How TokenCap Traces Taint Flow from Sources to Sinks Using AST Traversal

Generative AI is great at writing features, but notorious for re-introducing classic security vulnerabilities like SQL injection, Command Injection, and Path Traversal.

In TokenCap, we implemented intra-procedural static taint flow analysis in src/security/taint/ to flag tainted data paths before code changes are committed.

Taint Analysis Mechanics

1. Sources: HTTP request properties (req.body, req.query, req.params, event.body).
2. Propagation: Data flow tracking across variable assignments, template strings, and object destructuring within the function scope.
3. Sinks: Unescaped database execution calls (db.raw, query()), shell executions (exec, spawn), and filesystem operations (fs.readFile).
4. Sanitizers: Validating functions that cleanse taint (such as parameterized queries or validator schemas).

Inspection Example

tokencap analyze security

CLI Output:

Inspecting 62 route handlers for static taint flow...
[WARNING] Potential SQL Injection Sink:
  - Source: req.query.filter (src/api/users.js:34)
  - Taint Path: filter -> rawFilterClause -> queryStr
  - Sink: db.raw(queryStr) (src/api/users.js:48)
  - Recommendation: Use parameterized binding (:filter) or validate through zod schema.

This security finding is embedded into .tokencap/risk-map.md, alerting any coding agent working on src/api/users.js to avoid raw string concatenation.

Read our security architecture at tokencap.vansharora.app