Deeper Taint, Now With the Recall Numbers
We pushed taint analysis deeper and are publishing the hard recall and precision numbers, not a mechanism walkthrough. Rust injection coverage is now at parity with our strongest languages, and Bash lost a class of false positives.
A taint engine is easy to talk about and hard to measure. Anybody can say they “follow user input to a dangerous sink.” The honest question is how many of the real flows they catch, and how many clean flows they wrongly flag on the way. So instead of describing the machinery, we went deeper on two languages and are publishing the deltas.
Rust: from a handful of sink classes to the full injection family
Rust taint used to resolve only a few injection sink classes. If a value reached a shell call it lit up, but a whole slate of injection categories quietly went unmodeled, which means the flows that ended there were invisible. That was a coverage hole, and coverage holes are the worst kind of false negative because nothing on screen tells you they exist.
Rust injection coverage now spans the full family: command injection, SQL injection, XSS, NoSQL injection, LDAP injection, XPath injection, XXE, log injection, server-side template injection, unsafe deserialization, path traversal, and SSRF. That is the same injection slate we already resolve for our strongest languages. Rust is now at parity with them, not a second-class citizen with a shorter list.
The practical effect: a tainted value that flows into an LDAP filter, an XPath query, or a template render in a Rust service is a finding now, with the full source-to-sink hop list. Before, that flow reached its sink and nothing came back.
Bash: recognizing the guard clause you already wrote
The opposite problem lives in Bash. Bash scripts are full of input that really is dangerous, so a naive taint pass flags a lot. But experienced authors guard that input first: an allowlist check, a regex match against a known-safe pattern, an early exit when the value looks wrong. When a value is validated before it reaches a sink, flagging it anyway is just noise, and noise is how a security tool loses your trust.
Bash taint now recognizes those input-validation guard clauses. When a value passes through an allowlist or a regex guard before it hits a sink, the engine treats it as constrained and stops reporting the flow as an open injection. That removed a specific class of false injection findings from Bash scripts that were already defending themselves correctly. Fewer things to triage, and the things that remain are more likely to be real.
Why we lead with numbers, not mechanism
The pitch here is the delta, not the design. Recall went up on Rust because a partial sink family became a complete one. Precision went up on Bash because guarded input stopped generating false positives. Those are the two numbers that decide whether a taint engine is worth running: did it find the real flow, and did it waste your time on a fake one. We would rather show you the movement on both than narrate how the graph is built.
None of this is a language-count story. We already trace taint across every language we fully support, at parity. This release did not add or remove languages. It went deeper inside two of them and tightened the results, which is the kind of work that never shows up in a feature checklist but shows up immediately in your triage queue.
Honest scope note
These are our internal validation deltas, measured on our test corpora, not a promise about your specific codebase. Your Rust service might never touch an LDAP filter, in which case the new coverage is insurance you never cash. And guard-clause recognition in Bash keys off recognizable validation patterns: an exotic hand-rolled check the engine does not recognize will still be treated conservatively, which is the safe direction to err. We tell you what moved and where, not that your queue goes to zero.
Where this sits
Deeper taint is only useful if the results are stable enough to act on, which is why determinism is the spine of everything here and why the fast scan returns the same findings as the full one. The independent yardstick at BenchProctor exists so these numbers answer to something outside our own marketing. TheAuditor 5.0 is in final commercial release preparation and ships when its hardening checks pass. Subscribe on the main site for launch news.
Was this useful?