Cross-service taint analysis
Find the injection paths that live in the seams between your services.
The vulnerability no single-repo scanner sees
A real attack path often spans services: user input enters one service, is published to a queue, consumed by another that trusts the bus, and written to a shared database unsanitized. No single repository has the whole picture, so single-service SAST and dependency scanners never see the path.
How VulnGraph finds it
VulnGraph builds a unified call graph across your services and propagates taint labels from sources (endpoints accepting user input) along the graph to sinks (database writes, unauthenticated consumers). When tainted data reaches a sink without verified sanitization, it surfaces the full path — every hop, every service.
Across repositories, not just services
Workspace analysis unions a workspace's repositories into one architecture graph — shared databases, queues and internal calls become links — so taint that crosses repo boundaries is detected too. The result is the exact class of finding that fragmented, per-repo tooling structurally cannot produce.
Key capabilities
- ✓Source/sink identification with sanitizer awareness
- ✓Cross-service and cross-repository propagation
- ✓Severity weighted into an explainable security score
- ✓SARIF 2.1.0 export for GitHub Code Scanning