Event-driven architecture security
Follow untrusted data through the queue, not just the request.
Async decoupling hides the dataflow
Queues exist to decouple services — which is exactly why the dataflow becomes invisible. A producer publishes user input to a topic; a consumer somewhere else trusts the bus and acts on the payload. There is no request/response trace to follow, so tooling that reasons about synchronous calls never connects the producer's input to the consumer's sink.
Topic-aware taint across the broker
VulnGraph matches producers and consumers by topic across every repository, then propagates taint across the broker as a first-class graph edge. When user input published to a topic reaches a consumer that writes to a database or executes a command without sanitization, it surfaces the full path — producer, topic, consumer, sink.
Brokers and specs it understands
Detection spans Kafka (kafkajs, Spring @KafkaListener, NestJS @EventPattern), RabbitMQ/AMQP, AWS SQS, and Google Pub/Sub at the code level, plus AsyncAPI 2.x and 3.0 specifications — so event-driven services described by contract or by code both land on the graph.
Key capabilities
- ✓Topic-matched producer/consumer linking across repos
- ✓Taint propagation across the message bus
- ✓Implicit-trust detection on queue consumers
- ✓Kafka, RabbitMQ, SQS, Pub/Sub and AsyncAPI coverage