not Another Scanner

Security agent skills package a tester’s method, not a fixed script. Learn how they work, what the library covers, and how to…
AI SAST vs Traditional SAST

How ai sast differs from traditional rule based static analysis, why a model must be grounded in a deterministic graph, and how…
Why SAST Tools Have So Many False Positives

Why sast false positives pile up: no reachability, unmodeled sanitizers, over approximation, framework blindness, dead code, and what cuts the noise.
Why SAST Misses Business Logic Bugs

Why sast business logic coverage falls short: static analysis matches dangerous code shapes, but logic bugs hide in the safe checks your…