Write a custom Semgrep rule to track a real taint path
When the codebase has a project-specific source or sink, a five-line taint rule finds every instance faster than reading files.
Tag: taint-analysis
Review by sources and sinks, not top to bottom
Enumerate every input source and every dangerous sink first, then only read the code that connects them.