Security Analysis Explorer

Trace taint propagation through code, explore the taint lattice, and discover vulnerabilities. Select a program to see how tainted data flows from sources to sinks — and how sanitizers break the chain.

SQL InjectionClassic SQL injection: user input flows directly into a SQL query without sanitization.
Source Code
Loading editor...

Taint Lattice

4-element flat lattice: Bot < {Untainted, Tainted} < Top. Tracks whether data is user-controlled (tainted) or safe (untainted).

Height: 2 (finite)
Width: 2
Widening: Not needed
Hasse Diagram — click two elements to compute join & meet
UntaintedTainted

Click an element in the diagram above

Key Property

join(Untainted, Tainted) = Top — if data might be tainted OR untainted, we must treat it as potentially tainted (conservative/sound). This is why merge points after branches can increase taint levels.