In the blog post, we will explain the technical details on how SonarQube cloud uses taint analysis to identify the taint flow vulnerability, CVE-2024-35219, a critical arbitrary file read and deletion vulnerability in the OpenAPI Generator. With these solutions, we introduce CPGHunter, a novel framework that integrates LLM and taint analysis into a scalable vulnerability detection pipeline. In this paper, we design and implement CoBrA, a context-, branch-sensitive approach to detect taint-style vulnerabilities in PHP-based Web applications. Taint analysis is a classical program analysis technique that marks data from untrusted sources as “tainted” and then follows that data as it flows through the program. In response to this question, we present TaintRadar, a system that treats taint-style vulnerability discovery as a sequence of independent, composable graph augmentation operators executed over an optimized base CPG representation. Taint analysis (also known as taint checking) is a security technique used in software development to track the flow of potentially harmful data through a program. What is taint analysis? A red alert flashes across your monitor. You see untrusted data creeping through your application's logic, and you need to know exactly where it's headed. This is where taint analysis comes in. Think of it as a digital tracking system for dirty or unverified input. We introduce a novel on-demand, element-sensitive analysis for composite containers based on semantic model, access pattern abstraction and a sparse tracking model. This approach resolves the expensive analysis overhead and the over-taint problem without sacrificing precision. In this section, we showcase some interesting taint-style vulnerabilities of inter-service type detected by MScan in highly popular applications, further illustrating the high risk posed by these vulnerabilities and demonstrating the practical utility of MScan in real-world scenarios. To address these limitations, we present TaintRadar, an approach that systematically augments CPGs with three semantic analysis layers. First, vulnerability-typed sanitization computes node-level safety guarantees using transfer functions and context-sensitive parameter binding.