Write a custom Semgrep rule to track a real taint path
When the codebase has a project-specific source or sink, a five-line taint rule finds every instance faster than reading files.
Tag: methodology
Review by sources and sinks, not top to bottom
Enumerate every input source and every dangerous sink first, then only read the code that connects them.
Look at what the platform opens, not just what you deploy
The app on :8080 is rarely the whole attack surface. Enumerate every listener the server itself owns.