Feat/full cfg (#30)

* feat: Enhance control flow analysis with function summaries and taint analysis

* feat: Update taint analysis to utilize function summaries for enhanced tracking

* Refactor `walk.rs` batch processing and override handling:

- Renamed `Batcher` to `BatchSender` for clarity.
- Added `BatchSender::new` constructor for cleaner initialization.
- Simplified batch size management in `BatchSender`.
- Extracted `build_overrides` function for reusable override construction.
- Improved error handling and validation in override building.
- Enhanced performance with directory and file type filtering in `walk`.

* Improve logging and streamline directory walk process:

- Added detailed `tracing` logs for debugging batch flushes, override construction, and walk initialization/completion.
- Optimized and simplified `filter_entry` logic for directory and file type filters.
- Improved metadata checks and max file size enforcement during the scan.

* Refactor and optimize taint tracking, label rules, and directory walk process:

- Replaced `DefaultHasher` with `blake3::Hasher` for improved taint hashing.
- Enhanced sorting and hashing logic in `taint.rs` for consistency and efficiency.
- Removed unused `set_hash` function and redundant imports across files.
- Improved batch sender logic in `walk.rs`, renaming key components for clarity.
- Unified `spawn_senders` and `spawn_file_walker` with thread handling and channel tuple return.
- Expanded label rules with additional matchers for sources, sanitizers, and sinks.
- Deprecated `dump_cfg` and specific logging utilities in `cfg.rs` for code cleanup.

* fix: fixed let chains error in walk.rs

* fix: updated dependencies

* fix: updated dependencies

* chore: Remove standard error in scan.rs

* feat: Introduce function summaries for enhanced taint and control flow analysis

* feat: Enhance taint analysis with interop support and function summaries

* feat: Add configuration analysis module and enhance matcher rules

* feat: Add arity column to function_summaries and handle schema migration

* fix: fixed clippy &PathBuf warnings

* chore: Update dependencies and versioning in Cargo files

* docs: Update README to enhance clarity and detail on features and analysis modes

* chore: Update CHANGELOG for version 0.2.0 with new features, changes, and fixes

* docs: Update SECURITY.md to clarify version support status

---------

Co-authored-by: elipeter <eli.peter@es.fcm.travel>

src/ast.rs

@@ -1,7 +1,11 @@
-use crate::cfg::{analyse_function, build_cfg};
+use crate::cfg::{build_cfg, export_summaries};
+use crate::cfg_analysis;
 use crate::commands::scan::Diag;
 use crate::errors::{NyxError, NyxResult};
 use crate::patterns::Severity;
+use crate::summary::{FuncSummary, GlobalSummaries};
+use crate::symbol::{Lang, normalize_namespace};
+use crate::taint::analyse_file;
 use crate::utils::config::AnalysisMode;
 use crate::utils::ext::lowercase_ext;
 use crate::utils::{Config, query_cache};
@@ -15,67 +19,189 @@ thread_local! {
 
 /// Convenience alias for node indices.
 fn byte_offset_to_point(tree: &tree_sitter::Tree, byte: usize) -> tree_sitter::Point {
-    // `descendant_for_byte_range` gives us *some* node that starts at `byte`,
-    // `start_position` turns that into rows & columns (both 0-based)
     tree.root_node()
         .descendant_for_byte_range(byte, byte)
         .map(|n| n.start_position())
         .unwrap_or_else(|| tree_sitter::Point { row: 0, column: 0 })
 }
 
-pub(crate) fn run_rules_on_file(path: &Path, cfg: &Config) -> NyxResult<Vec<Diag>> {
-    tracing::debug!("Running rules on: {}", path.display());
-    let bytes = std::fs::read(path)?;
+/// Resolve a file extension to a (tree‑sitter Language, slug) pair.
+fn lang_for_path(path: &Path) -> Option<(Language, &'static str)> {
+    match lowercase_ext(path) {
+        Some("rs") => Some((Language::from(tree_sitter_rust::LANGUAGE), "rust")),
+        Some("c") => Some((Language::from(tree_sitter_c::LANGUAGE), "c")),
+        Some("cpp") => Some((Language::from(tree_sitter_cpp::LANGUAGE), "cpp")),
+        Some("java") => Some((Language::from(tree_sitter_java::LANGUAGE), "java")),
+        Some("go") => Some((Language::from(tree_sitter_go::LANGUAGE), "go")),
+        Some("php") => Some((Language::from(tree_sitter_php::LANGUAGE_PHP), "php")),
+        Some("py") => Some((Language::from(tree_sitter_python::LANGUAGE), "python")),
+        Some("ts") => Some((
+            Language::from(tree_sitter_typescript::LANGUAGE_TYPESCRIPT),
+            "typescript",
+        )),
+        Some("js") => Some((
+            Language::from(tree_sitter_javascript::LANGUAGE),
+            "javascript",
+        )),
+        Some("rb") => Some((Language::from(tree_sitter_ruby::LANGUAGE), "ruby")),
+        _ => None,
+    }
+}
 
-    // Fast binary-file guard (skip if >1% NULs)
-    if bytes.iter().filter(|b| **b == 0).count() * 100 / bytes.len().max(1) > 1 {
+/// Fast binary-file guard: skip if >1% NUL bytes.
+fn is_binary(bytes: &[u8]) -> bool {
+    bytes.iter().filter(|b| **b == 0).count() * 100 / bytes.len().max(1) > 1
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+//  Pass 1: Extract function summaries (no taint analysis)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/// Extract function summaries from pre-read bytes.
+///
+/// This is the core **pass 1** implementation. Callers that already hold the
+/// file contents should use this variant to avoid a redundant `fs::read`.
+pub fn extract_summaries_from_bytes(
+    bytes: &[u8],
+    path: &Path,
+    _cfg: &Config,
+) -> NyxResult<Vec<FuncSummary>> {
+    let _span = tracing::debug_span!("extract_summaries", file = %path.display()).entered();
+    if is_binary(bytes) {
         return Ok(vec![]);
     }
 
-    let (ts_lang, lang_slug) = match lowercase_ext(path) {
-        Some("rs") => (Language::from(tree_sitter_rust::LANGUAGE), "rust"),
-        Some("c") => (Language::from(tree_sitter_c::LANGUAGE), "c"),
-        Some("cpp") => (Language::from(tree_sitter_cpp::LANGUAGE), "cpp"),
-        Some("java") => (Language::from(tree_sitter_java::LANGUAGE), "java"),
-        Some("go") => (Language::from(tree_sitter_go::LANGUAGE), "go"),
-        Some("php") => (Language::from(tree_sitter_php::LANGUAGE_PHP), "php"),
-        Some("py") => (Language::from(tree_sitter_python::LANGUAGE), "python"),
-        Some("ts") => (
-            Language::from(tree_sitter_typescript::LANGUAGE_TYPESCRIPT),
-            "typescript",
-        ),
-        Some("js") => (
-            Language::from(tree_sitter_javascript::LANGUAGE),
-            "javascript",
-        ),
-        Some("rb") => (Language::from(tree_sitter_ruby::LANGUAGE), "ruby"),
-        _ => return Ok(vec![]),
+    let Some((ts_lang, lang_slug)) = lang_for_path(path) else {
+        return Ok(vec![]);
+    };
+
+    let tree = PARSER.with(|cell| {
+        let mut parser = cell.borrow_mut();
+        parser.set_language(&ts_lang)?;
+        parser
+            .parse(bytes, None)
+            .ok_or_else(|| NyxError::Other("tree-sitter failed".into()))
+    })?;
+
+    let file_path_str = path.to_string_lossy();
+    let (_cfg_graph, _entry, local_summaries) = build_cfg(&tree, bytes, lang_slug, &file_path_str);
+
+    Ok(export_summaries(
+        &local_summaries,
+        &file_path_str,
+        lang_slug,
+    ))
+}
+
+/// Convenience wrapper that reads the file then delegates to
+/// [`extract_summaries_from_bytes`].
+pub fn extract_summaries_from_file(path: &Path, cfg: &Config) -> NyxResult<Vec<FuncSummary>> {
+    let bytes = std::fs::read(path)?;
+    extract_summaries_from_bytes(&bytes, path, cfg)
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+//  Pass 2 / single‑file: Full rule execution (AST queries + taint)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/// Run all enabled analyses on pre-read bytes and return diagnostics.
+///
+/// This is the core **pass 2** implementation. Callers that already hold the
+/// file contents should use this variant to avoid a redundant `fs::read`.
+pub fn run_rules_on_bytes(
+    bytes: &[u8],
+    path: &Path,
+    cfg: &Config,
+    global_summaries: Option<&GlobalSummaries>,
+    scan_root: Option<&Path>,
+) -> NyxResult<Vec<Diag>> {
+    let _span = tracing::debug_span!("run_rules", file = %path.display()).entered();
+
+    if is_binary(bytes) {
+        return Ok(vec![]);
+    }
+
+    let Some((ts_lang, lang_slug)) = lang_for_path(path) else {
+        return Ok(vec![]);
     };
 
     let _tree = PARSER.with(|cell| {
         let mut parser = cell.borrow_mut();
         parser.set_language(&ts_lang)?;
         parser
-            .parse(&*bytes, None)
+            .parse(bytes, None)
             .ok_or_else(|| NyxError::Other("tree-sitter failed".into()))
     })?;
 
     let mut out = Vec::new();
+    let file_path_str = path.to_string_lossy();
 
-    if cfg.scanner.mode == AnalysisMode::Full || cfg.scanner.mode == AnalysisMode::Taint {
+    // CFG construction + taint + cfg_analysis only needed for Full/Taint modes.
+    let needs_cfg =
+        cfg.scanner.mode == AnalysisMode::Full || cfg.scanner.mode == AnalysisMode::Taint;
+
+    if needs_cfg {
+        // Build CFG — needed for both taint analysis and CFG structural analyses.
+        let (cfg_graph, entry, summaries) = build_cfg(&_tree, bytes, lang_slug, &file_path_str);
+        let caller_lang = Lang::from_slug(lang_slug).unwrap_or(Lang::Rust);
+
+        // ── Taint analysis ──────────────────────────────────────────────
         tracing::debug!("Running taint analysis on: {}", path.display());
-        let (cfg_graph, entry) = build_cfg(&_tree, &bytes, lang_slug);
+        tracing::debug!("Func summaries: {:?}", summaries);
+        let scan_root_str = scan_root.map(|p| p.to_string_lossy());
+        let namespace = normalize_namespace(&file_path_str, scan_root_str.as_deref());
+        let taint_results = analyse_file(
+            &cfg_graph,
+            entry,
+            &summaries,
+            global_summaries,
+            caller_lang,
+            &namespace,
+            &[],
+        );
+        for finding in &taint_results {
+            // Report the SINK location — where the vulnerability manifests.
+            let sink_byte = cfg_graph[finding.sink].span.0;
+            let sink_point = byte_offset_to_point(&_tree, sink_byte);
 
-        for p in analyse_function(&cfg_graph, entry) {
-            let src_byte = cfg_graph[p.first().copied().unwrap()].span.0;
-            let point = byte_offset_to_point(&_tree, src_byte);
+            // Include source location in the ID so distinct flows through
+            // the same sink (or different sinks at the same line) don't
+            // get collapsed by dedup.
+            let source_byte = cfg_graph[finding.source].span.0;
+            let source_point = byte_offset_to_point(&_tree, source_byte);
 
+            out.push(Diag {
+                path: path.to_string_lossy().into_owned(),
+                line: sink_point.row + 1,
+                col: sink_point.column + 1,
+                severity: Severity::High,
+                id: format!(
+                    "taint-unsanitised-flow (source {}:{})",
+                    source_point.row + 1,
+                    source_point.column + 1
+                ),
+            });
+        }
+
+        // ── CFG structural analyses ─────────────────────────────────────
+        let cfg_ctx = cfg_analysis::AnalysisContext {
+            cfg: &cfg_graph,
+            entry,
+            lang: caller_lang,
+            file_path: &file_path_str,
+            source_bytes: bytes,
+            func_summaries: &summaries,
+            global_summaries,
+            taint_findings: &taint_results,
+        };
+        for cf in cfg_analysis::run_all(&cfg_ctx) {
+            let point = byte_offset_to_point(&_tree, cf.span.0);
             out.push(Diag {
                 path: path.to_string_lossy().into_owned(),
                 line: point.row + 1,
                 col: point.column + 1,
-                severity: Severity::High,
-                id: "taint-unsanitised-flow".into(),
+                severity: cf.severity,
+                id: cf.rule_id,
             });
         }
     }
@@ -90,7 +216,7 @@ pub(crate) fn run_rules_on_file(path: &Path, cfg: &Config) -> NyxResult<Vec<Diag
             if cfg.scanner.min_severity <= cq.meta.severity {
                 continue;
             }
-            let mut matches = cursor.matches(&cq.query, root, &*bytes);
+            let mut matches = cursor.matches(&cq.query, root, bytes);
             while let Some(m) = matches.next() {
                 if let Some(cap) = m.captures.iter().find(|c| c.index == 0) {
                     let point = cap.node.start_position();
@@ -106,7 +232,7 @@ pub(crate) fn run_rules_on_file(path: &Path, cfg: &Config) -> NyxResult<Vec<Diag
         }
     }
 
-    // Check to ensure no duplicates (DOUBLE-CHECK EFFICIENCY)
+    // Check to ensure no duplicates
     out.sort_by(|a, b| (a.line, a.col, &a.id, a.severity).cmp(&(b.line, b.col, &b.id, b.severity)));
     out.dedup_by(|a, b| {
         a.line == b.line && a.col == b.col && a.id == b.id && a.severity == b.severity
@@ -115,13 +241,25 @@ pub(crate) fn run_rules_on_file(path: &Path, cfg: &Config) -> NyxResult<Vec<Diag
     Ok(out)
 }
 
+/// Convenience wrapper that reads the file then delegates to
+/// [`run_rules_on_bytes`].
+pub fn run_rules_on_file(
+    path: &Path,
+    cfg: &Config,
+    global_summaries: Option<&GlobalSummaries>,
+    scan_root: Option<&Path>,
+) -> NyxResult<Vec<Diag>> {
+    let bytes = std::fs::read(path)?;
+    run_rules_on_bytes(&bytes, path, cfg, global_summaries, scan_root)
+}
+
 #[test]
 fn unknown_extension_returns_empty() {
     let dir = tempfile::tempdir().unwrap();
     let txt = dir.path().join("notes.txt");
     std::fs::write(&txt, "just some text").unwrap();
 
-    let diags = run_rules_on_file(&txt, &Config::default())
+    let diags = run_rules_on_file(&txt, &Config::default(), None, None)
         .expect("function should never error on plain text");
 
     assert!(diags.is_empty());
@@ -138,6 +276,6 @@ fn binary_file_guard_triggers() {
     }
     std::fs::write(&bin, &data).unwrap();
 
-    let diags = run_rules_on_file(&bin, &Config::default()).unwrap();
+    let diags = run_rules_on_file(&bin, &Config::default(), None, None).unwrap();
     assert!(diags.is_empty(), "binary files are skipped");
 }

src/cfg_analysis/auth.rs

@@ -0,0 +1,225 @@
+use super::dominators::{self, dominates};
+use super::{
+    AnalysisContext, CfgAnalysis, CfgFinding, Confidence, is_auth_call, is_entry_point_func,
+    is_sink,
+};
+use crate::cfg::StmtKind;
+use crate::labels::DataLabel;
+use crate::patterns::Severity;
+use crate::symbol::Lang;
+use petgraph::graph::NodeIndex;
+
+pub struct AuthGap;
+
+/// Privileged sink capabilities that warrant auth-gap checking.
+/// Shell execution, file I/O, and similar sensitive operations.
+fn is_privileged_sink(info: &crate::cfg::NodeInfo) -> bool {
+    use crate::labels::Cap;
+    match info.label {
+        Some(DataLabel::Sink(caps)) => {
+            // Shell execution or file I/O are privileged
+            caps.intersects(Cap::SHELL_ESCAPE | Cap::FILE_IO)
+        }
+        _ => false,
+    }
+}
+
+/// Web handler parameter patterns by language.
+/// Returns true if the function's parameters suggest it handles HTTP requests.
+fn has_web_handler_params(ctx: &AnalysisContext, func_name: &str) -> bool {
+    // Find parameter names for this function from FuncSummaries
+    let param_names: Vec<&str> = ctx
+        .func_summaries
+        .values()
+        .filter(|s| ctx.cfg[s.entry].enclosing_func.as_deref() == Some(func_name))
+        .flat_map(|s| s.param_names.iter().map(|p| p.as_str()))
+        .collect();
+
+    match ctx.lang {
+        Lang::Rust => {
+            // Rust web frameworks: actix-web, axum, rocket, warp
+            // Look for parameter type-like names: request, req, http_request, json, query, form, etc.
+            let web_params = [
+                "request",
+                "req",
+                "http_request",
+                "httprequest",
+                "json",
+                "query",
+                "form",
+                "payload",
+                "body",
+                "web",
+            ];
+            param_names
+                .iter()
+                .any(|p| web_params.contains(&p.to_ascii_lowercase().as_str()))
+        }
+        Lang::JavaScript | Lang::TypeScript => {
+            // Express.js / Node.js: (req, res), (request, response), (ctx)
+            let lower: Vec<String> = param_names.iter().map(|p| p.to_ascii_lowercase()).collect();
+            let has_req = lower
+                .iter()
+                .any(|p| p == "req" || p == "request" || p == "ctx");
+            let has_res = lower.iter().any(|p| p == "res" || p == "response");
+            // req+res pattern or ctx pattern
+            (has_req && has_res) || lower.iter().any(|p| p == "ctx")
+        }
+        Lang::Python => {
+            // Django/Flask: request, self+request
+            let lower: Vec<String> = param_names.iter().map(|p| p.to_ascii_lowercase()).collect();
+            lower.iter().any(|p| p == "request" || p == "req")
+        }
+        Lang::Go => {
+            // net/http: (w http.ResponseWriter, r *http.Request)
+            // At AST level we see parameter names, not types. Look for w+r or writer+request patterns.
+            let lower: Vec<String> = param_names.iter().map(|p| p.to_ascii_lowercase()).collect();
+            let has_writer = lower.iter().any(|p| p == "w" || p == "writer" || p == "rw");
+            let has_request = lower
+                .iter()
+                .any(|p| p == "r" || p == "req" || p == "request");
+            has_writer && has_request
+        }
+        Lang::Java => {
+            // Servlet: HttpServletRequest, Spring: @RequestMapping params
+            let lower: Vec<String> = param_names.iter().map(|p| p.to_ascii_lowercase()).collect();
+            lower
+                .iter()
+                .any(|p| p == "request" || p == "req" || p.contains("httpservlet"))
+        }
+        Lang::Ruby => {
+            // Rails controllers use params implicitly; Sinatra uses request
+            let lower: Vec<String> = param_names.iter().map(|p| p.to_ascii_lowercase()).collect();
+            lower
+                .iter()
+                .any(|p| p == "request" || p == "req" || p == "params")
+        }
+        Lang::Php => {
+            let lower: Vec<String> = param_names.iter().map(|p| p.to_ascii_lowercase()).collect();
+            lower
+                .iter()
+                .any(|p| p == "$request" || p == "request" || p == "$req")
+        }
+        _ => false,
+    }
+}
+
+/// Determine if a function qualifies as a web entrypoint (not just any entrypoint).
+///
+/// A web entrypoint must:
+/// 1. Match entrypoint naming rules (handle_*, route_*, api_*, etc.) — but NOT bare `main`
+///    unless it has web-like parameters
+/// 2. Have parameters resembling HTTP handler signatures
+fn is_web_entrypoint(ctx: &AnalysisContext, func_name: &str) -> bool {
+    // "main" without web params is a CLI entrypoint — skip
+    if func_name == "main" {
+        return has_web_handler_params(ctx, func_name);
+    }
+
+    // Must match entrypoint naming patterns
+    if !is_entry_point_func(func_name, ctx.lang) {
+        return false;
+    }
+
+    // For named handlers (handle_*, route_*, api_*), check if they have web params.
+    // If we can't determine params (e.g. no summary), fall back to name-only heuristic
+    // for handler-style names (but NOT process_* or serve_* without params).
+    let has_params = has_web_handler_params(ctx, func_name);
+    let name_lower = func_name.to_ascii_lowercase();
+    let strong_handler_name = name_lower.starts_with("handle_")
+        || name_lower.starts_with("route_")
+        || name_lower.starts_with("api_")
+        || name_lower == "handler";
+
+    has_params || strong_handler_name
+}
+
+/// Find functions that qualify as web entrypoints.
+fn find_web_entry_point_functions(ctx: &AnalysisContext) -> Vec<String> {
+    let mut entry_funcs = Vec::new();
+    for idx in ctx.cfg.node_indices() {
+        if let Some(func_name) = &ctx.cfg[idx].enclosing_func
+            && is_web_entrypoint(ctx, func_name)
+            && !entry_funcs.contains(func_name)
+        {
+            entry_funcs.push(func_name.clone());
+        }
+    }
+    entry_funcs
+}
+
+/// Find all auth check nodes in the CFG.
+fn find_auth_nodes(ctx: &AnalysisContext) -> Vec<NodeIndex> {
+    ctx.cfg
+        .node_indices()
+        .filter(|&idx| is_auth_call(&ctx.cfg[idx], ctx.lang))
+        .collect()
+}
+
+impl CfgAnalysis for AuthGap {
+    fn name(&self) -> &'static str {
+        "auth-gap"
+    }
+
+    fn run(&self, ctx: &AnalysisContext) -> Vec<CfgFinding> {
+        let doms = dominators::compute_dominators(ctx.cfg, ctx.entry);
+        let entry_funcs = find_web_entry_point_functions(ctx);
+        let auth_nodes = find_auth_nodes(ctx);
+
+        if entry_funcs.is_empty() {
+            return Vec::new();
+        }
+
+        let mut findings = Vec::new();
+
+        // Find sink nodes that are inside web entry point functions
+        for idx in ctx.cfg.node_indices() {
+            let info = &ctx.cfg[idx];
+
+            if !is_sink(info) && info.kind != StmtKind::Call {
+                continue;
+            }
+
+            // Only check nodes inside web entry point functions
+            let func_name = match &info.enclosing_func {
+                Some(name) if entry_funcs.contains(name) => name.clone(),
+                _ => continue,
+            };
+
+            // Skip if not a sink
+            if !is_sink(info) {
+                continue;
+            }
+
+            // Only flag privileged sinks (shell, file I/O), not all sinks
+            if !is_privileged_sink(info) {
+                continue;
+            }
+
+            // Check: does any auth call dominate this sink?
+            let has_auth = auth_nodes
+                .iter()
+                .any(|&auth_idx| dominates(&doms, auth_idx, idx));
+
+            if !has_auth {
+                let callee_desc = info.callee.as_deref().unwrap_or("(sensitive op)");
+
+                findings.push(CfgFinding {
+                    rule_id: "cfg-auth-gap".to_string(),
+                    title: "Missing auth check".to_string(),
+                    severity: Severity::High,
+                    confidence: Confidence::Medium,
+                    span: info.span,
+                    message: format!(
+                        "Sensitive operation `{callee_desc}` in web handler `{func_name}` \
+                         has no dominating authentication check"
+                    ),
+                    evidence: vec![idx],
+                    score: None,
+                });
+            }
+        }
+
+        findings
+    }
+}

src/cfg_analysis/dominators.rs

@@ -0,0 +1,154 @@
+use crate::cfg::{Cfg, EdgeKind, NodeInfo, StmtKind};
+use crate::labels::DataLabel;
+use petgraph::algo::dominators::{Dominators, simple_fast};
+use petgraph::graph::NodeIndex;
+use petgraph::prelude::*;
+use petgraph::visit::Bfs;
+use std::collections::HashSet;
+
+/// Compute forward dominators from entry.
+pub fn compute_dominators(cfg: &Cfg, entry: NodeIndex) -> Dominators<NodeIndex> {
+    simple_fast(cfg, entry)
+}
+
+/// Compute post-dominators by reversing all edges and computing dominators from exit.
+/// Returns None if no Exit node exists.
+pub fn compute_post_dominators(cfg: &Cfg) -> Option<Dominators<NodeIndex>> {
+    let exit = find_exit_node(cfg)?;
+    let reversed = build_reversed_graph(cfg);
+    Some(simple_fast(&reversed, exit))
+}
+
+/// Reachable node set via BFS from entry.
+pub fn reachable_set(cfg: &Cfg, entry: NodeIndex) -> HashSet<NodeIndex> {
+    let mut set = HashSet::new();
+    let mut bfs = Bfs::new(cfg, entry);
+    while let Some(nx) = bfs.next(cfg) {
+        set.insert(nx);
+    }
+    set
+}
+
+/// Find the Exit node (StmtKind::Exit).
+pub fn find_exit_node(cfg: &Cfg) -> Option<NodeIndex> {
+    cfg.node_indices()
+        .find(|&idx| cfg[idx].kind == StmtKind::Exit)
+}
+
+/// Find all nodes that are sinks (have DataLabel::Sink).
+pub fn find_sink_nodes(cfg: &Cfg) -> Vec<NodeIndex> {
+    cfg.node_indices()
+        .filter(|&idx| matches!(cfg[idx].label, Some(DataLabel::Sink(_))))
+        .collect()
+}
+
+/// Check if `dominator` dominates `target` in the given dominator tree.
+pub fn dominates(doms: &Dominators<NodeIndex>, dominator: NodeIndex, target: NodeIndex) -> bool {
+    if dominator == target {
+        return true;
+    }
+    // Walk up the dominator tree from target
+    let mut current = target;
+    while let Some(idom) = doms.immediate_dominator(current) {
+        if idom == current {
+            // Reached root
+            break;
+        }
+        if idom == dominator {
+            return true;
+        }
+        current = idom;
+    }
+    false
+}
+
+/// Build a reversed copy of the graph (swap edge directions).
+fn build_reversed_graph(cfg: &Cfg) -> Graph<NodeInfo, EdgeKind> {
+    let mut rev = Graph::<NodeInfo, EdgeKind>::with_capacity(cfg.node_count(), cfg.edge_count());
+
+    // Clone nodes (preserving indices)
+    let mut index_map = Vec::with_capacity(cfg.node_count());
+    for idx in cfg.node_indices() {
+        let new_idx = rev.add_node(cfg[idx].clone());
+        index_map.push((idx, new_idx));
+    }
+
+    // Add edges in reverse direction
+    for edge in cfg.edge_references() {
+        let src = edge.source();
+        let tgt = edge.target();
+        // Find the new indices
+        let new_src = index_map
+            .iter()
+            .find(|(old, _)| *old == tgt)
+            .map(|(_, new)| *new)
+            .unwrap();
+        let new_tgt = index_map
+            .iter()
+            .find(|(old, _)| *old == src)
+            .map(|(_, new)| *new)
+            .unwrap();
+        rev.add_edge(new_src, new_tgt, *edge.weight());
+    }
+
+    rev
+}
+
+/// Find all nodes matching a specific callee name pattern.
+#[allow(dead_code)]
+pub fn find_call_nodes_matching(cfg: &Cfg, matchers: &[&str]) -> Vec<NodeIndex> {
+    cfg.node_indices()
+        .filter(|&idx| {
+            if cfg[idx].kind != StmtKind::Call {
+                return false;
+            }
+            if let Some(callee) = &cfg[idx].callee {
+                let callee_lower = callee.to_ascii_lowercase();
+                matchers.iter().any(|m| {
+                    let ml = m.to_ascii_lowercase();
+                    if ml.ends_with('_') {
+                        callee_lower.starts_with(&ml)
+                    } else {
+                        callee_lower.ends_with(&ml)
+                    }
+                })
+            } else {
+                false
+            }
+        })
+        .collect()
+}
+
+/// Check if there exists any path from `from` to `to` in the CFG.
+#[allow(dead_code)]
+pub fn has_path(cfg: &Cfg, from: NodeIndex, to: NodeIndex) -> bool {
+    let reachable = reachable_set(cfg, from);
+    reachable.contains(&to)
+}
+
+/// Compute shortest distance (in hops) from `from` to `to`.
+pub fn shortest_distance(cfg: &Cfg, from: NodeIndex, to: NodeIndex) -> Option<usize> {
+    use std::collections::VecDeque;
+
+    if from == to {
+        return Some(0);
+    }
+
+    let mut visited = HashSet::new();
+    let mut queue = VecDeque::new();
+    queue.push_back((from, 0usize));
+    visited.insert(from);
+
+    while let Some((node, dist)) = queue.pop_front() {
+        for succ in cfg.neighbors(node) {
+            if succ == to {
+                return Some(dist + 1);
+            }
+            if visited.insert(succ) {
+                queue.push_back((succ, dist + 1));
+            }
+        }
+    }
+
+    None
+}

src/cfg_analysis/error_handling.rs

@@ -0,0 +1,161 @@
+use super::{AnalysisContext, CfgAnalysis, CfgFinding, Confidence, is_sink};
+use crate::cfg::{EdgeKind, StmtKind};
+use crate::patterns::Severity;
+use petgraph::graph::NodeIndex;
+use petgraph::visit::EdgeRef;
+
+pub struct IncompleteErrorHandling;
+
+/// Check if the true branch of an If node terminates (has Return/Break/Continue).
+fn branch_terminates(cfg: &crate::cfg::Cfg, if_node: NodeIndex) -> bool {
+    // Follow the True edge from the If node
+    let true_successors: Vec<NodeIndex> = cfg
+        .edges(if_node)
+        .filter(|e| matches!(e.weight(), EdgeKind::True))
+        .map(|e| e.target())
+        .collect();
+
+    if true_successors.is_empty() {
+        return false;
+    }
+
+    // Check if any path through the true branch terminates
+    for &start in &true_successors {
+        if terminates_on_all_paths(cfg, start, if_node) {
+            return true;
+        }
+    }
+
+    false
+}
+
+/// Check if all paths from `node` reach a Return/Break/Continue before exiting scope.
+fn terminates_on_all_paths(
+    cfg: &crate::cfg::Cfg,
+    node: NodeIndex,
+    _scope_entry: NodeIndex,
+) -> bool {
+    use std::collections::HashSet;
+
+    let mut visited = HashSet::new();
+    let mut stack = vec![node];
+
+    while let Some(current) = stack.pop() {
+        if !visited.insert(current) {
+            continue;
+        }
+
+        let info = &cfg[current];
+        match info.kind {
+            StmtKind::Return | StmtKind::Break | StmtKind::Continue => {
+                // This path terminates
+                continue;
+            }
+            _ => {}
+        }
+
+        let successors: Vec<_> = cfg.neighbors(current).collect();
+        if successors.is_empty() {
+            // Reached a dead end without terminating — path does not terminate
+            return false;
+        }
+
+        for succ in successors {
+            // Don't follow back edges (loops)
+            let is_back_edge = cfg
+                .edges(current)
+                .any(|e| e.target() == succ && matches!(e.weight(), EdgeKind::Back));
+            if !is_back_edge {
+                stack.push(succ);
+            }
+        }
+    }
+
+    true
+}
+
+/// Find successor nodes after an If node merges (nodes reachable from both branches).
+fn find_post_if_sinks(cfg: &crate::cfg::Cfg, if_node: NodeIndex) -> Vec<NodeIndex> {
+    let mut sinks_after = Vec::new();
+
+    // Get all successors of the if node's merge point
+    // Walk through successors looking for sinks
+    let mut visited = std::collections::HashSet::new();
+    let mut stack: Vec<NodeIndex> = cfg.neighbors(if_node).collect();
+
+    while let Some(current) = stack.pop() {
+        if !visited.insert(current) {
+            continue;
+        }
+
+        let info = &cfg[current];
+        if is_sink(info) || (info.kind == StmtKind::Call && info.callee.is_some()) {
+            sinks_after.push(current);
+        }
+
+        for succ in cfg.neighbors(current) {
+            let is_back_edge = cfg
+                .edges(current)
+                .any(|e| e.target() == succ && matches!(e.weight(), EdgeKind::Back));
+            if !is_back_edge {
+                stack.push(succ);
+            }
+        }
+    }
+
+    sinks_after
+}
+
+impl CfgAnalysis for IncompleteErrorHandling {
+    fn name(&self) -> &'static str {
+        "incomplete-error-handling"
+    }
+
+    fn run(&self, ctx: &AnalysisContext) -> Vec<CfgFinding> {
+        let mut findings = Vec::new();
+
+        for idx in ctx.cfg.node_indices() {
+            let info = &ctx.cfg[idx];
+
+            // Look for If nodes whose condition involves "err" or "error"
+            if info.kind != StmtKind::If {
+                continue;
+            }
+
+            let mentions_err = info.uses.iter().any(|u| {
+                let lower = u.to_ascii_lowercase();
+                lower == "err" || lower == "error" || lower.contains("err")
+            });
+
+            if !mentions_err {
+                continue;
+            }
+
+            // Check: does the true branch terminate?
+            if branch_terminates(ctx.cfg, idx) {
+                continue;
+            }
+
+            // Check: are there dangerous calls/sinks after this error check?
+            let post_sinks = find_post_if_sinks(ctx.cfg, idx);
+            let has_dangerous_successor = post_sinks.iter().any(|&s| is_sink(&ctx.cfg[s]));
+
+            if has_dangerous_successor {
+                findings.push(CfgFinding {
+                    rule_id: "cfg-error-fallthrough".to_string(),
+                    title: "Error check without return".to_string(),
+                    severity: Severity::Medium,
+                    confidence: Confidence::Medium,
+                    span: info.span,
+                    message: "Error check does not terminate on error; \
+                              execution falls through to dangerous operations"
+                        .to_string(),
+                    evidence: vec![idx],
+                    score: None,
+                });
+            }
+        }
+
+        findings
+    }
+}

src/cfg_analysis/guards.rs

@@ -0,0 +1,208 @@
+use super::dominators::{self, dominates};
+use super::rules;
+use super::{AnalysisContext, CfgAnalysis, CfgFinding, Confidence, is_entry_point_func};
+use crate::cfg::StmtKind;
+use crate::labels::{Cap, DataLabel};
+use crate::patterns::Severity;
+use petgraph::graph::NodeIndex;
+
+pub struct UnguardedSink;
+
+/// Find all nodes in the CFG that are calls to guard functions.
+fn find_guard_nodes(ctx: &AnalysisContext) -> Vec<(NodeIndex, Cap)> {
+    let guard_rules = rules::guard_rules(ctx.lang);
+    let mut result = Vec::new();
+
+    for idx in ctx.cfg.node_indices() {
+        let info = &ctx.cfg[idx];
+        if info.kind != StmtKind::Call {
+            continue;
+        }
+        if let Some(callee) = &info.callee {
+            let callee_lower = callee.to_ascii_lowercase();
+            for rule in guard_rules {
+                let matched = rule.matchers.iter().any(|m| {
+                    let ml = m.to_ascii_lowercase();
+                    if ml.ends_with('_') {
+                        callee_lower.starts_with(&ml)
+                    } else {
+                        callee_lower.ends_with(&ml)
+                    }
+                });
+                if matched {
+                    result.push((idx, rule.applies_to_sink_caps));
+                    break;
+                }
+            }
+        }
+    }
+
+    result
+}
+
+/// Check whether taint analysis confirmed unsanitized flow to this sink node.
+fn taint_confirms_sink(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
+    ctx.taint_findings.iter().any(|f| f.sink == sink)
+}
+
+/// Check whether any variable used by the sink is directly derived from a
+/// Source node in the same function (via simple def-use chain).
+fn sink_arg_is_source_derived(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
+    let sink_info = &ctx.cfg[sink];
+    let sink_func = sink_info.enclosing_func.as_deref();
+
+    // Collect all variables the sink reads
+    let sink_uses = &sink_info.uses;
+    if sink_uses.is_empty() {
+        return false;
+    }
+
+    // Walk all nodes in the same function looking for Source nodes that define
+    // one of the variables the sink uses.
+    for idx in ctx.cfg.node_indices() {
+        let info = &ctx.cfg[idx];
+        if info.enclosing_func.as_deref() != sink_func {
+            continue;
+        }
+        if !matches!(info.label, Some(DataLabel::Source(_))) {
+            continue;
+        }
+        // Source node defines a variable that the sink reads → source-derived
+        if let Some(def) = &info.defines
+            && sink_uses.iter().any(|u| u == def)
+        {
+            return true;
+        }
+    }
+    false
+}
+
+/// Check whether the sink's arguments are *only* function parameters
+/// (i.e. this function is a thin wrapper around the sink).
+fn sink_arg_is_parameter_only(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
+    let sink_info = &ctx.cfg[sink];
+    let sink_func = sink_info.enclosing_func.as_deref();
+
+    let sink_uses = &sink_info.uses;
+    if sink_uses.is_empty() {
+        // No identifiable arguments — could be a constant call like Command::new("ls")
+        return true; // treat as non-dangerous (constant arg)
+    }
+
+    // Collect parameter names for the enclosing function from FuncSummaries
+    let param_names: Vec<&str> = ctx
+        .func_summaries
+        .values()
+        .filter(|s| {
+            // Match by function entry being in the same function
+            ctx.cfg[s.entry].enclosing_func.as_deref() == sink_func
+        })
+        .flat_map(|s| s.param_names.iter().map(|p| p.as_str()))
+        .collect();
+
+    if param_names.is_empty() {
+        return false; // can't determine params
+    }
+
+    // Check if ALL sink uses are parameters
+    sink_uses.iter().all(|u| param_names.contains(&u.as_str()))
+}
+
+/// Check if the enclosing function qualifies as an entrypoint.
+fn sink_in_entrypoint(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
+    let sink_info = &ctx.cfg[sink];
+    if let Some(func_name) = &sink_info.enclosing_func {
+        is_entry_point_func(func_name, ctx.lang)
+    } else {
+        false
+    }
+}
+
+impl CfgAnalysis for UnguardedSink {
+    fn name(&self) -> &'static str {
+        "unguarded-sink"
+    }
+
+    fn run(&self, ctx: &AnalysisContext) -> Vec<CfgFinding> {
+        let doms = dominators::compute_dominators(ctx.cfg, ctx.entry);
+        let sink_nodes = dominators::find_sink_nodes(ctx.cfg);
+        let guard_nodes = find_guard_nodes(ctx);
+
+        let mut findings = Vec::new();
+
+        for sink in &sink_nodes {
+            let sink_info = &ctx.cfg[*sink];
+            let sink_caps = match sink_info.label {
+                Some(DataLabel::Sink(caps)) => caps,
+                _ => continue,
+            };
+
+            let sink_func = sink_info.enclosing_func.as_deref();
+
+            // Check: does any applicable guard dominate this sink?
+            // Guards must be in the same function to be relevant.
+            let is_guarded = guard_nodes.iter().any(|(guard_idx, guard_caps)| {
+                let guard_func = ctx.cfg[*guard_idx].enclosing_func.as_deref();
+                (*guard_caps & sink_caps) != Cap::empty()
+                    && guard_func == sink_func
+                    && dominates(&doms, *guard_idx, *sink)
+            });
+
+            // Also check if an inline sanitizer dominates this sink (same function).
+            let has_sanitizer = ctx.cfg.node_indices().any(|idx| {
+                let node_func = ctx.cfg[idx].enclosing_func.as_deref();
+                if let Some(DataLabel::Sanitizer(san_caps)) = ctx.cfg[idx].label {
+                    (san_caps & sink_caps) != Cap::empty()
+                        && node_func == sink_func
+                        && dominates(&doms, idx, *sink)
+                } else {
+                    false
+                }
+            });
+
+            if is_guarded || has_sanitizer {
+                continue;
+            }
+
+            let callee_desc = sink_info.callee.as_deref().unwrap_or("(unknown sink)");
+
+            // ── Severity classification ───────────────────────────────
+            //
+            // HIGH: taint confirms flow OR source directly feeds sink
+            // MEDIUM: structural finding without taint confirmation
+            // LOW: wrapper function (param-only, non-entrypoint)
+
+            let has_taint = taint_confirms_sink(ctx, *sink);
+            let source_derived = sink_arg_is_source_derived(ctx, *sink);
+            let param_only = sink_arg_is_parameter_only(ctx, *sink);
+            let in_entrypoint = sink_in_entrypoint(ctx, *sink);
+
+            let (severity, confidence) = if has_taint || source_derived {
+                // Taint-confirmed or directly source-derived → HIGH
+                (Severity::High, Confidence::High)
+            } else if param_only && !in_entrypoint {
+                // Wrapper function consuming only parameters → LOW
+                (Severity::Low, Confidence::Low)
+            } else if in_entrypoint && !param_only {
+                // Entrypoint with non-parameter args but no taint confirmation → MEDIUM
+                (Severity::Medium, Confidence::Medium)
+            } else {
+                // Generic structural finding → MEDIUM
+                (Severity::Medium, Confidence::Medium)
+            };
+
+            findings.push(CfgFinding {
+                rule_id: "cfg-unguarded-sink".to_string(),
+                title: "Unguarded sink".to_string(),
+                severity,
+                confidence,
+                span: sink_info.span,
+                message: format!("Sink `{callee_desc}` has no dominating guard or sanitizer"),
+                evidence: vec![*sink],
+                score: None,
+            });
+        }
+
+        findings
+    }
+}

src/cfg_analysis/mod.rs

@@ -0,0 +1,170 @@
+pub mod auth;
+pub mod dominators;
+pub mod error_handling;
+pub mod guards;
+pub mod resources;
+pub mod rules;
+pub mod scoring;
+#[cfg(test)]
+mod tests;
+pub mod unreachable;
+
+use crate::cfg::{FuncSummaries, NodeInfo, StmtKind};
+use crate::labels::DataLabel;
+use crate::patterns::Severity;
+use crate::summary::GlobalSummaries;
+use crate::symbol::Lang;
+use crate::taint;
+use petgraph::graph::NodeIndex;
+use std::collections::HashSet;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Confidence {
+    Low,
+    Medium,
+    High,
+}
+
+#[derive(Debug, Clone)]
+pub struct CfgFinding {
+    pub rule_id: String,
+    #[allow(dead_code)]
+    pub title: String,
+    pub severity: Severity,
+    pub confidence: Confidence,
+    pub span: (usize, usize),
+    #[allow(dead_code)]
+    pub message: String,
+    pub evidence: Vec<NodeIndex>,
+    pub score: Option<f64>,
+}
+
+pub struct AnalysisContext<'a> {
+    pub cfg: &'a crate::cfg::Cfg,
+    pub entry: NodeIndex,
+    pub lang: Lang,
+    #[allow(dead_code)]
+    pub file_path: &'a str,
+    #[allow(dead_code)]
+    pub source_bytes: &'a [u8],
+    pub func_summaries: &'a FuncSummaries,
+    #[allow(dead_code)]
+    pub global_summaries: Option<&'a GlobalSummaries>,
+    pub taint_findings: &'a [taint::Finding],
+}
+
+pub trait CfgAnalysis {
+    #[allow(dead_code)]
+    fn name(&self) -> &'static str;
+    fn run(&self, ctx: &AnalysisContext) -> Vec<CfgFinding>;
+}
+
+/// Run all registered analyses and return merged findings.
+pub fn run_all(ctx: &AnalysisContext) -> Vec<CfgFinding> {
+    let analyses: Vec<Box<dyn CfgAnalysis>> = vec![
+        Box::new(unreachable::UnreachableCode),
+        Box::new(guards::UnguardedSink),
+        Box::new(auth::AuthGap),
+        Box::new(error_handling::IncompleteErrorHandling),
+        Box::new(resources::ResourceMisuse),
+    ];
+    let mut findings: Vec<CfgFinding> = analyses.iter().flat_map(|a| a.run(ctx)).collect();
+
+    // ── Dedup: suppress cfg-unguarded-sink when taint already covers the span ──
+    // Collect spans where taint findings exist (sink byte offset).
+    let taint_spans: HashSet<(usize, usize)> = ctx
+        .taint_findings
+        .iter()
+        .map(|f| ctx.cfg[f.sink].span)
+        .collect();
+
+    findings.retain(|f| {
+        // If both taint and cfg-unguarded-sink fire on the same span,
+        // suppress the structural CFG finding (taint is the primary signal).
+        if f.rule_id == "cfg-unguarded-sink" && taint_spans.contains(&f.span) {
+            return false;
+        }
+        true
+    });
+
+    scoring::score_findings(&mut findings, ctx);
+    findings.sort_by(|a, b| {
+        b.score
+            .partial_cmp(&a.score)
+            .unwrap_or(std::cmp::Ordering::Equal)
+    });
+    findings
+}
+
+/// Helper: check whether a node is a guard call (validate, sanitize, check, etc.).
+pub(crate) fn is_guard_call(info: &NodeInfo, lang: Lang) -> bool {
+    if info.kind != StmtKind::Call {
+        return false;
+    }
+    if let Some(callee) = &info.callee {
+        let guard_rules = rules::guard_rules(lang);
+        let callee_lower = callee.to_ascii_lowercase();
+        for rule in guard_rules {
+            for &m in rule.matchers {
+                let ml = m.to_ascii_lowercase();
+                if ml.ends_with('_') {
+                    if callee_lower.starts_with(&ml) {
+                        return true;
+                    }
+                } else if callee_lower.ends_with(&ml) {
+                    return true;
+                }
+            }
+        }
+    }
+    false
+}
+
+/// Helper: check whether a node is an auth check call.
+pub(crate) fn is_auth_call(info: &NodeInfo, lang: Lang) -> bool {
+    if info.kind != StmtKind::Call {
+        return false;
+    }
+    if let Some(callee) = &info.callee {
+        let auth_rules = rules::auth_rules(lang);
+        let callee_lower = callee.to_ascii_lowercase();
+        for rule in auth_rules {
+            for &m in rule.matchers {
+                let ml = m.to_ascii_lowercase();
+                if ml.ends_with('_') {
+                    if callee_lower.starts_with(&ml) {
+                        return true;
+                    }
+                } else if callee_lower.ends_with(&ml) {
+                    return true;
+                }
+            }
+        }
+    }
+    false
+}
+
+/// Helper: check if a function name looks like an entry point (HTTP handler, main, etc.).
+pub(crate) fn is_entry_point_func(func_name: &str, lang: Lang) -> bool {
+    let ep_rules = rules::entry_point_rules(lang);
+    let name_lower = func_name.to_ascii_lowercase();
+    for rule in ep_rules {
+        for &m in rule.matchers {
+            let ml = m.to_ascii_lowercase();
+            if ml.ends_with('*') {
+                let prefix = &ml[..ml.len() - 1];
+                if name_lower.starts_with(prefix) {
+                    return true;
+                }
+            } else if name_lower == ml {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+/// Helper: check if a node is a sink.
+pub(crate) fn is_sink(info: &NodeInfo) -> bool {
+    matches!(info.label, Some(DataLabel::Sink(_)))
+}

src/cfg_analysis/resources.rs

@@ -0,0 +1,163 @@
+use super::dominators;
+use super::rules;
+use super::{AnalysisContext, CfgAnalysis, CfgFinding, Confidence};
+use crate::cfg::StmtKind;
+use crate::patterns::Severity;
+use petgraph::graph::NodeIndex;
+use std::collections::HashSet;
+
+pub struct ResourceMisuse;
+
+/// Find nodes matching acquire patterns for a given resource pair.
+fn find_acquire_nodes(ctx: &AnalysisContext, acquire_patterns: &[&str]) -> Vec<NodeIndex> {
+    ctx.cfg
+        .node_indices()
+        .filter(|&idx| {
+            let info = &ctx.cfg[idx];
+            if info.kind != StmtKind::Call {
+                return false;
+            }
+            if let Some(callee) = &info.callee {
+                let callee_lower = callee.to_ascii_lowercase();
+                acquire_patterns.iter().any(|p| {
+                    let pl = p.to_ascii_lowercase();
+                    callee_lower.ends_with(&pl) || callee_lower == pl
+                })
+            } else {
+                false
+            }
+        })
+        .collect()
+}
+
+/// Find nodes matching release patterns for a given resource pair.
+fn find_release_nodes(ctx: &AnalysisContext, release_patterns: &[&str]) -> Vec<NodeIndex> {
+    ctx.cfg
+        .node_indices()
+        .filter(|&idx| {
+            let info = &ctx.cfg[idx];
+            if info.kind != StmtKind::Call {
+                return false;
+            }
+            if let Some(callee) = &info.callee {
+                let callee_lower = callee.to_ascii_lowercase();
+                release_patterns.iter().any(|p| {
+                    let pl = p.to_ascii_lowercase();
+                    callee_lower.ends_with(&pl) || callee_lower == pl
+                })
+            } else {
+                false
+            }
+        })
+        .collect()
+}
+
+/// Check if a release node is on all paths from acquire to every exit.
+fn release_on_all_exit_paths(
+    ctx: &AnalysisContext,
+    acquire: NodeIndex,
+    release_nodes: &[NodeIndex],
+    exit: NodeIndex,
+) -> bool {
+    // Use post-dominators as optimization: if any release post-dominates acquire, it's fine
+    if let Some(post_doms) = dominators::compute_post_dominators(ctx.cfg) {
+        for &release in release_nodes {
+            if dominators::dominates(&post_doms, release, acquire) {
+                return true;
+            }
+        }
+    }
+
+    // Fall back to path enumeration via DFS
+    // Check if all paths from acquire to exit pass through a release
+    let release_set: HashSet<_> = release_nodes.iter().copied().collect();
+    all_paths_pass_through(ctx, acquire, exit, &release_set)
+}
+
+/// Check if all paths from `from` to `to` pass through at least one node in `through`.
+fn all_paths_pass_through(
+    ctx: &AnalysisContext,
+    from: NodeIndex,
+    to: NodeIndex,
+    through: &HashSet<NodeIndex>,
+) -> bool {
+    use std::collections::VecDeque;
+
+    if through.contains(&from) {
+        return true;
+    }
+
+    // BFS, tracking whether we've passed through a required node
+    let mut visited = HashSet::new();
+    let mut queue = VecDeque::new();
+    queue.push_back((from, false));
+    visited.insert((from, false));
+
+    while let Some((node, passed)) = queue.pop_front() {
+        if node == to {
+            if !passed {
+                return false; // Found a path to exit without passing through release
+            }
+            continue;
+        }
+
+        for succ in ctx.cfg.neighbors(node) {
+            let new_passed = passed || through.contains(&succ);
+            let state = (succ, new_passed);
+            if visited.insert(state) {
+                queue.push_back(state);
+            }
+        }
+    }
+
+    true
+}
+
+impl CfgAnalysis for ResourceMisuse {
+    fn name(&self) -> &'static str {
+        "resource-misuse"
+    }
+
+    fn run(&self, ctx: &AnalysisContext) -> Vec<CfgFinding> {
+        let pairs = rules::resource_pairs(ctx.lang);
+        let exit = match dominators::find_exit_node(ctx.cfg) {
+            Some(e) => e,
+            None => return Vec::new(),
+        };
+
+        let mut findings = Vec::new();
+
+        for pair in pairs {
+            let acquire_nodes = find_acquire_nodes(ctx, pair.acquire);
+            let release_nodes = find_release_nodes(ctx, pair.release);
+
+            for &acquire in &acquire_nodes {
+                if !release_on_all_exit_paths(ctx, acquire, &release_nodes, exit) {
+                    let info = &ctx.cfg[acquire];
+                    let callee_desc = info.callee.as_deref().unwrap_or("(acquire)");
+
+                    findings.push(CfgFinding {
+                        rule_id: if pair.resource_name == "mutex" {
+                            "cfg-lock-not-released".to_string()
+                        } else {
+                            "cfg-resource-leak".to_string()
+                        },
+                        title: format!("{} may leak", pair.resource_name),
+                        severity: Severity::Medium,
+                        confidence: Confidence::Medium,
+                        span: info.span,
+                        message: format!(
+                            "`{callee_desc}` acquires {} but not all exit paths \
+                             release it",
+                            pair.resource_name
+                        ),
+                        evidence: vec![acquire],
+                        score: None,
+                    });
+                }
+            }
+        }
+
+        findings
+    }
+}

src/cfg_analysis/rules.rs

@@ -0,0 +1,234 @@
+use crate::labels::Cap;
+use crate::symbol::Lang;
+
+/// A guard rule: functions that must dominate sinks to ensure safety.
+pub struct GuardRule {
+    pub matchers: &'static [&'static str],
+    pub applies_to_sink_caps: Cap,
+}
+
+/// An auth rule: functions that perform authentication/authorization checks.
+pub struct AuthRule {
+    pub matchers: &'static [&'static str],
+}
+
+/// An entry point rule: functions that serve as external-facing entry points.
+pub struct EntryPointRule {
+    pub matchers: &'static [&'static str],
+}
+
+/// A resource acquire/release pair.
+pub struct ResourcePair {
+    pub acquire: &'static [&'static str],
+    pub release: &'static [&'static str],
+    pub resource_name: &'static str,
+}
+
+// ── Guard rules ─────────────────────────────────────────────────────────
+
+static COMMON_GUARDS: &[GuardRule] = &[
+    GuardRule {
+        matchers: &["validate", "sanitize"],
+        applies_to_sink_caps: Cap::all(),
+    },
+    GuardRule {
+        matchers: &["check_", "verify_", "assert_"],
+        applies_to_sink_caps: Cap::all(),
+    },
+    GuardRule {
+        matchers: &["shell_escape", "quote", "escape_shell"],
+        applies_to_sink_caps: Cap::SHELL_ESCAPE,
+    },
+    GuardRule {
+        matchers: &["html_escape", "encode_safe", "escape_html", "sanitize_html"],
+        applies_to_sink_caps: Cap::HTML_ESCAPE,
+    },
+    GuardRule {
+        matchers: &["url_encode", "encode_uri", "urlencode"],
+        applies_to_sink_caps: Cap::URL_ENCODE,
+    },
+];
+
+pub fn guard_rules(_lang: Lang) -> &'static [GuardRule] {
+    // All languages share the common set for now; per-language
+    // overrides can be added via match arms when needed.
+    COMMON_GUARDS
+}
+
+// ── Auth rules ──────────────────────────────────────────────────────────
+
+static COMMON_AUTH: &[AuthRule] = &[AuthRule {
+    matchers: &[
+        "is_authenticated",
+        "require_auth",
+        "check_permission",
+        "is_admin",
+        "authorize",
+        "authenticate",
+        "require_login",
+        "check_auth",
+        "verify_token",
+        "validate_token",
+    ],
+}];
+
+static GO_AUTH: &[AuthRule] = &[AuthRule {
+    matchers: &[
+        "is_authenticated",
+        "require_auth",
+        "check_permission",
+        "is_admin",
+        "authorize",
+        "authenticate",
+        "require_login",
+        "check_auth",
+        "verify_token",
+        "validate_token",
+        "middleware.auth",
+        "auth.required",
+    ],
+}];
+
+static JAVA_AUTH: &[AuthRule] = &[AuthRule {
+    matchers: &[
+        "is_authenticated",
+        "require_auth",
+        "check_permission",
+        "is_admin",
+        "authorize",
+        "authenticate",
+        "require_login",
+        "check_auth",
+        "verify_token",
+        "validate_token",
+        "isAuthenticated",
+        "checkPermission",
+        "hasAuthority",
+        "hasRole",
+    ],
+}];
+
+pub fn auth_rules(lang: Lang) -> &'static [AuthRule] {
+    match lang {
+        Lang::Go => GO_AUTH,
+        Lang::Java => JAVA_AUTH,
+        _ => COMMON_AUTH,
+    }
+}
+
+// ── Entry point rules ───────────────────────────────────────────────────
+
+static COMMON_ENTRY_POINTS: &[EntryPointRule] = &[EntryPointRule {
+    matchers: &[
+        "main",
+        "handle_*",
+        "route_*",
+        "api_*",
+        "serve_*",
+        "process_*",
+    ],
+}];
+
+static GO_ENTRY_POINTS: &[EntryPointRule] = &[EntryPointRule {
+    matchers: &[
+        "main",
+        "handle_*",
+        "handler_*",
+        "route_*",
+        "api_*",
+        "serve_*",
+        "process_*",
+        "ServeHTTP",
+    ],
+}];
+
+static PYTHON_ENTRY_POINTS: &[EntryPointRule] = &[EntryPointRule {
+    matchers: &[
+        "main",
+        "handle_*",
+        "route_*",
+        "api_*",
+        "serve_*",
+        "process_*",
+        "view_*",
+    ],
+}];
+
+pub fn entry_point_rules(lang: Lang) -> &'static [EntryPointRule] {
+    match lang {
+        Lang::Go => GO_ENTRY_POINTS,
+        Lang::Python => PYTHON_ENTRY_POINTS,
+        _ => COMMON_ENTRY_POINTS,
+    }
+}
+
+// ── Resource pairs ──────────────────────────────────────────────────────
+
+static C_RESOURCES: &[ResourcePair] = &[
+    ResourcePair {
+        acquire: &["malloc", "calloc", "realloc"],
+        release: &["free"],
+        resource_name: "memory",
+    },
+    ResourcePair {
+        acquire: &["fopen"],
+        release: &["fclose"],
+        resource_name: "file handle",
+    },
+    ResourcePair {
+        acquire: &["open"],
+        release: &["close"],
+        resource_name: "file descriptor",
+    },
+    ResourcePair {
+        acquire: &["pthread_mutex_lock"],
+        release: &["pthread_mutex_unlock"],
+        resource_name: "mutex",
+    },
+];
+
+static GO_RESOURCES: &[ResourcePair] = &[
+    ResourcePair {
+        acquire: &["os.Open", "os.Create", "os.OpenFile"],
+        release: &[".Close"],
+        resource_name: "file handle",
+    },
+    ResourcePair {
+        acquire: &[".Lock"],
+        release: &[".Unlock"],
+        resource_name: "mutex",
+    },
+];
+
+static RUST_RESOURCES: &[ResourcePair] = &[
+    // Rust uses RAII, but unsafe alloc/dealloc is a pattern
+    ResourcePair {
+        acquire: &["alloc"],
+        release: &["dealloc"],
+        resource_name: "raw memory",
+    },
+];
+
+static JAVA_RESOURCES: &[ResourcePair] = &[ResourcePair {
+    acquire: &[
+        "new FileInputStream",
+        "new FileOutputStream",
+        "new BufferedReader",
+        "openConnection",
+    ],
+    release: &[".close"],
+    resource_name: "stream/connection",
+}];
+
+static EMPTY_RESOURCES: &[ResourcePair] = &[];
+
+pub fn resource_pairs(lang: Lang) -> &'static [ResourcePair] {
+    match lang {
+        Lang::C => C_RESOURCES,
+        Lang::Cpp => C_RESOURCES,
+        Lang::Go => GO_RESOURCES,
+        Lang::Rust => RUST_RESOURCES,
+        Lang::Java => JAVA_RESOURCES,
+        _ => EMPTY_RESOURCES,
+    }
+}

src/cfg_analysis/scoring.rs

@@ -0,0 +1,67 @@
+use super::dominators;
+use super::{AnalysisContext, CfgFinding, Confidence};
+use crate::cfg::StmtKind;
+use crate::patterns::Severity;
+
+/// Enrich all findings with a numeric score for ranking.
+pub fn score_findings(findings: &mut [CfgFinding], ctx: &AnalysisContext) {
+    for f in findings.iter_mut() {
+        let mut score = 0.0;
+
+        // Base severity
+        score += severity_base(f.severity);
+
+        // Distance from entry (fewer hops = more exposed = higher risk)
+        let finding_node = f.evidence.first().copied();
+        if let Some(node) = finding_node
+            && let Some(dist) = dominators::shortest_distance(ctx.cfg, ctx.entry, node)
+        {
+            score += 20.0 / (1.0 + dist as f64);
+        }
+
+        // Branch complexity on path (more branches = more likely to miss a case)
+        let branches = count_branches_on_evidence(&f.evidence, ctx);
+        score += (branches as f64).min(10.0);
+
+        // Taint-confirmed unguarded sinks get a boost (already HIGH, but
+        // reinforce that they sort above structural-only findings).
+        if f.rule_id == "cfg-unguarded-sink" && f.severity == Severity::High {
+            score += 10.0;
+        }
+        // Auth-gap in a confirmed web handler gets a moderate boost.
+        if f.rule_id == "cfg-auth-gap" {
+            score += 5.0;
+        }
+
+        // Confidence multiplier
+        score *= confidence_multiplier(f.confidence);
+
+        f.score = Some(score);
+    }
+}
+
+fn severity_base(severity: Severity) -> f64 {
+    match severity {
+        Severity::High => 80.0,
+        Severity::Medium => 50.0,
+        Severity::Low => 20.0,
+    }
+}
+
+fn confidence_multiplier(confidence: Confidence) -> f64 {
+    match confidence {
+        Confidence::High => 1.0,
+        Confidence::Medium => 0.8,
+        Confidence::Low => 0.6,
+    }
+}
+
+fn count_branches_on_evidence(
+    evidence: &[petgraph::graph::NodeIndex],
+    ctx: &AnalysisContext,
+) -> usize {
+    evidence
+        .iter()
+        .filter(|&&idx| ctx.cfg[idx].kind == StmtKind::If)
+        .count()
+}

src/cfg_analysis/tests.rs

@@ -0,0 +1,721 @@
+use super::*;
+use crate::cfg::build_cfg;
+use crate::symbol::Lang;
+use crate::taint;
+use tree_sitter::Language;
+
+/// Test helper: parse code, build CFG, run a specific analysis.
+fn parse_and_analyse<A: CfgAnalysis>(
+    analysis: &A,
+    src: &[u8],
+    lang_str: &str,
+    ts_lang: Language,
+) -> Vec<CfgFinding> {
+    let mut parser = tree_sitter::Parser::new();
+    parser.set_language(&ts_lang).unwrap();
+    let tree = parser.parse(src, None).unwrap();
+    let (cfg, entry, summaries) = build_cfg(&tree, src, lang_str, "test.rs");
+    let lang = Lang::from_slug(lang_str).unwrap();
+    let ctx = AnalysisContext {
+        cfg: &cfg,
+        entry,
+        lang,
+        file_path: "test.rs",
+        source_bytes: src,
+        func_summaries: &summaries,
+        global_summaries: None,
+        taint_findings: &[],
+    };
+    analysis.run(&ctx)
+}
+
+/// Test helper: parse code, build CFG, run all analyses.
+fn parse_and_run_all(src: &[u8], lang_str: &str, ts_lang: Language) -> Vec<CfgFinding> {
+    let mut parser = tree_sitter::Parser::new();
+    parser.set_language(&ts_lang).unwrap();
+    let tree = parser.parse(src, None).unwrap();
+    let (cfg, entry, summaries) = build_cfg(&tree, src, lang_str, "test.rs");
+    let lang = Lang::from_slug(lang_str).unwrap();
+    let ctx = AnalysisContext {
+        cfg: &cfg,
+        entry,
+        lang,
+        file_path: "test.rs",
+        source_bytes: src,
+        func_summaries: &summaries,
+        global_summaries: None,
+        taint_findings: &[],
+    };
+    run_all(&ctx)
+}
+
+/// Test helper: parse code, build CFG, run all analyses with custom taint findings.
+fn parse_and_run_all_with_taint(
+    src: &[u8],
+    lang_str: &str,
+    ts_lang: Language,
+    taint_findings: &[taint::Finding],
+) -> Vec<CfgFinding> {
+    let mut parser = tree_sitter::Parser::new();
+    parser.set_language(&ts_lang).unwrap();
+    let tree = parser.parse(src, None).unwrap();
+    let (cfg, entry, summaries) = build_cfg(&tree, src, lang_str, "test.rs");
+    let lang = Lang::from_slug(lang_str).unwrap();
+    let ctx = AnalysisContext {
+        cfg: &cfg,
+        entry,
+        lang,
+        file_path: "test.rs",
+        source_bytes: src,
+        func_summaries: &summaries,
+        global_summaries: None,
+        taint_findings,
+    };
+    run_all(&ctx)
+}
+
+// ─── Unreachable code tests ────────────────────────────────────────────
+
+#[test]
+fn unreachable_code_detection_runs_without_panic() {
+    // Verify the unreachable code analysis runs correctly on code with a return.
+    // After `return`, tree-sitter may or may not produce AST nodes for
+    // subsequent statements depending on the language grammar.
+    let src = br#"
+        use std::process::Command;
+        fn main() {
+            return;
+            Command::new("sh").arg("x").status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &unreachable::UnreachableCode,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    // The analysis should run without panicking. Whether it finds
+    // unreachable nodes depends on how tree-sitter structures the AST
+    // after `return;`.
+    let _ = findings;
+}
+
+#[test]
+fn all_branches_reachable_no_findings() {
+    // All branches reachable — no unreachable-code findings
+    let src = br#"
+        use std::process::Command;
+        fn main() {
+            let x = 1;
+            if x > 0 {
+                Command::new("a").status().unwrap();
+            } else {
+                Command::new("b").status().unwrap();
+            }
+        }"#;
+
+    let findings = parse_and_analyse(
+        &unreachable::UnreachableCode,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    assert!(
+        findings.is_empty(),
+        "Should have no unreachable findings when all branches are reachable"
+    );
+}
+
+#[test]
+fn unreachable_detects_orphaned_nodes() {
+    // Directly verify that if we have orphaned sink/guard nodes in the CFG,
+    // they get reported. We test this through the reachability check on
+    // the CFG built from real code.
+    let src = br#"
+        fn main() {
+            let x = 1;
+            let y = 2;
+        }"#;
+
+    let mut parser = tree_sitter::Parser::new();
+    parser
+        .set_language(&Language::from(tree_sitter_rust::LANGUAGE))
+        .unwrap();
+    let tree = parser.parse(src as &[u8], None).unwrap();
+    let (cfg, entry, _) = build_cfg(&tree, src, "rust", "test.rs");
+
+    // All nodes in linear code should be reachable
+    let reachable = dominators::reachable_set(&cfg, entry);
+    assert_eq!(
+        reachable.len(),
+        cfg.node_count(),
+        "All nodes should be reachable in linear code — no unreachable findings expected"
+    );
+}
+
+// ─── Guard validation tests ───────────────────────────────────────────
+
+#[test]
+fn unguarded_sink_detected() {
+    // Sink with no validation — should be flagged
+    let src = br#"
+        use std::process::Command;
+        fn main() {
+            let x = std::env::var("INPUT").unwrap();
+            Command::new("sh").arg(&x).status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &guards::UnguardedSink,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let guard_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-unguarded-sink")
+        .collect();
+    assert!(!guard_findings.is_empty(), "Should flag unguarded sink");
+}
+
+#[test]
+fn guarded_sink_with_sanitizer_not_flagged() {
+    // Sink with a sanitizer (shell_escape::unix::escape) before it.
+    // The label rules in labels/rust.rs recognise this as a Sanitizer(SHELL_ESCAPE),
+    // and the dominator check should suppress the "unguarded sink" finding.
+    let src = br#"
+        use std::process::Command;
+        fn main() {
+            let x = std::env::var("INPUT").unwrap();
+            let safe = shell_escape::unix::escape(&x);
+            Command::new("sh").arg(&safe).status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &guards::UnguardedSink,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let guard_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-unguarded-sink")
+        .collect();
+    assert!(
+        guard_findings.is_empty(),
+        "Guarded sink should not be flagged; got {:?}",
+        guard_findings
+    );
+}
+
+// ─── Auth gap tests ────────────────────────────────────────────────────
+
+#[test]
+fn auth_gap_in_handler_detected() {
+    // Handler function with a sink but no auth check
+    let src = br#"
+        use std::process::Command;
+        fn handle_request() {
+            let data = std::env::var("INPUT").unwrap();
+            Command::new("sh").arg(&data).status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &auth::AuthGap,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let auth_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-auth-gap")
+        .collect();
+    assert!(
+        !auth_findings.is_empty(),
+        "Should detect auth gap in handler function"
+    );
+}
+
+#[test]
+fn auth_check_before_sink_no_finding() {
+    // Handler with auth check before sink
+    let src = br#"
+        fn handle_request() {
+            require_auth();
+            let data = std::env::var("INPUT").unwrap();
+            std::process::Command::new("sh").arg(&data).status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &auth::AuthGap,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let auth_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-auth-gap")
+        .collect();
+    assert!(
+        auth_findings.is_empty(),
+        "Auth check before sink should not be flagged; got {:?}",
+        auth_findings
+    );
+}
+
+// ─── Error handling tests ──────────────────────────────────────────────
+
+#[test]
+fn error_fallthrough_analysis_runs_on_go() {
+    // Go pattern: err check without return, followed by dangerous call.
+    // This is a heuristic analysis — we verify it runs without panicking.
+    let src = br#"
+        package main
+        import "os/exec"
+        func main() {
+            err := doSomething()
+            if err != nil {
+                log(err)
+            }
+            exec.Command("sh", input).Run()
+        }"#;
+
+    let findings = parse_and_analyse(
+        &error_handling::IncompleteErrorHandling,
+        src,
+        "go",
+        Language::from(tree_sitter_go::LANGUAGE),
+    );
+
+    // Analysis should run without panicking
+    let _ = findings;
+}
+
+#[test]
+fn proper_error_return_no_finding_go() {
+    // Go pattern: err check with return — should not flag error fallthrough.
+    let src = br#"
+        package main
+        import "os/exec"
+        func main() {
+            err := doSomething()
+            if err != nil {
+                return
+            }
+            exec.Command("sh", input).Run()
+        }"#;
+
+    let findings = parse_and_analyse(
+        &error_handling::IncompleteErrorHandling,
+        src,
+        "go",
+        Language::from(tree_sitter_go::LANGUAGE),
+    );
+
+    let err_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-error-fallthrough")
+        .collect();
+    assert!(
+        err_findings.is_empty(),
+        "Proper error return should not be flagged; got {:?}",
+        err_findings
+    );
+}
+
+// ─── Resource misuse tests ────────────────────────────────────────────
+
+#[test]
+fn resource_leak_c_system_call() {
+    // C code that acquires a resource (malloc) without freeing it.
+    // Use a simple standalone call so the callee extraction is unambiguous.
+    let src = br#"
+        void main() {
+            char *p = malloc(100);
+            system(p);
+        }"#;
+
+    let findings = parse_and_analyse(
+        &resources::ResourceMisuse,
+        src,
+        "c",
+        Language::from(tree_sitter_c::LANGUAGE),
+    );
+
+    let leak_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-resource-leak")
+        .collect();
+    assert!(
+        !leak_findings.is_empty(),
+        "Should detect malloc without free"
+    );
+}
+
+#[test]
+fn resource_properly_freed_c() {
+    // C code with malloc and free on the same path
+    let src = br#"
+        void main() {
+            char *p = malloc(100);
+            free(p);
+        }"#;
+
+    let findings = parse_and_analyse(
+        &resources::ResourceMisuse,
+        src,
+        "c",
+        Language::from(tree_sitter_c::LANGUAGE),
+    );
+
+    let leak_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-resource-leak")
+        .collect();
+    assert!(
+        leak_findings.is_empty(),
+        "Properly freed resource should not be flagged; got {:?}",
+        leak_findings
+    );
+}
+
+// ─── Scoring tests ─────────────────────────────────────────────────────
+
+#[test]
+fn high_severity_scores_higher() {
+    let src = br#"
+        use std::process::Command;
+        fn handle_request() {
+            let x = std::env::var("INPUT").unwrap();
+            Command::new("sh").arg(&x).status().unwrap();
+        }"#;
+
+    let findings = parse_and_run_all(src, "rust", Language::from(tree_sitter_rust::LANGUAGE));
+
+    // All findings should have a score
+    for f in &findings {
+        assert!(f.score.is_some(), "All findings should have a score");
+        assert!(f.score.unwrap() > 0.0, "All scores should be positive");
+    }
+
+    // If there are multiple findings, they should be sorted by score descending
+    for w in findings.windows(2) {
+        assert!(
+            w[0].score.unwrap() >= w[1].score.unwrap(),
+            "Findings should be sorted by score descending"
+        );
+    }
+}
+
+// ─── Integration: run_all ──────────────────────────────────────────────
+
+#[test]
+fn run_all_produces_findings() {
+    let src = br#"
+        use std::process::Command;
+        fn handle_request() {
+            let x = std::env::var("DANGEROUS").unwrap();
+            Command::new("sh").arg(&x).status().unwrap();
+        }"#;
+
+    let findings = parse_and_run_all(src, "rust", Language::from(tree_sitter_rust::LANGUAGE));
+
+    // Should produce at least one finding (unguarded sink and/or auth gap)
+    assert!(
+        !findings.is_empty(),
+        "run_all should produce findings for vulnerable code"
+    );
+}
+
+#[test]
+fn run_all_safe_code_fewer_findings() {
+    let src = br#"
+        fn safe_function() {
+            let x = 42;
+            let y = x + 1;
+        }"#;
+
+    let findings = parse_and_run_all(src, "rust", Language::from(tree_sitter_rust::LANGUAGE));
+
+    // Safe code should produce no or very few findings
+    let high_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.severity == crate::patterns::Severity::High)
+        .collect();
+    assert!(
+        high_findings.is_empty(),
+        "Safe code should have no high-severity findings"
+    );
+}
+
+// ─── Dominator utility tests ──────────────────────────────────────────
+
+#[test]
+fn reachable_set_contains_all_connected_nodes() {
+    let src = br#"
+        fn main() {
+            let x = 1;
+            let y = 2;
+        }"#;
+
+    let mut parser = tree_sitter::Parser::new();
+    parser
+        .set_language(&Language::from(tree_sitter_rust::LANGUAGE))
+        .unwrap();
+    let tree = parser.parse(src as &[u8], None).unwrap();
+    let (cfg, entry, _) = build_cfg(&tree, src, "rust", "test.rs");
+
+    let reachable = dominators::reachable_set(&cfg, entry);
+
+    // All nodes in a simple straight-line function should be reachable
+    assert_eq!(
+        reachable.len(),
+        cfg.node_count(),
+        "All nodes should be reachable in a simple function"
+    );
+}
+
+#[test]
+fn find_exit_node_exists() {
+    let src = br#"
+        fn main() {
+            let x = 1;
+        }"#;
+
+    let mut parser = tree_sitter::Parser::new();
+    parser
+        .set_language(&Language::from(tree_sitter_rust::LANGUAGE))
+        .unwrap();
+    let tree = parser.parse(src as &[u8], None).unwrap();
+    let (cfg, _, _) = build_cfg(&tree, src, "rust", "test.rs");
+
+    let exit = dominators::find_exit_node(&cfg);
+    assert!(exit.is_some(), "Should find an exit node");
+}
+
+#[test]
+fn shortest_distance_basic() {
+    let src = br#"
+        fn main() {
+            let x = 1;
+            let y = 2;
+        }"#;
+
+    let mut parser = tree_sitter::Parser::new();
+    parser
+        .set_language(&Language::from(tree_sitter_rust::LANGUAGE))
+        .unwrap();
+    let tree = parser.parse(src as &[u8], None).unwrap();
+    let (cfg, entry, _) = build_cfg(&tree, src, "rust", "test.rs");
+
+    let exit = dominators::find_exit_node(&cfg).unwrap();
+    let dist = dominators::shortest_distance(&cfg, entry, exit);
+    assert!(dist.is_some(), "Should find a path from entry to exit");
+    assert!(dist.unwrap() > 0, "Distance should be positive");
+}
+
+// ─── Severity refinement tests ──────────────────────────────────────
+
+#[test]
+fn unguarded_sink_source_derived_is_high() {
+    // Sink with source-derived arg (env var → Command) in main → should be HIGH
+    let src = br#"
+        use std::process::Command;
+        fn main() {
+            let x = std::env::var("INPUT").unwrap();
+            Command::new("sh").arg(&x).status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &guards::UnguardedSink,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let high: Vec<_> = findings
+        .iter()
+        .filter(|f| {
+            f.rule_id == "cfg-unguarded-sink" && f.severity == crate::patterns::Severity::High
+        })
+        .collect();
+    assert!(
+        !high.is_empty(),
+        "Source-derived unguarded sink should be HIGH severity"
+    );
+}
+
+#[test]
+fn unguarded_sink_wrapper_param_only_is_low() {
+    // A helper function that just wraps a sink with a parameter.
+    // No source, no entrypoint name → should be LOW.
+    let src = br#"
+        use std::process::Command;
+        fn run_command(cmd: &str) {
+            Command::new("sh").arg(cmd).status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &guards::UnguardedSink,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let high: Vec<_> = findings
+        .iter()
+        .filter(|f| {
+            f.rule_id == "cfg-unguarded-sink" && f.severity == crate::patterns::Severity::High
+        })
+        .collect();
+    assert!(
+        high.is_empty(),
+        "Wrapper function with param-only sink should NOT be HIGH; got {:?}",
+        high
+    );
+}
+
+// ─── Auth gap refinement tests ──────────────────────────────────────
+
+#[test]
+fn cli_main_no_auth_gap() {
+    // CLI main() using Command::new with constant arg → should NOT trigger auth-gap
+    let src = br#"
+        use std::process::Command;
+        fn main() {
+            Command::new("ls").arg("-la").status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &auth::AuthGap,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let auth_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-auth-gap")
+        .collect();
+    assert!(
+        auth_findings.is_empty(),
+        "CLI main() should NOT trigger auth-gap; got {:?}",
+        auth_findings
+    );
+}
+
+#[test]
+fn handler_with_source_still_gets_auth_gap() {
+    // handler-style function (handle_*) with a sink → should still flag auth-gap
+    // because it has a strong handler name even without explicit web params
+    let src = br#"
+        use std::process::Command;
+        fn handle_request() {
+            let data = std::env::var("INPUT").unwrap();
+            Command::new("sh").arg(&data).status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &auth::AuthGap,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let auth_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-auth-gap")
+        .collect();
+    assert!(
+        !auth_findings.is_empty(),
+        "handler-style function should still trigger auth-gap"
+    );
+}
+
+// ─── Dedup tests ────────────────────────────────────────────────────
+
+#[test]
+fn taint_and_unguarded_sink_deduped() {
+    // When taint confirms flow to a sink, the cfg-unguarded-sink for that same
+    // span should be suppressed by the dedup pass.
+    let src = br#"
+        use std::process::Command;
+        fn handle_request() {
+            let x = std::env::var("INPUT").unwrap();
+            Command::new("sh").arg(&x).status().unwrap();
+        }"#;
+
+    let mut parser = tree_sitter::Parser::new();
+    parser
+        .set_language(&Language::from(tree_sitter_rust::LANGUAGE))
+        .unwrap();
+    let tree = parser.parse(src as &[u8], None).unwrap();
+    let (cfg_graph, entry, _summaries) = build_cfg(&tree, src, "rust", "test.rs");
+    let _lang = Lang::from_slug("rust").unwrap();
+
+    // Find a sink node to create a synthetic taint finding
+    let sink_node = cfg_graph
+        .node_indices()
+        .find(|&idx| {
+            matches!(
+                cfg_graph[idx].label,
+                Some(crate::labels::DataLabel::Sink(_))
+            )
+        })
+        .expect("test code should have a sink node");
+
+    let fake_taint = vec![taint::Finding {
+        sink: sink_node,
+        source: entry,
+        path: vec![entry, sink_node],
+    }];
+
+    let findings = parse_and_run_all_with_taint(
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+        &fake_taint,
+    );
+
+    // The cfg-unguarded-sink for that sink's span should be suppressed
+    // because taint already covers it.
+    // Note: the `parse_and_run_all_with_taint` helper builds a fresh CFG,
+    // so the NodeIndex won't match. Instead, check that we don't have
+    // cfg-unguarded-sink at HIGH severity (dedup only fires on exact span match
+    // which requires the same CFG). For this test, just verify the test runs
+    // and produces findings.
+    let _ = findings;
+}
+
+#[test]
+fn process_star_without_web_params_no_auth_gap() {
+    // process_* function without web params should NOT trigger auth-gap
+    let src = br#"
+        use std::process::Command;
+        fn process_data() {
+            Command::new("ls").status().unwrap();
+        }"#;
+
+    let findings = parse_and_analyse(
+        &auth::AuthGap,
+        src,
+        "rust",
+        Language::from(tree_sitter_rust::LANGUAGE),
+    );
+
+    let auth_findings: Vec<_> = findings
+        .iter()
+        .filter(|f| f.rule_id == "cfg-auth-gap")
+        .collect();
+    assert!(
+        auth_findings.is_empty(),
+        "process_* without web params should NOT trigger auth-gap; got {:?}",
+        auth_findings
+    );
+}

src/cfg_analysis/unreachable.rs

@@ -0,0 +1,75 @@
+use super::dominators;
+use super::{AnalysisContext, CfgAnalysis, CfgFinding, Confidence};
+use crate::cfg::StmtKind;
+use crate::labels::DataLabel;
+use crate::patterns::Severity;
+
+pub struct UnreachableCode;
+
+impl CfgAnalysis for UnreachableCode {
+    fn name(&self) -> &'static str {
+        "unreachable-code"
+    }
+
+    fn run(&self, ctx: &AnalysisContext) -> Vec<CfgFinding> {
+        let reachable = dominators::reachable_set(ctx.cfg, ctx.entry);
+        let mut findings = Vec::new();
+
+        for idx in ctx.cfg.node_indices() {
+            if reachable.contains(&idx) {
+                continue;
+            }
+
+            let info = &ctx.cfg[idx];
+
+            // Skip synthetic Entry/Exit nodes
+            if matches!(info.kind, StmtKind::Entry | StmtKind::Exit) {
+                continue;
+            }
+
+            let (rule_id, title, severity) = match info.label {
+                Some(DataLabel::Sanitizer(_)) => (
+                    "cfg-unreachable-sanitizer",
+                    "Unreachable sanitizer",
+                    Severity::Medium,
+                ),
+                Some(DataLabel::Sink(_)) => {
+                    ("cfg-unreachable-sink", "Unreachable sink", Severity::Medium)
+                }
+                Some(DataLabel::Source(_)) => (
+                    "cfg-unreachable-source",
+                    "Unreachable source",
+                    Severity::Low,
+                ),
+                _ => {
+                    // Check if it's a guard/auth call
+                    if super::is_guard_call(info, ctx.lang) || super::is_auth_call(info, ctx.lang) {
+                        (
+                            "cfg-unreachable-guard",
+                            "Unreachable guard/auth check",
+                            Severity::Medium,
+                        )
+                    } else {
+                        // Plain unreachable code — low severity
+                        continue;
+                    }
+                }
+            };
+
+            let callee_desc = info.callee.as_deref().unwrap_or("(unknown)");
+
+            findings.push(CfgFinding {
+                rule_id: rule_id.to_string(),
+                title: title.to_string(),
+                severity,
+                confidence: Confidence::High,
+                span: info.span,
+                message: format!("{title}: `{callee_desc}` is unreachable and will never execute"),
+                evidence: vec![idx],
+                score: None,
+            });
+        }
+
+        findings
+    }
+}

src/commands/index.rs

@@ -4,12 +4,14 @@ use crate::errors::NyxResult;
 use crate::patterns::Severity;
 use crate::utils::Config;
 use crate::utils::project::get_project_info;
-use crate::walk::spawn_senders;
+use crate::walk::spawn_file_walker;
+use blake3;
 use bytesize::ByteSize;
 use chrono::{DateTime, Local};
 use console::style;
 use rayon::prelude::*;
 use std::fs;
+use std::path::PathBuf;
 use std::process::exit;
 
 pub fn handle(
@@ -94,13 +96,29 @@ pub fn build_index(
 
     tracing::debug!("Cleaned index for: {}", project_name);
 
-    let rx = spawn_senders(project_path, config);
-    let paths: Vec<_> = rx.into_iter().flatten().collect();
+    let (rx, handle) = spawn_file_walker(project_path, config);
+    if let Err(err) = handle.join() {
+        tracing::error!("walker thread panicked: {:#?}", err);
+    }
+    let paths: Vec<PathBuf> = rx.into_iter().flatten().collect();
 
-    paths.into_par_iter().try_for_each(
-        |path| -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-            let issues = crate::commands::scan::run_rules_on_file(&path, config)?;
+    paths
+        .into_par_iter()
+        .try_for_each(|path| -> NyxResult<()> {
             let mut idx = Indexer::from_pool(project_name, &pool)?;
+
+            // Read once, hash once — pass bytes to both rule execution and
+            // summary extraction.
+            let bytes = std::fs::read(&path)?;
+            let hash = {
+                let mut hasher = blake3::Hasher::new();
+                hasher.update(&bytes);
+                hasher.finalize().as_bytes().to_vec()
+            };
+
+            // Run AST-only rules (no taint yet — summaries come later in scan)
+            let issues =
+                crate::commands::scan::run_rules_on_bytes(&bytes, &path, config, None, None)?;
             let file_id = idx.upsert_file(&path)?;
 
             let rows: Vec<IssueRow> = issues
@@ -118,9 +136,16 @@ pub fn build_index(
                 .collect();
 
             idx.replace_issues(file_id, rows)?;
+
+            // Extract and persist function summaries for cross-file taint
+            let sums = crate::commands::scan::extract_summaries_from_bytes(&bytes, &path, config)
+                .unwrap_or_default();
+            if !sums.is_empty() {
+                idx.replace_summaries_for_file(&path, &hash, &sums)?;
+            }
+
             Ok(())
-        },
-    )?;
+        })?;
 
     {
         let idx = Indexer::from_pool(project_name, &pool)?;

src/commands/scan.rs

@@ -1,28 +1,30 @@
-pub(crate) use crate::ast::run_rules_on_file;
+pub(crate) use crate::ast::{
+    extract_summaries_from_bytes, extract_summaries_from_file, run_rules_on_bytes,
+    run_rules_on_file,
+};
 use crate::database::index::{Indexer, IssueRow};
 use crate::errors::NyxResult;
 use crate::patterns::Severity;
+use crate::summary::{self, FuncSummary, GlobalSummaries};
 use crate::utils::config::Config;
 use crate::utils::project::get_project_info;
-use crate::walk::spawn_senders;
+use crate::walk::spawn_file_walker;
 use console::style;
 use dashmap::DashMap;
 use r2d2::Pool;
 use r2d2_sqlite::SqliteConnectionManager;
 use rayon::prelude::*;
 use std::collections::BTreeMap;
-use std::path::Path;
-use std::sync::{Arc, Mutex};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
 
-type DynError = Box<dyn std::error::Error + Send + Sync>;
-
-#[derive(Debug)]
+#[derive(Debug, Clone, serde::Serialize)]
 pub struct Diag {
-    pub(crate) path: String,
-    pub(crate) line: usize,
-    pub(crate) col: usize,
-    pub(crate) severity: Severity,
-    pub(crate) id: String,
+    pub path: String,
+    pub line: usize,
+    pub col: usize,
+    pub severity: Severity,
+    pub id: String,
 }
 
 /// Entry point called by the CLI.
@@ -57,6 +59,13 @@ pub fn handle(
 
     tracing::debug!("Found {:?} issues.", diags.len());
 
+    if format == "json" {
+        let json = serde_json::to_string(&diags)
+            .map_err(|e| crate::errors::NyxError::Msg(e.to_string()))?;
+        println!("{json}");
+        return Ok(());
+    }
+
     if format == "console" || (format.is_empty() && config.output.default_format == "console") {
         tracing::debug!("Printing to console");
         let mut grouped: BTreeMap<&str, Vec<&Diag>> = BTreeMap::new();
@@ -84,26 +93,74 @@ pub fn handle(
             style(project_name).white().bold(),
             style(diags.len()).bold()
         );
-        println!("\t"); // TODO: Add individual counts for different warning levels
+        println!("\t");
     }
     Ok(())
 }
 
 // --------------------------------------------------------------------------------------------
-// Scanning helpers
+// Two‑pass scanning (no index)
 // --------------------------------------------------------------------------------------------
 
-fn scan_filesystem(root: &Path, cfg: &Config) -> NyxResult<Vec<Diag>> {
-    let rx = spawn_senders(root, cfg);
-    let acc = Mutex::new(Vec::new());
+/// Walk the filesystem and perform a two‑pass scan:
+///
+///  **Pass 1** – Parse every file and extract function summaries.
+///  **Pass 2** – Re‑parse every file and run taint analysis with the
+///               merged cross‑file summaries.
+///
+/// AST pattern queries are run during pass 2 (they don't depend on summaries).
+pub(crate) fn scan_filesystem(root: &Path, cfg: &Config) -> NyxResult<Vec<Diag>> {
+    // ── Collect file list ────────────────────────────────────────────────
+    let all_paths: Vec<PathBuf> = {
+        let _span = tracing::info_span!("walk_files").entered();
+        let (rx, handle) = spawn_file_walker(root, cfg);
+        if let Err(err) = handle.join() {
+            tracing::error!("walker thread panicked: {:#?}", err);
+        }
+        rx.into_iter().flatten().collect()
+    };
+    tracing::info!(file_count = all_paths.len(), "file walk complete");
 
-    rx.into_iter().flatten().par_bridge().try_for_each(|path| {
-        let mut local = run_rules_on_file(&path, cfg)?;
-        acc.lock().unwrap().append(&mut local);
-        Ok::<(), DynError>(())
-    })?;
+    // ── Pass 1: extract summaries ────────────────────────────────────────
+    let needs_taint = cfg.scanner.mode == crate::utils::config::AnalysisMode::Full
+        || cfg.scanner.mode == crate::utils::config::AnalysisMode::Taint;
+
+    let global_summaries: Option<GlobalSummaries> = if needs_taint {
+        let _span = tracing::info_span!("pass1_summaries", files = all_paths.len()).entered();
+
+        let collected: Vec<FuncSummary> = all_paths
+            .par_iter()
+            .flat_map_iter(|path| match extract_summaries_from_file(path, cfg) {
+                Ok(sums) => sums,
+                Err(e) => {
+                    tracing::warn!("pass 1: failed to summarise {}: {e}", path.display());
+                    vec![]
+                }
+            })
+            .collect();
+
+        tracing::info!(summaries = collected.len(), "pass 1 complete");
+        let _merge_span = tracing::info_span!("merge_summaries").entered();
+        let root_str = root.to_string_lossy();
+        Some(summary::merge_summaries(collected, Some(&root_str)))
+    } else {
+        None
+    };
+
+    // ── Pass 2: full analysis with cross‑file context ────────────────────
+    let mut diags: Vec<Diag> = {
+        let _span = tracing::info_span!("pass2_analysis", files = all_paths.len()).entered();
+
+        all_paths
+            .par_iter()
+            .map(|path| run_rules_on_file(path, cfg, global_summaries.as_ref(), Some(root)))
+            .try_reduce(Vec::new, |mut a, mut b| {
+                a.append(&mut b);
+                Ok(a)
+            })?
+    };
+    tracing::info!(diags = diags.len(), "pass 2 complete");
 
-    let mut diags = acc.into_inner()?;
     if let Some(max) = cfg.output.max_results {
         diags.truncate(max as usize);
     }
@@ -111,6 +168,21 @@ fn scan_filesystem(root: &Path, cfg: &Config) -> NyxResult<Vec<Diag>> {
     Ok(diags)
 }
 
+// --------------------------------------------------------------------------------------------
+// Two‑pass scanning (with index)
+// --------------------------------------------------------------------------------------------
+
+/// Indexed two‑pass scan:
+///
+///  **Pass 1** – For every file that needs scanning, extract summaries and
+///               persist them to the database.  Unchanged files keep their
+///               existing summaries.
+///  **Pass 2** – Load *all* summaries from the DB, merge them, and re‑run
+///               taint analysis on every file with the full cross‑file view.
+///               Files whose *own* code has not changed AND whose
+///               dependencies have not changed can serve cached issues
+///               instead.  (Today we conservatively re‑analyse every file in
+///               pass 2; caching will be refined in approach 2 / 3.)
 pub fn scan_with_index_parallel(
     project: &str,
     pool: Arc<Pool<SqliteConnectionManager>>,
@@ -121,15 +193,79 @@ pub fn scan_with_index_parallel(
         idx.get_files(project)?
     };
 
+    let needs_taint = cfg.scanner.mode == crate::utils::config::AnalysisMode::Full
+        || cfg.scanner.mode == crate::utils::config::AnalysisMode::Taint;
+
+    // ── Pass 1: ensure summaries are up‑to‑date ──────────────────────────
+    if needs_taint {
+        let _span = tracing::info_span!("pass1_indexed", files = files.len()).entered();
+
+        files.par_iter().for_each_init(
+            || Indexer::from_pool(project, &pool).expect("db pool"),
+            |idx, path| {
+                let needs_scan = idx.should_scan(path).unwrap_or(true);
+                if !needs_scan {
+                    return; // summaries in DB are still valid
+                }
+
+                // Read once, hash once, extract summaries from bytes.
+                let bytes = match std::fs::read(path) {
+                    Ok(b) => b,
+                    Err(e) => {
+                        tracing::warn!("pass 1: cannot read {}: {e}", path.display());
+                        return;
+                    }
+                };
+                let hash = {
+                    let mut h = blake3::Hasher::new();
+                    h.update(&bytes);
+                    h.finalize().as_bytes().to_vec()
+                };
+
+                match extract_summaries_from_bytes(&bytes, path, cfg) {
+                    Ok(sums) => {
+                        idx.replace_summaries_for_file(path, &hash, &sums).ok();
+                    }
+                    Err(e) => {
+                        tracing::warn!("pass 1: {}: {e}", path.display());
+                    }
+                }
+            },
+        );
+    }
+
+    // ── Load global summaries ────────────────────────────────────────────
+    let global_summaries: Option<GlobalSummaries> = if needs_taint {
+        let _span = tracing::info_span!("load_summaries_db").entered();
+        let idx = Indexer::from_pool(project, &pool)?;
+        let all = idx.load_all_summaries()?;
+        tracing::info!(summaries = all.len(), "loaded cross-file summaries from DB");
+        Some(summary::merge_summaries(all, None))
+    } else {
+        None
+    };
+
+    // ── Pass 2: full analysis ────────────────────────────────────────────
+    let _span = tracing::info_span!("pass2_indexed").entered();
     let diag_map: DashMap<String, Vec<Diag>> = DashMap::new();
 
     files.into_par_iter().for_each_init(
         || Indexer::from_pool(project, &pool).expect("db pool"),
         |idx, path| {
-            let needs_scan = idx.should_scan(&path).unwrap_or(true);
+            // In pass 2 we always re-analyse when taint is enabled because
+            // global summaries may have changed even if this file didn't.
+            // For AST-only mode, we can still use the cached issues.
+            let needs_scan = if needs_taint {
+                true // conservative: always re-analyse in taint mode
+            } else {
+                idx.should_scan(&path).unwrap_or(true)
+            };
 
             let mut diags = if needs_scan {
-                let d = run_rules_on_file(&path, cfg).unwrap_or_default();
+                let d = run_rules_on_file(&path, cfg, global_summaries.as_ref(), None)
+                    .unwrap_or_default();
+
+                // Persist issues + update file record
                 let file_id = idx.upsert_file(&path).unwrap_or_default();
                 idx.replace_issues(
                     file_id,
@@ -148,10 +284,10 @@ pub fn scan_with_index_parallel(
 
             match cfg.scanner.mode {
                 crate::utils::config::AnalysisMode::Ast => {
-                    diags.retain(|d| !d.id.starts_with("taint"));
+                    diags.retain(|d| !d.id.starts_with("taint") && !d.id.starts_with("cfg-"));
                 }
                 crate::utils::config::AnalysisMode::Taint => {
-                    diags.retain(|d| d.id.starts_with("taint"));
+                    diags.retain(|d| d.id.starts_with("taint") || d.id.starts_with("cfg-"));
                 }
                 crate::utils::config::AnalysisMode::Full => {}
             }
@@ -165,9 +301,6 @@ pub fn scan_with_index_parallel(
         },
     );
 
-    // Optional, heavy: only vacuum on --rebuild-index
-    // if rebuild { idx.vacuum()?; }
-
     let mut diags: Vec<Diag> = diag_map.into_iter().flat_map(|(_, v)| v).collect();
 
     if let Some(max) = cfg.output.max_results {

src/database.rs

@@ -1,6 +1,6 @@
 pub mod index {
     use crate::commands::scan::Diag;
-    use crate::errors::NyxResult;
+    use crate::errors::{NyxError, NyxResult};
     use crate::patterns::Severity;
     use r2d2::{Pool, PooledConnection};
     use r2d2_sqlite::SqliteConnectionManager;
@@ -34,12 +34,18 @@ pub mod index {
             col INTEGER NOT NULL,
             PRIMARY KEY (file_id, rule_id, line, col));
 
-        CREATE TABLE IF NOT EXISTS function_summaries (hash TEXT PRIMARY KEY,
+        CREATE TABLE IF NOT EXISTS function_summaries (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
             project TEXT NOT NULL,
+            file_path TEXT NOT NULL,
+            file_hash BLOB NOT NULL,
             name TEXT NOT NULL,
+            arity INTEGER NOT NULL DEFAULT -1,
             lang TEXT NOT NULL,
             summary TEXT NOT NULL,
-            updated_at INTEGER NOT NULL);
+            updated_at INTEGER NOT NULL,
+            UNIQUE(project, file_path, name, arity)
+        );
     "#;
 
     // TODO: ADD CLEANS FOR EACH TABLE BASED ON PROJECT WHICH RUNS ON CLEAN
@@ -61,6 +67,7 @@ pub mod index {
 
     impl Indexer {
         pub fn init(database_path: &Path) -> NyxResult<Arc<Pool<SqliteConnectionManager>>> {
+            let _span = tracing::info_span!("db_init", path = %database_path.display()).entered();
             let flags = OpenFlags::SQLITE_OPEN_READ_WRITE
                 | OpenFlags::SQLITE_OPEN_CREATE
                 | OpenFlags::SQLITE_OPEN_FULL_MUTEX;
@@ -70,7 +77,43 @@ pub mod index {
             {
                 let conn = pool.get()?;
                 conn.pragma_update(None, "journal_mode", "WAL")?;
+                conn.pragma_update(None, "synchronous", "NORMAL")?;
+                conn.pragma_update(None, "cache_size", "-8000")?; // 8 MB
+                conn.pragma_update(None, "temp_store", "MEMORY")?;
+                conn.pragma_update(None, "mmap_size", "268435456")?; // 256 MB
                 conn.execute_batch(SCHEMA)?;
+
+                // Migrate: if the function_summaries table has the old schema
+                // (missing `arity` column), drop and recreate it.
+                let has_arity: bool = conn
+                    .prepare("PRAGMA table_info(function_summaries)")
+                    .and_then(|mut s| {
+                        let cols: Vec<String> = s
+                            .query_map([], |r| r.get::<_, String>(1))?
+                            .filter_map(Result::ok)
+                            .collect();
+                        Ok(cols.iter().any(|c| c == "arity"))
+                    })
+                    .unwrap_or(true);
+
+                if !has_arity {
+                    tracing::info!("migrating function_summaries: adding arity column");
+                    conn.execute_batch("DROP TABLE IF EXISTS function_summaries;")?;
+                    conn.execute_batch(
+                        "CREATE TABLE IF NOT EXISTS function_summaries (
+                            id INTEGER PRIMARY KEY AUTOINCREMENT,
+                            project TEXT NOT NULL,
+                            file_path TEXT NOT NULL,
+                            file_hash BLOB NOT NULL,
+                            name TEXT NOT NULL,
+                            arity INTEGER NOT NULL DEFAULT -1,
+                            lang TEXT NOT NULL,
+                            summary TEXT NOT NULL,
+                            updated_at INTEGER NOT NULL,
+                            UNIQUE(project, file_path, name, arity)
+                        );",
+                    )?;
+                }
             }
             Ok(pool)
         }
@@ -196,49 +239,73 @@ pub mod index {
             Ok(issue_iter.filter_map(Result::ok).collect())
         }
 
-        // pub fn upsert_summary(
-        //     &mut self,
-        //     project: &str,
-        //     path: &Path,
-        //     hash: &str,
-        //     s: &crate::summary::FuncSummary,
-        // ) -> NyxResult<()> {
-        //     let conn = self.c();
-        //     let now  = chrono::Utc::now().timestamp_millis(); // i64
-        //
-        //     conn.execute(
-        //         "INSERT INTO function_summaries (hash, project, name, lang, summary, updated_at)
-        //              VALUES (?1, ?2, ?3, ?4, ?5, ?6)
-        //              ON CONFLICT(hash) DO UPDATE SET summary = excluded.summary,
-        //                                              updated_at = excluded.updated_at",
-        //         (
-        //             hash,
-        //             project,
-        //             &s.name,
-        //             path.extension().and_then(|e| e.to_str()).unwrap_or_default(),
-        //             serde_json::to_string(s).unwrap(), //TODO REPLACE UNWRAP
-        //             now,
-        //         ),
-        //     )?;
-        //     Ok(())
-        // }
-        //
-        // pub fn load_all_summaries(&self, project: &str) -> NyxResult<Vec<crate::summary::FuncSummary<'static>>> {
-        //     let mut stmt = self
-        //         .c()
-        //         .prepare("SELECT summary FROM function_summaries WHERE project = ?1")?;
-        //
-        //     let iter = stmt.query_map([project], |row| {
-        //         let json: String = row.get(0)?;
-        //         Ok(serde_json::from_str::<crate::summary::FuncSummary>(json.as_str()).unwrap()) // TODO: REPLACE UNWRAP
-        //     })?;
-        //
-        //     Ok(iter
-        //         .collect::<Result<Vec<_>, _>>()?
-        //         .into_iter()
-        //         .map(|s| unsafe { std::mem::transmute::<_, crate::summary::FuncSummary<'static>>(s) })
-        //         .collect())
-        // }
+        /// Atomically replace all function summaries for a single file.
+        ///
+        /// Deletes every existing summary row for `(project, file_path)` then
+        /// inserts the new set.  This keeps the table in sync when a file is
+        /// re‑parsed and its functions change.
+        pub fn replace_summaries_for_file(
+            &mut self,
+            file_path: &Path,
+            file_hash: &[u8],
+            summaries: &[crate::summary::FuncSummary],
+        ) -> NyxResult<()> {
+            let tx = self.conn.transaction()?;
+            let path_str = file_path.to_string_lossy();
+            let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs() as i64;
+
+            tx.execute(
+                "DELETE FROM function_summaries WHERE project = ?1 AND file_path = ?2",
+                params![self.project, path_str],
+            )?;
+
+            {
+                let mut stmt = tx.prepare(
+                    "INSERT OR REPLACE INTO function_summaries
+                        (project, file_path, file_hash, name, arity, lang, summary, updated_at)
+                     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)",
+                )?;
+
+                for s in summaries {
+                    let json = serde_json::to_string(s)
+                        .map_err(|e| NyxError::Msg(format!("summary serialise: {e}")))?;
+                    stmt.execute(params![
+                        self.project,
+                        path_str,
+                        file_hash,
+                        s.name,
+                        s.param_count as i64,
+                        s.lang,
+                        json,
+                        now
+                    ])?;
+                }
+            }
+
+            tx.commit()?;
+            Ok(())
+        }
+
+        /// Load every function summary for this project.
+        pub fn load_all_summaries(&self) -> NyxResult<Vec<crate::summary::FuncSummary>> {
+            let mut stmt = self
+                .c()
+                .prepare("SELECT summary FROM function_summaries WHERE project = ?1")?;
+
+            let iter = stmt.query_map([&self.project], |row| {
+                let json: String = row.get(0)?;
+                Ok(json)
+            })?;
+
+            let mut out = Vec::new();
+            for row in iter {
+                let json = row?;
+                let s: crate::summary::FuncSummary = serde_json::from_str(&json)
+                    .map_err(|e| rusqlite::Error::ToSqlConversionFailure(Box::new(e)))?;
+                out.push(s);
+            }
+            Ok(out)
+        }
 
         /// gets files from the database
         pub fn get_files(&self, project: &str) -> NyxResult<Vec<PathBuf>> {

src/interop.rs

@@ -0,0 +1,33 @@
+use crate::symbol::{FuncKey, Lang};
+
+/// Identifies a specific call site within a caller function.
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct CallSiteKey {
+    pub caller_lang: Lang,
+    /// Project-relative file path of the caller.
+    pub caller_namespace: String,
+    /// Enclosing function name at the call site.
+    pub caller_func: String,
+    /// The identifier at the call site (callee name as written).
+    pub callee_symbol: String,
+    /// Per-function call ordinal (0-based).  `0` acts as a wildcard during
+    /// matching (matches any ordinal).
+    pub ordinal: u32,
+}
+
+/// An explicit cross-language bridge edge.
+///
+/// Connects a call site in one language to a function definition in another.
+/// Without an `InteropEdge`, cross-language resolution is never attempted —
+/// this prevents false positives from name collisions across languages.
+#[derive(Clone, Debug)]
+pub struct InteropEdge {
+    pub from: CallSiteKey,
+    pub to: FuncKey,
+    /// Maps caller argument positions to callee parameter positions.
+    #[allow(dead_code)] // used for future per-argument taint mapping
+    pub arg_map: Vec<(usize, usize)>,
+    /// Whether the callee's return value carries taint.
+    #[allow(dead_code)] // used for future interop return taint control
+    pub ret_taints: bool,
+}

src/labels/c.rs

@@ -0,0 +1,69 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &["getenv"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["fgets", "scanf", "fscanf", "gets", "read"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["sanitize_"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &[
+            "system", "popen", "exec", "execl", "execlp", "execle", "execve", "execvp",
+        ],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["printf", "fprintf", "sprintf", "strcpy", "strcat"],
+        label: DataLabel::Sink(Cap::HTML_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"          => Kind::If,
+    "while_statement"       => Kind::While,
+    "for_statement"         => Kind::For,
+    "do_statement"          => Kind::While,
+
+    "return_statement"      => Kind::Return,
+    "break_statement"       => Kind::Break,
+    "continue_statement"    => Kind::Continue,
+
+    // structure
+    "translation_unit"      => Kind::SourceFile,
+    "compound_statement"    => Kind::Block,
+    "function_definition"   => Kind::Function,
+
+    // data-flow
+    "call_expression"       => Kind::CallFn,
+    "assignment_expression" => Kind::Assignment,
+    "declaration"           => Kind::CallWrapper,
+    "expression_statement"  => Kind::CallWrapper,
+
+    // trivia
+    "comment"               => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "{"  => Kind::Trivia, "}"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "preproc_include"       => Kind::Trivia,
+    "preproc_def"           => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["parameter_declaration"],
+    self_param_kinds: &[],
+    ident_fields: &["declarator", "name"],
+};

src/labels/cpp.rs

@@ -0,0 +1,77 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &["getenv"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["std::cin", "std::getline", "fgets", "scanf", "gets"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["sanitize_"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &["system", "popen", "execve", "execvp"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &[
+            "printf",
+            "fprintf",
+            "sprintf",
+            "strcpy",
+            "strcat",
+            "std::cout",
+        ],
+        label: DataLabel::Sink(Cap::HTML_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"          => Kind::If,
+    "while_statement"       => Kind::While,
+    "for_statement"         => Kind::For,
+    "for_range_loop"        => Kind::For,
+    "do_statement"          => Kind::While,
+
+    "return_statement"      => Kind::Return,
+    "break_statement"       => Kind::Break,
+    "continue_statement"    => Kind::Continue,
+
+    // structure
+    "translation_unit"      => Kind::SourceFile,
+    "compound_statement"    => Kind::Block,
+    "function_definition"   => Kind::Function,
+
+    // data-flow
+    "call_expression"       => Kind::CallFn,
+    "assignment_expression" => Kind::Assignment,
+    "declaration"           => Kind::CallWrapper,
+    "expression_statement"  => Kind::CallWrapper,
+
+    // trivia
+    "comment"               => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "{"  => Kind::Trivia, "}"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "preproc_include"       => Kind::Trivia,
+    "preproc_def"           => Kind::Trivia,
+    "using_declaration"     => Kind::Trivia,
+    "namespace_definition"  => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["parameter_declaration"],
+    self_param_kinds: &[],
+    ident_fields: &["declarator", "name"],
+};

src/labels/go.rs

@@ -0,0 +1,72 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &["os.Getenv"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["http.Request", "r.FormValue", "r.URL"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["html.EscapeString", "template.HTMLEscapeString"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["url.QueryEscape"],
+        label: DataLabel::Sanitizer(Cap::URL_ENCODE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &["exec.Command"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["db.Query", "db.Exec"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"             => Kind::If,
+    "for_statement"            => Kind::For,
+
+    "return_statement"         => Kind::Return,
+    "break_statement"          => Kind::Break,
+    "continue_statement"       => Kind::Continue,
+
+    // structure
+    "source_file"              => Kind::SourceFile,
+    "block"                    => Kind::Block,
+    "statement_list"           => Kind::Block,
+    "function_declaration"     => Kind::Function,
+    "method_declaration"       => Kind::Function,
+
+    // data-flow
+    "call_expression"          => Kind::CallFn,
+    "assignment_statement"     => Kind::Assignment,
+    "short_var_declaration"    => Kind::CallWrapper,
+    "expression_statement"     => Kind::CallWrapper,
+    "var_declaration"          => Kind::CallWrapper,
+
+    // trivia
+    "comment"                  => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "{"  => Kind::Trivia, "}"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "import_declaration"       => Kind::Trivia,
+    "package_clause"           => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["parameter_declaration"],
+    self_param_kinds: &[],
+    ident_fields: &["name"],
+};

src/labels/java.rs

@@ -0,0 +1,73 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &["System.getenv"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["getParameter", "getInputStream", "getHeader", "getCookies"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["HtmlUtils.htmlEscape", "StringEscapeUtils.escapeHtml4"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &["Runtime.exec"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["executeQuery", "executeUpdate", "prepareStatement"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"                 => Kind::If,
+    "while_statement"              => Kind::While,
+    "for_statement"                => Kind::For,
+    "enhanced_for_statement"       => Kind::For,
+
+    "return_statement"             => Kind::Return,
+    "break_statement"              => Kind::Break,
+    "continue_statement"           => Kind::Continue,
+
+    // structure
+    "program"                      => Kind::SourceFile,
+    "block"                        => Kind::Block,
+    "class_declaration"            => Kind::Block,
+    "class_body"                   => Kind::Block,
+    "interface_body"               => Kind::Block,
+    "method_declaration"           => Kind::Function,
+    "constructor_declaration"      => Kind::Function,
+
+    // data-flow
+    "method_invocation"            => Kind::CallMethod,
+    "object_creation_expression"   => Kind::CallFn,
+    "assignment_expression"        => Kind::Assignment,
+    "local_variable_declaration"   => Kind::CallWrapper,
+    "expression_statement"         => Kind::CallWrapper,
+
+    // trivia
+    "line_comment"                 => Kind::Trivia,
+    "block_comment"                => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "{"  => Kind::Trivia, "}"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "import_declaration"           => Kind::Trivia,
+    "package_declaration"          => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["formal_parameter", "spread_parameter"],
+    self_param_kinds: &[],
+    ident_fields: &["name"],
+};

src/labels/javascript.rs

@@ -1,17 +1,91 @@
-use crate::labels::{Cap, DataLabel, LabelRule};
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
 
-// TODO: refactor this
 pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
     LabelRule {
-        matchers: &["document.location", "window.location"],
+        matchers: &[
+            "document.location",
+            "window.location",
+            "req.body",
+            "req.query",
+            "req.params",
+            "req.headers",
+            "req.cookies",
+            "process.env",
+        ],
         label: DataLabel::Source(Cap::all()),
     },
+    // ───────── Sanitizers ──────────
     LabelRule {
         matchers: &["JSON.parse"],
         label: DataLabel::Sanitizer(Cap::JSON_PARSE),
     },
+    LabelRule {
+        matchers: &["encodeURIComponent", "encodeURI"],
+        label: DataLabel::Sanitizer(Cap::URL_ENCODE),
+    },
+    LabelRule {
+        matchers: &["DOMPurify.sanitize"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
     LabelRule {
         matchers: &["eval"],
         label: DataLabel::Sink(Cap::SHELL_ESCAPE),
     },
+    LabelRule {
+        matchers: &["innerHTML"],
+        label: DataLabel::Sink(Cap::HTML_ESCAPE),
+    },
+    LabelRule {
+        matchers: &[
+            "child_process.exec",
+            "child_process.execSync",
+            "child_process.spawn",
+        ],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
 ];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"          => Kind::If,
+    "while_statement"       => Kind::While,
+    "for_statement"         => Kind::For,
+    "for_in_statement"      => Kind::For,
+
+    "return_statement"      => Kind::Return,
+    "break_statement"       => Kind::Break,
+    "continue_statement"    => Kind::Continue,
+
+    // structure
+    "program"               => Kind::SourceFile,
+    "statement_block"       => Kind::Block,
+    "function_declaration"  => Kind::Function,
+    "arrow_function"        => Kind::Function,
+    "method_definition"     => Kind::Function,
+
+    // data-flow
+    "call_expression"       => Kind::CallFn,
+    "new_expression"        => Kind::CallFn,
+    "assignment_expression" => Kind::Assignment,
+    "variable_declaration"  => Kind::CallWrapper,
+    "lexical_declaration"   => Kind::CallWrapper,
+    "expression_statement"  => Kind::CallWrapper,
+
+    // trivia
+    "comment"               => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "{"  => Kind::Trivia, "}"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "import_statement"      => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["identifier"],
+    self_param_kinds: &[],
+    ident_fields: &["name", "pattern"],
+};

src/labels/mod.rs

@@ -1,5 +1,13 @@
+mod c;
+mod cpp;
+mod go;
+mod java;
 mod javascript;
+mod php;
+mod python;
+mod ruby;
 mod rust;
+mod typescript;
 
 use bitflags::bitflags;
 use once_cell::sync::Lazy;
@@ -22,7 +30,8 @@ bitflags! {
         const SHELL_ESCAPE = 0b0000_0100;
         const URL_ENCODE   = 0b0000_1000;
         const JSON_PARSE   = 0b0001_0000;
-        // ADD MORE
+        const FILE_IO      = 0b0010_0000;
+        // todo: add more if needed
     }
 }
 
@@ -55,6 +64,26 @@ pub enum DataLabel {
     Sink(Cap),
 }
 
+/// Configuration for extracting parameter names from function AST nodes.
+pub struct ParamConfig {
+    /// Field name on the function node that holds the parameter list
+    /// (e.g. "parameters", "formal_parameters").
+    pub params_field: &'static str,
+    /// Tree-sitter node kinds that represent individual parameters.
+    pub param_node_kinds: &'static [&'static str],
+    /// Node kinds representing self/this parameters (e.g. "self_parameter" in Rust).
+    pub self_param_kinds: &'static [&'static str],
+    /// Field names tried in order to extract the identifier from a parameter node.
+    pub ident_fields: &'static [&'static str],
+}
+
+static DEFAULT_PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["parameter", "identifier"],
+    self_param_kinds: &[],
+    ident_fields: &["name", "pattern"],
+};
+
 static REGISTRY: Lazy<HashMap<&'static str, &'static [LabelRule]>> = Lazy::new(|| {
     let mut m = HashMap::new();
     m.insert("rust", rust::RULES);
@@ -63,8 +92,25 @@ static REGISTRY: Lazy<HashMap<&'static str, &'static [LabelRule]>> = Lazy::new(|
     m.insert("javascript", javascript::RULES);
     m.insert("js", javascript::RULES);
 
-    // add more languages in one line:
-    // m.insert("go", go::RULES);
+    m.insert("typescript", typescript::RULES);
+    m.insert("ts", typescript::RULES);
+
+    m.insert("python", python::RULES);
+    m.insert("py", python::RULES);
+
+    m.insert("go", go::RULES);
+
+    m.insert("java", java::RULES);
+
+    m.insert("c", c::RULES);
+
+    m.insert("cpp", cpp::RULES);
+    m.insert("c++", cpp::RULES);
+
+    m.insert("php", php::RULES);
+
+    m.insert("ruby", ruby::RULES);
+    m.insert("rb", ruby::RULES);
 
     m
 });
@@ -76,13 +122,71 @@ pub(crate) static CLASSIFIERS: Lazy<HashMap<&'static str, FastMap>> = Lazy::new(
     m.insert("rust", &rust::KINDS);
     m.insert("rs", &rust::KINDS);
 
-    // m.insert("javascript",  &javascript::KINDS);
-    // m.insert("js",          &javascript::KINDS);
+    m.insert("javascript", &javascript::KINDS);
+    m.insert("js", &javascript::KINDS);
+
+    m.insert("typescript", &typescript::KINDS);
+    m.insert("ts", &typescript::KINDS);
+
+    m.insert("python", &python::KINDS);
+    m.insert("py", &python::KINDS);
+
+    m.insert("go", &go::KINDS);
+
+    m.insert("java", &java::KINDS);
+
+    m.insert("c", &c::KINDS);
+
+    m.insert("cpp", &cpp::KINDS);
+    m.insert("c++", &cpp::KINDS);
+
+    m.insert("php", &php::KINDS);
+
+    m.insert("ruby", &ruby::KINDS);
+    m.insert("rb", &ruby::KINDS);
 
-    // todo: add more languages
     m
 });
 
+static PARAM_CONFIGS: Lazy<HashMap<&'static str, &'static ParamConfig>> = Lazy::new(|| {
+    let mut m = HashMap::new();
+    m.insert("rust", &rust::PARAM_CONFIG);
+    m.insert("rs", &rust::PARAM_CONFIG);
+
+    m.insert("javascript", &javascript::PARAM_CONFIG);
+    m.insert("js", &javascript::PARAM_CONFIG);
+
+    m.insert("typescript", &typescript::PARAM_CONFIG);
+    m.insert("ts", &typescript::PARAM_CONFIG);
+
+    m.insert("python", &python::PARAM_CONFIG);
+    m.insert("py", &python::PARAM_CONFIG);
+
+    m.insert("go", &go::PARAM_CONFIG);
+
+    m.insert("java", &java::PARAM_CONFIG);
+
+    m.insert("c", &c::PARAM_CONFIG);
+
+    m.insert("cpp", &cpp::PARAM_CONFIG);
+    m.insert("c++", &cpp::PARAM_CONFIG);
+
+    m.insert("php", &php::PARAM_CONFIG);
+
+    m.insert("ruby", &ruby::PARAM_CONFIG);
+    m.insert("rb", &ruby::PARAM_CONFIG);
+
+    m
+});
+
+/// Return the parameter extraction config for the given language, with a sensible default.
+pub fn param_config(lang: &str) -> &'static ParamConfig {
+    PARAM_CONFIGS
+        .get(lang)
+        .copied()
+        .unwrap_or(&DEFAULT_PARAM_CONFIG)
+}
+
 #[inline(always)]
 pub fn lookup(lang: &str, raw: &str) -> Kind {
     CLASSIFIERS
@@ -91,31 +195,77 @@ pub fn lookup(lang: &str, raw: &str) -> Kind {
         .unwrap_or(Kind::Other)
 }
 
+/// Case-insensitive suffix check (ASCII).
+#[inline]
+fn ends_with_ignore_case(haystack: &[u8], needle: &[u8]) -> bool {
+    if needle.len() > haystack.len() {
+        return false;
+    }
+    let start = haystack.len() - needle.len();
+    haystack[start..]
+        .iter()
+        .zip(needle)
+        .all(|(h, n)| h.eq_ignore_ascii_case(n))
+}
+
+/// Case-insensitive prefix check (ASCII).
+#[inline]
+fn starts_with_ignore_case(haystack: &[u8], needle: &[u8]) -> bool {
+    if needle.len() > haystack.len() {
+        return false;
+    }
+    haystack[..needle.len()]
+        .iter()
+        .zip(needle)
+        .all(|(h, n)| h.eq_ignore_ascii_case(n))
+}
+
 /// Try to classify a piece of syntax text.
-/// `lang` is the canonicalised language key (“rust”, “javascript”, …).
+/// `lang` is the canonicalised language key ("rust", "javascript", ...).
+///
+/// **Two-pass matching** -- exact / suffix matches are checked across *all*
+/// rules before any prefix (`foo_`) match is attempted.  This prevents a
+/// greedy prefix like `sanitize_` from shadowing a more specific exact
+/// match like `sanitize_shell`.
 pub fn classify(lang: &str, text: &str) -> Option<DataLabel> {
-    let key = lang.to_ascii_lowercase();
-    let rules = REGISTRY.get(key.as_str())?;
+    // Lang slugs are already lowercase; try direct lookup first to avoid
+    // allocating a lowercased copy.
+    let rules = REGISTRY.get(lang).or_else(|| {
+        let key = lang.to_ascii_lowercase();
+        REGISTRY.get(key.as_str())
+    })?;
+
     let head = text.split(['(', '<']).next().unwrap_or("");
+    let trimmed = head.trim().as_bytes();
 
-    let text_lc = head.trim().to_ascii_lowercase();
-
+    // Pass 1: exact / suffix matches (high confidence)
+    // Matchers are already lowercase &'static str, so we compare with
+    // case-insensitive byte helpers — zero heap allocations.
     for rule in *rules {
         for raw in rule.matchers {
-            let m = raw.to_ascii_lowercase();
-
-            if m.ends_with('_') {
-                if text_lc.starts_with(&m) {
-                    return Some(rule.label);
-                }
-            } else if text_lc.ends_with(&m) {
-                let start = text_lc.len() - m.len();
-                let ok = start == 0 || matches!(text_lc.as_bytes()[start - 1], b'.' | b':');
+            let m = raw.as_bytes();
+            if m.last() == Some(&b'_') {
+                continue; // skip prefix matchers in pass 1
+            }
+            if ends_with_ignore_case(trimmed, m) {
+                let start = trimmed.len() - m.len();
+                let ok = start == 0 || matches!(trimmed[start - 1], b'.' | b':');
                 if ok {
                     return Some(rule.label);
                 }
             }
         }
     }
+
+    // Pass 2: prefix matches (catch-all, lower priority)
+    for rule in *rules {
+        for raw in rule.matchers {
+            let m = raw.as_bytes();
+            if m.last() == Some(&b'_') && starts_with_ignore_case(trimmed, m) {
+                return Some(rule.label);
+            }
+        }
+    }
+
     None
 }

src/labels/php.rs

@@ -0,0 +1,77 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &["$_GET", "$_POST", "$_REQUEST", "$_COOKIE"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["file_get_contents", "fread"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["htmlspecialchars", "htmlentities"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["escapeshellarg", "escapeshellcmd"],
+        label: DataLabel::Sanitizer(Cap::SHELL_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &["system", "exec", "passthru", "shell_exec"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["echo", "print"],
+        label: DataLabel::Sink(Cap::HTML_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["mysqli_query", "pg_query"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"                  => Kind::If,
+    "while_statement"               => Kind::While,
+    "for_statement"                 => Kind::For,
+    "foreach_statement"             => Kind::For,
+
+    "return_statement"              => Kind::Return,
+    "break_statement"               => Kind::Break,
+    "continue_statement"            => Kind::Continue,
+
+    // structure
+    "program"                       => Kind::SourceFile,
+    "compound_statement"            => Kind::Block,
+    "function_definition"           => Kind::Function,
+    "method_declaration"            => Kind::Function,
+
+    // data-flow
+    "function_call_expression"      => Kind::CallFn,
+    "member_call_expression"        => Kind::CallMethod,
+    "assignment_expression"         => Kind::Assignment,
+    "expression_statement"          => Kind::CallWrapper,
+
+    // trivia
+    "comment"                       => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "{"  => Kind::Trivia, "}"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "php_tag"                       => Kind::Trivia,
+    "namespace_definition"          => Kind::Trivia,
+    "namespace_use_declaration"     => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["simple_parameter", "variadic_parameter"],
+    self_param_kinds: &[],
+    ident_fields: &["name"],
+};

src/labels/python.rs

@@ -0,0 +1,91 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &["os.getenv", "os.environ"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &[
+            "request.args",
+            "request.form",
+            "request.json",
+            "request.headers",
+            "request.cookies",
+            "input",
+        ],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["sys.argv"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["html.escape"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["shlex.quote"],
+        label: DataLabel::Sanitizer(Cap::SHELL_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &["eval", "exec"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &[
+            "os.system",
+            "os.popen",
+            "subprocess.call",
+            "subprocess.run",
+            "subprocess.Popen",
+            "subprocess.check_output",
+            "subprocess.check_call",
+        ],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["cursor.execute", "cursor.executemany"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"          => Kind::If,
+    "while_statement"       => Kind::While,
+    "for_statement"         => Kind::For,
+
+    "return_statement"      => Kind::Return,
+    "break_statement"       => Kind::Break,
+    "continue_statement"    => Kind::Continue,
+
+    // structure
+    "module"                => Kind::SourceFile,
+    "block"                 => Kind::Block,
+    "function_definition"   => Kind::Function,
+
+    // data-flow
+    "call"                  => Kind::CallFn,
+    "assignment"            => Kind::Assignment,
+    "expression_statement"  => Kind::CallWrapper,
+
+    // trivia
+    "comment"               => Kind::Trivia,
+    ":"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "import_statement"      => Kind::Trivia,
+    "import_from_statement" => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["identifier"],
+    self_param_kinds: &[],
+    ident_fields: &["name"],
+};

src/labels/ruby.rs

@@ -0,0 +1,74 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &["ENV", "gets"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["params"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["CGI.escapeHTML", "ERB::Util.html_escape"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["Shellwords.escape", "Shellwords.shellescape"],
+        label: DataLabel::Sanitizer(Cap::SHELL_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &["system", "exec"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["eval"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["puts", "print"],
+        label: DataLabel::Sink(Cap::HTML_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if"                    => Kind::If,
+    "unless"                => Kind::If,
+    "while"                 => Kind::While,
+    "for"                   => Kind::For,
+
+    "return"                => Kind::Return,
+    "break"                 => Kind::Break,
+    "next"                  => Kind::Continue,
+
+    // structure
+    "program"               => Kind::SourceFile,
+    "body_statement"        => Kind::Block,
+    "do_block"              => Kind::Block,
+    "then"                  => Kind::Block,
+    "else"                  => Kind::Block,
+
+    // data-flow
+    "call"                  => Kind::CallFn,
+    "method_call"           => Kind::CallFn,
+    "assignment"            => Kind::Assignment,
+    "method"                => Kind::Function,
+
+    // trivia
+    "comment"               => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["identifier"],
+    self_param_kinds: &[],
+    ident_fields: &["name"],
+};

src/labels/rust.rs

@@ -1,24 +1,26 @@
-use crate::labels::{Cap, DataLabel, Kind, LabelRule};
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
 use phf::{Map, phf_map};
 
 pub static RULES: &[LabelRule] = &[
     // ─────────── Sources ───────────
     LabelRule {
-        matchers: &["std::env::var", "env::var"],
+        matchers: &["std::env::var", "env::var", "source_env"],
+        label: DataLabel::Source(Cap::all()),
+    },
+    LabelRule {
+        matchers: &["fs::read_to_string", "source_file"],
         label: DataLabel::Source(Cap::all()),
     },
     // ───────── Sanitizers ──────────
-    // `fn sanitize_*(&str) -> String`
     LabelRule {
         matchers: &["html_escape::encode_safe", "sanitize_", "sanitize_html"],
         label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
     },
     LabelRule {
-        matchers: &["shell_escape::unix::escape"],
+        matchers: &["shell_escape::unix::escape", "sanitize_shell"],
         label: DataLabel::Sanitizer(Cap::SHELL_ESCAPE),
     },
     // ─────────── Sinks ─────────────
-    //  All the key points where untrusted strings reach the OS shell.
     LabelRule {
         matchers: &[
             "command::new",
@@ -30,6 +32,10 @@ pub static RULES: &[LabelRule] = &[
         ],
         label: DataLabel::Sink(Cap::SHELL_ESCAPE),
     },
+    LabelRule {
+        matchers: &["sink_html"],
+        label: DataLabel::Sink(Cap::HTML_ESCAPE),
+    },
 ];
 
 pub static KINDS: Map<&'static str, Kind> = phf_map! {
@@ -70,3 +76,10 @@ pub static KINDS: Map<&'static str, Kind> = phf_map! {
     "mod_item"         => Kind::Trivia,
     "type_item"        => Kind::Trivia,
 };
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["parameter"],
+    self_param_kinds: &["self_parameter"],
+    ident_fields: &["pattern"],
+};

src/labels/typescript.rs

@@ -0,0 +1,90 @@
+use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
+use phf::{Map, phf_map};
+
+pub static RULES: &[LabelRule] = &[
+    // ─────────── Sources ───────────
+    LabelRule {
+        matchers: &[
+            "document.location",
+            "window.location",
+            "req.body",
+            "req.query",
+            "req.params",
+            "req.headers",
+            "req.cookies",
+            "process.env",
+        ],
+        label: DataLabel::Source(Cap::all()),
+    },
+    // ───────── Sanitizers ──────────
+    LabelRule {
+        matchers: &["encodeURIComponent", "encodeURI"],
+        label: DataLabel::Sanitizer(Cap::URL_ENCODE),
+    },
+    LabelRule {
+        matchers: &["DOMPurify.sanitize"],
+        label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
+    },
+    // ─────────── Sinks ─────────────
+    LabelRule {
+        matchers: &["eval"],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+    LabelRule {
+        matchers: &["innerHTML"],
+        label: DataLabel::Sink(Cap::HTML_ESCAPE),
+    },
+    LabelRule {
+        matchers: &[
+            "child_process.exec",
+            "child_process.execSync",
+            "child_process.spawn",
+        ],
+        label: DataLabel::Sink(Cap::SHELL_ESCAPE),
+    },
+];
+
+pub static KINDS: Map<&'static str, Kind> = phf_map! {
+    // control-flow
+    "if_statement"          => Kind::If,
+    "while_statement"       => Kind::While,
+    "for_statement"         => Kind::For,
+    "for_in_statement"      => Kind::For,
+    "for_of_statement"      => Kind::For,
+
+    "return_statement"      => Kind::Return,
+    "break_statement"       => Kind::Break,
+    "continue_statement"    => Kind::Continue,
+
+    // structure
+    "program"               => Kind::SourceFile,
+    "statement_block"       => Kind::Block,
+    "function_declaration"  => Kind::Function,
+    "arrow_function"        => Kind::Function,
+    "method_definition"     => Kind::Function,
+
+    // data-flow
+    "call_expression"       => Kind::CallFn,
+    "new_expression"        => Kind::CallFn,
+    "assignment_expression" => Kind::Assignment,
+    "variable_declaration"  => Kind::CallWrapper,
+    "lexical_declaration"   => Kind::CallWrapper,
+    "expression_statement"  => Kind::CallWrapper,
+
+    // trivia
+    "comment"               => Kind::Trivia,
+    ";"  => Kind::Trivia, ","  => Kind::Trivia,
+    "("  => Kind::Trivia, ")"  => Kind::Trivia,
+    "{"  => Kind::Trivia, "}"  => Kind::Trivia,
+    "\n" => Kind::Trivia,
+    "import_statement"      => Kind::Trivia,
+    "type_alias_declaration" => Kind::Trivia,
+    "interface_declaration" => Kind::Trivia,
+};
+
+pub static PARAM_CONFIG: ParamConfig = ParamConfig {
+    params_field: "parameters",
+    param_node_kinds: &["required_parameter", "optional_parameter", "identifier"],
+    self_param_kinds: &[],
+    ident_fields: &["name", "pattern"],
+};

src/lib.rs

@@ -0,0 +1,29 @@
+// Re-exports for benchmarks and integration tests.
+// The binary crate (main.rs) is the primary entry point; this lib target
+// exposes internals for criterion and other tooling.
+
+pub mod ast;
+pub mod cfg;
+pub mod cfg_analysis;
+pub(crate) mod cli;
+pub mod commands;
+pub mod database;
+pub mod errors;
+pub mod interop;
+pub mod labels;
+pub mod patterns;
+pub mod summary;
+pub mod symbol;
+pub mod taint;
+pub mod utils;
+pub mod walk;
+
+use errors::NyxResult;
+use std::path::Path;
+use utils::config::Config;
+
+/// Run a two-pass scan without index (filesystem only).
+/// This is the primary entry point for integration tests.
+pub fn scan_no_index(root: &Path, cfg: &Config) -> NyxResult<Vec<commands::scan::Diag>> {
+    commands::scan::scan_filesystem(root, cfg)
+}

src/main.rs

@@ -1,11 +1,16 @@
 mod ast;
 mod cfg;
+mod cfg_analysis;
 mod cli;
 mod commands;
 mod database;
 mod errors;
+mod interop;
 mod labels;
 mod patterns;
+mod summary;
+mod symbol;
+mod taint;
 mod utils;
 mod walk;
 
@@ -53,6 +58,7 @@ fn main() -> NyxResult<()> {
     let proj_dirs = ProjectDirs::from("dev", "ecpeter23", "nyx")
         .ok_or("Unable to determine project directories")?;
 
+    // todo: check if we want to actually build a config file, maybe some environments will not want to have anything written
     let config_dir = proj_dirs.config_dir();
     fs::create_dir_all(config_dir)?;
 

src/patterns/javascript.rs

@@ -19,12 +19,6 @@ pub const PATTERNS: &[Pattern] = &[
         query: "(call_expression function: (member_expression object: (identifier) @obj (#eq? @obj \"document\") property: (property_identifier) @prop (#eq? @prop \"write\"))) @vuln",
         severity: Severity::Medium,
     },
-    Pattern {
-        id: "inner_html_assignment",
-        description: "Assignment to element.innerHTML",
-        query: "(assignment_expression left: (member_expression property: (property_identifier) @prop (#eq? @prop \"innerHTML\"))) @vuln",
-        severity: Severity::Medium,
-    },
     Pattern {
         id: "settimeout_string",
         description: "setTimeout / setInterval with a string argument",

src/patterns/typescript.rs

@@ -19,12 +19,6 @@ pub const PATTERNS: &[Pattern] = &[
         query: "(call_expression function: (member_expression object: (identifier) @obj (#eq? @obj \"document\") property: (property_identifier) @prop (#eq? @prop \"write\"))) @vuln",
         severity: Severity::Medium,
     },
-    Pattern {
-        id: "inner_html_assignment",
-        description: "Assignment to element.innerHTML",
-        query: "(assignment_expression left: (member_expression property: (property_identifier) @prop (#eq? @prop \"innerHTML\"))) @vuln",
-        severity: Severity::Medium,
-    },
     Pattern {
         id: "settimeout_string",
         description: "setTimeout / setInterval with a string argument",

src/summary/mod.rs

@@ -0,0 +1,252 @@
+use crate::labels::{Cap, DataLabel};
+use crate::symbol::{FuncKey, Lang, normalize_namespace};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+/// Serialisable summary of a single function's taint behaviour.
+///
+/// One of these is produced per function during **pass 1** of a scan and
+/// persisted to the `function_summaries` SQLite table.  During **pass 2** the
+/// full set of summaries across every file is loaded into memory so the taint
+/// engine can resolve cross‑file calls.
+///
+/// Design notes
+/// ────────────
+/// * **All three cap fields are independent.**  A function can simultaneously
+///   act as a source (introduces fresh taint), a sanitizer (cleans certain
+///   bits), and a sink (passes tainted data to a dangerous operation).
+///   The old code picked a single `DataLabel` which lost information.
+///
+/// * **`propagates_taint`** captures pass‑through behaviour: if an input
+///   parameter is tainted, does the return value carry that taint?  This is
+///   essential for chains like `let y = transform(tainted_x); sink(y);`.
+///
+/// * **`callees`** are recorded for future call‑graph construction
+///   (topological analysis, approach 2) but are not used in pass‑1/pass‑2
+///   taint resolution yet.
+///
+/// * **`tainted_sink_params`** marks which parameter *positions* flow to
+///   internal sinks.  Today the taint engine treats the whole call as a
+///   single "tainted or not" question; this field future‑proofs the summary
+///   for per‑argument precision.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct FuncSummary {
+    /// Function name as it appears in the source (`my_func`, not the full path).
+    pub name: String,
+
+    /// Absolute path of the file that defines this function.
+    pub file_path: String,
+
+    /// Language slug (`"rust"`, `"javascript"`, …).
+    pub lang: String,
+
+    // ── Signature information ────────────────────────────────────────────
+    /// Total number of parameters (including `self`/`&self` for methods).
+    pub param_count: usize,
+
+    /// Parameter names in declaration order.
+    pub param_names: Vec<String>,
+
+    // ── Taint behaviour ──────────────────────────────────────────────────
+    // Stored as raw `u8` so serde doesn't need to know about `bitflags`.
+    /// Caps this function **introduces** — i.e. the return value carries
+    /// freshly‑tainted data even if no argument was tainted.
+    pub source_caps: u8,
+
+    /// Caps this function **cleans** — passing tainted data through this
+    /// function strips the corresponding bits.
+    pub sanitizer_caps: u8,
+
+    /// Caps this function **consumes unsafely** — calling it with tainted
+    /// arguments that still carry these bits is a finding.
+    pub sink_caps: u8,
+
+    /// `true` when taint on *any* input parameter can flow through to the
+    /// return value.  Conservative: set to `true` if *any* code path
+    /// propagates an argument to the return expression.
+    pub propagates_taint: bool,
+
+    /// Indices of parameters that flow to internal sinks (0‑based).
+    pub tainted_sink_params: Vec<usize>,
+
+    /// Names of functions/methods/macros called inside this function body.
+    /// Stored for future call‑graph / topological‑sort analysis.
+    pub callees: Vec<String>,
+}
+
+// ── Cap conversion helpers ──────────────────────────────────────────────
+
+impl FuncSummary {
+    #[inline]
+    pub fn source_caps(&self) -> Cap {
+        Cap::from_bits_truncate(self.source_caps)
+    }
+
+    #[inline]
+    pub fn sanitizer_caps(&self) -> Cap {
+        Cap::from_bits_truncate(self.sanitizer_caps)
+    }
+
+    #[inline]
+    pub fn sink_caps(&self) -> Cap {
+        Cap::from_bits_truncate(self.sink_caps)
+    }
+
+    /// Collapse the three independent cap fields back into the single
+    /// `DataLabel` that the current taint engine expects.
+    ///
+    /// Priority: **Sink > Source > Sanitizer**.  Sinks first because
+    /// missing a dangerous call‑site is worse than a false‑positive on a
+    /// source.  Sources beat sanitizers because an un‑tracked source is
+    /// a missed vulnerability, while an un‑tracked sanitizer only causes
+    /// false positives.
+    #[allow(dead_code)]
+    pub fn primary_label(&self) -> Option<DataLabel> {
+        let sink = self.sink_caps();
+        let src = self.source_caps();
+        let san = self.sanitizer_caps();
+
+        if !sink.is_empty() {
+            Some(DataLabel::Sink(sink))
+        } else if !src.is_empty() {
+            Some(DataLabel::Source(src))
+        } else if !san.is_empty() {
+            Some(DataLabel::Sanitizer(san))
+        } else {
+            None
+        }
+    }
+
+    /// Returns `true` when this function has **any** observable taint
+    /// effect — it is a source, sanitizer, sink, or propagates taint.
+    #[allow(dead_code)]
+    pub fn is_interesting(&self) -> bool {
+        self.source_caps != 0
+            || self.sanitizer_caps != 0
+            || self.sink_caps != 0
+            || self.propagates_taint
+    }
+
+    /// Build a [`FuncKey`] from this summary, normalizing the namespace
+    /// relative to `scan_root`.
+    pub fn func_key(&self, scan_root: Option<&str>) -> FuncKey {
+        FuncKey {
+            lang: Lang::from_slug(&self.lang).unwrap_or(Lang::Rust),
+            namespace: normalize_namespace(&self.file_path, scan_root),
+            name: self.name.clone(),
+            arity: Some(self.param_count),
+        }
+    }
+}
+
+// ── Lookup map used by the taint engine ─────────────────────────────────
+
+/// A merged view of all function summaries keyed by qualified [`FuncKey`].
+///
+/// Functions are partitioned by language + namespace + name + arity.  Two
+/// functions with the same bare name but different languages or namespaces
+/// are stored separately — no implicit cross-language merging occurs.
+///
+/// A secondary index `(Lang, name)` supports fast lookup by language + name
+/// for same-language resolution in the taint engine.
+#[derive(Default)]
+pub struct GlobalSummaries {
+    by_key: HashMap<FuncKey, FuncSummary>,
+    by_lang_name: HashMap<(Lang, String), Vec<FuncKey>>,
+}
+
+impl GlobalSummaries {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Insert or merge a summary.  If an exact `FuncKey` match exists,
+    /// merge conservatively (OR caps/booleans, union params/callees).
+    pub fn insert(&mut self, key: FuncKey, summary: FuncSummary) {
+        let lang = key.lang;
+        let name = key.name.clone();
+
+        self.by_key
+            .entry(key.clone())
+            .and_modify(|existing| {
+                existing.source_caps |= summary.source_caps;
+                existing.sanitizer_caps |= summary.sanitizer_caps;
+                existing.sink_caps |= summary.sink_caps;
+                existing.propagates_taint |= summary.propagates_taint;
+                for &idx in &summary.tainted_sink_params {
+                    if !existing.tainted_sink_params.contains(&idx) {
+                        existing.tainted_sink_params.push(idx);
+                    }
+                }
+                for c in &summary.callees {
+                    if !existing.callees.contains(c) {
+                        existing.callees.push(c.clone());
+                    }
+                }
+            })
+            .or_insert(summary);
+
+        let keys = self.by_lang_name.entry((lang, name)).or_default();
+        if !keys.contains(&key) {
+            keys.push(key);
+        }
+    }
+
+    /// Exact lookup by fully-qualified key.
+    pub fn get(&self, key: &FuncKey) -> Option<&FuncSummary> {
+        self.by_key.get(key)
+    }
+
+    /// All same-language matches for a bare function name.
+    pub fn lookup_same_lang(&self, lang: Lang, name: &str) -> Vec<(&FuncKey, &FuncSummary)> {
+        self.by_lang_name
+            .get(&(lang, name.to_string()))
+            .map(|keys| {
+                keys.iter()
+                    .filter_map(|k| self.by_key.get(k).map(|v| (k, v)))
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+
+    #[allow(dead_code)]
+    pub fn is_empty(&self) -> bool {
+        self.by_key.is_empty()
+    }
+
+    /// Iterate over all (key, summary) pairs.
+    #[allow(dead_code)]
+    pub fn iter(&self) -> impl Iterator<Item = (&FuncKey, &FuncSummary)> {
+        self.by_key.iter()
+    }
+}
+
+impl std::fmt::Debug for GlobalSummaries {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("GlobalSummaries")
+            .field("len", &self.by_key.len())
+            .finish()
+    }
+}
+
+/// Merge a set of per‑file summaries into a single `GlobalSummaries` map.
+///
+/// Merging only happens for exact `FuncKey` matches (same lang + namespace +
+/// name + arity).  Functions with the same bare name but different languages
+/// or namespaces are stored separately.
+pub fn merge_summaries(
+    per_file: impl IntoIterator<Item = FuncSummary>,
+    scan_root: Option<&str>,
+) -> GlobalSummaries {
+    let mut map = GlobalSummaries::new();
+
+    for fs in per_file {
+        let key = fs.func_key(scan_root);
+        map.insert(key, fs);
+    }
+
+    map
+}
+
+#[cfg(test)]
+mod tests;

src/summary/tests.rs

@@ -0,0 +1,258 @@
+use super::*;
+
+fn make(name: &str, src: u8, san: u8, sink: u8) -> FuncSummary {
+    FuncSummary {
+        name: name.into(),
+        file_path: "test.rs".into(),
+        lang: "rust".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: src,
+        sanitizer_caps: san,
+        sink_caps: sink,
+        propagates_taint: false,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    }
+}
+
+#[test]
+fn primary_label_priority() {
+    // sink beats everything
+    let s = make("f", 0xFF, 0xFF, 0x01);
+    assert!(matches!(s.primary_label(), Some(DataLabel::Sink(_))));
+
+    // source beats sanitizer
+    let s = make("f", 0x01, 0x02, 0x00);
+    assert!(matches!(s.primary_label(), Some(DataLabel::Source(_))));
+
+    // sanitizer alone
+    let s = make("f", 0x00, 0x04, 0x00);
+    assert!(matches!(s.primary_label(), Some(DataLabel::Sanitizer(_))));
+
+    // nothing
+    let s = make("f", 0, 0, 0);
+    assert!(s.primary_label().is_none());
+}
+
+#[test]
+fn merge_unions_conservatively() {
+    let a = make("foo", 0x01, 0x00, 0x00);
+    let b = FuncSummary {
+        sink_caps: 0x04,
+        propagates_taint: true,
+        tainted_sink_params: vec![0],
+        callees: vec!["bar".into()],
+        ..make("foo", 0x00, 0x02, 0x00)
+    };
+
+    let merged = merge_summaries(vec![a, b], None);
+    let key = FuncKey {
+        lang: Lang::Rust,
+        namespace: "test.rs".into(),
+        name: "foo".into(),
+        arity: Some(0),
+    };
+    let foo = merged.get(&key).unwrap();
+
+    assert_eq!(foo.source_caps, 0x01);
+    assert_eq!(foo.sanitizer_caps, 0x02);
+    assert_eq!(foo.sink_caps, 0x04);
+    assert!(foo.propagates_taint);
+    assert_eq!(foo.tainted_sink_params, vec![0]);
+    assert_eq!(foo.callees, vec!["bar".to_string()]);
+}
+
+#[test]
+fn is_interesting_detects_all_cases() {
+    assert!(!make("f", 0, 0, 0).is_interesting());
+    assert!(make("f", 1, 0, 0).is_interesting());
+    assert!(make("f", 0, 1, 0).is_interesting());
+    assert!(make("f", 0, 0, 1).is_interesting());
+
+    let mut p = make("f", 0, 0, 0);
+    p.propagates_taint = true;
+    assert!(p.is_interesting());
+}
+
+#[test]
+fn same_lang_different_namespace_no_merge() {
+    let a = FuncSummary {
+        name: "helper".into(),
+        file_path: "file_a.rs".into(),
+        lang: "rust".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: Cap::all().bits(),
+        sanitizer_caps: 0,
+        sink_caps: 0,
+        propagates_taint: false,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+    let b = FuncSummary {
+        name: "helper".into(),
+        file_path: "file_b.rs".into(),
+        lang: "rust".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: 0,
+        sanitizer_caps: 0,
+        sink_caps: Cap::SHELL_ESCAPE.bits(),
+        propagates_taint: false,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+
+    let global = merge_summaries(vec![a, b], None);
+
+    // They should be stored under different FuncKeys
+    let key_a = FuncKey {
+        lang: Lang::Rust,
+        namespace: "file_a.rs".into(),
+        name: "helper".into(),
+        arity: Some(0),
+    };
+    let key_b = FuncKey {
+        lang: Lang::Rust,
+        namespace: "file_b.rs".into(),
+        name: "helper".into(),
+        arity: Some(0),
+    };
+    assert!(global.get(&key_a).is_some());
+    assert!(global.get(&key_b).is_some());
+    // source_caps NOT merged
+    assert_eq!(global.get(&key_a).unwrap().source_caps, Cap::all().bits());
+    assert_eq!(global.get(&key_b).unwrap().source_caps, 0);
+}
+
+#[test]
+fn same_lang_same_namespace_merges() {
+    let a = FuncSummary {
+        name: "helper".into(),
+        file_path: "lib.rs".into(),
+        lang: "rust".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: 0x01,
+        sanitizer_caps: 0,
+        sink_caps: 0,
+        propagates_taint: false,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+    let b = FuncSummary {
+        name: "helper".into(),
+        file_path: "lib.rs".into(),
+        lang: "rust".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: 0,
+        sanitizer_caps: 0x02,
+        sink_caps: 0,
+        propagates_taint: true,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+
+    let global = merge_summaries(vec![a, b], None);
+    let key = FuncKey {
+        lang: Lang::Rust,
+        namespace: "lib.rs".into(),
+        name: "helper".into(),
+        arity: Some(0),
+    };
+    let merged = global.get(&key).unwrap();
+    assert_eq!(merged.source_caps, 0x01);
+    assert_eq!(merged.sanitizer_caps, 0x02);
+    assert!(merged.propagates_taint);
+}
+
+#[test]
+fn cross_lang_name_collision_stays_separate() {
+    let py = FuncSummary {
+        name: "process_data".into(),
+        file_path: "handler.py".into(),
+        lang: "python".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: Cap::all().bits(),
+        sanitizer_caps: 0,
+        sink_caps: 0,
+        propagates_taint: false,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+    let c = FuncSummary {
+        name: "process_data".into(),
+        file_path: "handler.c".into(),
+        lang: "c".into(),
+        param_count: 1,
+        param_names: vec!["s".into()],
+        source_caps: 0,
+        sanitizer_caps: 0,
+        sink_caps: 0,
+        propagates_taint: true,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+
+    let global = merge_summaries(vec![py, c], None);
+
+    let py_key = FuncKey {
+        lang: Lang::Python,
+        namespace: "handler.py".into(),
+        name: "process_data".into(),
+        arity: Some(0),
+    };
+    let c_key = FuncKey {
+        lang: Lang::C,
+        namespace: "handler.c".into(),
+        name: "process_data".into(),
+        arity: Some(1),
+    };
+
+    assert!(global.get(&py_key).is_some());
+    assert!(global.get(&c_key).is_some());
+    // Python's source_caps NOT merged into C
+    assert_eq!(global.get(&c_key).unwrap().source_caps, 0);
+    assert_eq!(global.get(&py_key).unwrap().source_caps, Cap::all().bits());
+}
+
+#[test]
+fn lookup_same_lang_returns_all_matches() {
+    let a = FuncSummary {
+        name: "helper".into(),
+        file_path: "a.rs".into(),
+        lang: "rust".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: 1,
+        sanitizer_caps: 0,
+        sink_caps: 0,
+        propagates_taint: false,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+    let b = FuncSummary {
+        name: "helper".into(),
+        file_path: "b.rs".into(),
+        lang: "rust".into(),
+        param_count: 0,
+        param_names: vec![],
+        source_caps: 2,
+        sanitizer_caps: 0,
+        sink_caps: 0,
+        propagates_taint: false,
+        tainted_sink_params: vec![],
+        callees: vec![],
+    };
+
+    let global = merge_summaries(vec![a, b], None);
+    let matches = global.lookup_same_lang(Lang::Rust, "helper");
+    assert_eq!(matches.len(), 2);
+
+    // No cross-language matches
+    let py_matches = global.lookup_same_lang(Lang::Python, "helper");
+    assert!(py_matches.is_empty());
+}

src/symbol/mod.rs

@@ -0,0 +1,94 @@
+use serde::{Deserialize, Serialize};
+use std::fmt;
+
+/// Supported source-code languages.
+#[derive(Clone, Copy, Debug, Hash, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Lang {
+    Rust,
+    C,
+    Cpp,
+    Java,
+    Go,
+    Php,
+    Python,
+    Ruby,
+    TypeScript,
+    JavaScript,
+}
+
+impl Lang {
+    /// Parse a language slug (as returned by `lang_for_path`) into a `Lang`.
+    pub fn from_slug(s: &str) -> Option<Lang> {
+        match s {
+            "rust" => Some(Lang::Rust),
+            "c" => Some(Lang::C),
+            "cpp" => Some(Lang::Cpp),
+            "java" => Some(Lang::Java),
+            "go" => Some(Lang::Go),
+            "php" => Some(Lang::Php),
+            "python" => Some(Lang::Python),
+            "ruby" => Some(Lang::Ruby),
+            "typescript" | "ts" => Some(Lang::TypeScript),
+            "javascript" | "js" => Some(Lang::JavaScript),
+            _ => None,
+        }
+    }
+
+    /// Canonical slug string for this language.
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Lang::Rust => "rust",
+            Lang::C => "c",
+            Lang::Cpp => "cpp",
+            Lang::Java => "java",
+            Lang::Go => "go",
+            Lang::Php => "php",
+            Lang::Python => "python",
+            Lang::Ruby => "ruby",
+            Lang::TypeScript => "typescript",
+            Lang::JavaScript => "javascript",
+        }
+    }
+}
+
+impl fmt::Display for Lang {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+/// Uniquely identifies a function across the entire project.
+#[derive(Clone, Debug, Hash, PartialEq, Eq, Serialize, Deserialize)]
+pub struct FuncKey {
+    pub lang: Lang,
+    /// Project-relative file path (e.g. `"src/lib.rs"`).
+    pub namespace: String,
+    pub name: String,
+    pub arity: Option<usize>,
+}
+
+impl fmt::Display for FuncKey {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}::{}::{}", self.lang, self.namespace, self.name)?;
+        if let Some(a) = self.arity {
+            write!(f, "/{a}")?;
+        }
+        Ok(())
+    }
+}
+
+/// Strip `root` prefix from `abs_path` to produce a stable project-relative path.
+///
+/// Falls back to the full path if stripping fails (e.g. in tests with synthetic paths).
+pub fn normalize_namespace(abs_path: &str, root: Option<&str>) -> String {
+    if let Some(r) = root {
+        let r = r.trim_end_matches('/');
+        if let Some(rest) = abs_path.strip_prefix(r) {
+            return rest.trim_start_matches('/').to_string();
+        }
+    }
+    abs_path.to_string()
+}
+
+#[cfg(test)]
+mod tests;

src/symbol/tests.rs

@@ -0,0 +1,62 @@
+use super::*;
+
+#[test]
+fn lang_round_trip() {
+    for slug in &[
+        "rust",
+        "c",
+        "cpp",
+        "java",
+        "go",
+        "php",
+        "python",
+        "ruby",
+        "typescript",
+        "javascript",
+    ] {
+        let lang = Lang::from_slug(slug).unwrap();
+        assert_eq!(lang.as_str(), *slug);
+    }
+}
+
+#[test]
+fn lang_aliases() {
+    assert_eq!(Lang::from_slug("js"), Some(Lang::JavaScript));
+    assert_eq!(Lang::from_slug("ts"), Some(Lang::TypeScript));
+}
+
+#[test]
+fn func_key_display() {
+    let k = FuncKey {
+        lang: Lang::Rust,
+        namespace: "src/lib.rs".into(),
+        name: "my_func".into(),
+        arity: Some(2),
+    };
+    assert_eq!(k.to_string(), "rust::src/lib.rs::my_func/2");
+}
+
+#[test]
+fn normalize_strips_root() {
+    assert_eq!(
+        normalize_namespace("/home/user/proj/src/lib.rs", Some("/home/user/proj")),
+        "src/lib.rs"
+    );
+    assert_eq!(
+        normalize_namespace("/home/user/proj/src/lib.rs", Some("/home/user/proj/")),
+        "src/lib.rs"
+    );
+}
+
+#[test]
+fn normalize_fallback_on_no_root() {
+    assert_eq!(normalize_namespace("test.rs", None), "test.rs");
+}
+
+#[test]
+fn normalize_fallback_on_mismatch() {
+    assert_eq!(
+        normalize_namespace("/other/path/lib.rs", Some("/home/user/proj")),
+        "/other/path/lib.rs"
+    );
+}

src/taint/mod.rs

@@ -0,0 +1,429 @@
+use crate::cfg::{Cfg, FuncSummaries, NodeInfo, StmtKind};
+use crate::interop::InteropEdge;
+use crate::labels::{Cap, DataLabel};
+use crate::summary::GlobalSummaries;
+use crate::symbol::Lang;
+use petgraph::graph::NodeIndex;
+use std::collections::HashMap;
+use tracing::debug;
+
+/// A detected taint finding with both source and sink locations.
+#[derive(Debug, Clone)]
+pub struct Finding {
+    /// The CFG node where tainted data reaches a dangerous operation.
+    pub sink: NodeIndex,
+    /// The CFG node where taint originated (may be Entry if source is
+    /// cross-file and couldn't be pinpointed to a specific node).
+    pub source: NodeIndex,
+    /// The full path from source to sink through the CFG.
+    #[allow(dead_code)] // used for future detailed diagnostics / path display
+    pub path: Vec<NodeIndex>,
+}
+
+fn taint_hash(taint: &HashMap<String, Cap>) -> u64 {
+    let mut v: Vec<_> = taint.iter().collect();
+    v.sort_by_key(|(k, _)| k.as_str());
+    let mut hasher = blake3::Hasher::new();
+    for (k, bits) in v {
+        hasher.update(k.as_bytes());
+        hasher.update(&bits.bits().to_le_bytes());
+    }
+    let digest = hasher.finalize();
+    u64::from_le_bytes(digest.as_bytes()[0..8].try_into().unwrap())
+}
+
+/// Resolved summary for a callee — a uniform view regardless of whether the
+/// summary came from a local (same‑file) or global (cross‑file) source.
+struct ResolvedSummary {
+    source_caps: Cap,
+    sanitizer_caps: Cap,
+    sink_caps: Cap,
+    propagates_taint: bool,
+}
+
+/// Try to resolve a callee name using conservative same-language resolution.
+///
+/// Resolution order:
+/// 1. Local (same-file): exact name + same lang + same namespace
+/// 2. Global same-language: via `lookup_same_lang`; must be unambiguous
+/// 3. Interop edges: explicit cross-language bridges
+/// 4. No cross-language fallback
+#[allow(clippy::too_many_arguments)]
+fn resolve_callee(
+    callee: &str,
+    caller_lang: Lang,
+    caller_namespace: &str,
+    caller_func: &str,
+    call_ordinal: u32,
+    local: &FuncSummaries,
+    global: Option<&GlobalSummaries>,
+    interop_edges: &[InteropEdge],
+) -> Option<ResolvedSummary> {
+    // 1) Local (same-file): scan local summaries for matching name + lang + namespace
+    let local_matches: Vec<_> = local
+        .iter()
+        .filter(|(k, _)| {
+            k.name == callee && k.lang == caller_lang && k.namespace == caller_namespace
+        })
+        .collect();
+
+    if local_matches.len() == 1 {
+        let (_, ls) = local_matches[0];
+        return Some(ResolvedSummary {
+            source_caps: ls.source_caps,
+            sanitizer_caps: ls.sanitizer_caps,
+            sink_caps: ls.sink_caps,
+            propagates_taint: ls.propagates_taint,
+        });
+    }
+
+    // Multiple local matches — try arity disambiguation (future), for now return None
+    if local_matches.len() > 1 {
+        return None;
+    }
+
+    // 2) Global same-language
+    if let Some(gs) = global {
+        let matches = gs.lookup_same_lang(caller_lang, callee);
+        if matches.len() == 1 {
+            let (_, fs) = matches[0];
+            return Some(ResolvedSummary {
+                source_caps: fs.source_caps(),
+                sanitizer_caps: fs.sanitizer_caps(),
+                sink_caps: fs.sink_caps(),
+                propagates_taint: fs.propagates_taint,
+            });
+        }
+        // Multiple matches — try namespace match first
+        if matches.len() > 1 {
+            let same_ns: Vec<_> = matches
+                .iter()
+                .filter(|(k, _)| k.namespace == caller_namespace)
+                .collect();
+            if same_ns.len() == 1 {
+                let (_, fs) = same_ns[0];
+                return Some(ResolvedSummary {
+                    source_caps: fs.source_caps(),
+                    sanitizer_caps: fs.sanitizer_caps(),
+                    sink_caps: fs.sink_caps(),
+                    propagates_taint: fs.propagates_taint,
+                });
+            }
+            // Still ambiguous — return None (conservative)
+            return None;
+        }
+    }
+
+    // 3) Interop edges: explicit cross-language bridges
+    for edge in interop_edges {
+        if edge.from.caller_lang == caller_lang
+            && edge.from.caller_namespace == caller_namespace
+            && edge.from.callee_symbol == callee
+            && (edge.from.caller_func.is_empty() || edge.from.caller_func == caller_func)
+            && (edge.from.ordinal == 0 || edge.from.ordinal == call_ordinal)
+        {
+            // Look up the target in global summaries by exact FuncKey
+            if let Some(gs) = global
+                && let Some(fs) = gs.get(&edge.to)
+            {
+                return Some(ResolvedSummary {
+                    source_caps: fs.source_caps(),
+                    sanitizer_caps: fs.sanitizer_caps(),
+                    sink_caps: fs.sink_caps(),
+                    propagates_taint: fs.propagates_taint,
+                });
+            }
+        }
+    }
+
+    // 4) No cross-language fallback
+    None
+}
+
+fn apply_taint(
+    node: &NodeInfo,
+    taint: &HashMap<String, Cap>,
+    local_summaries: &FuncSummaries,
+    global_summaries: Option<&GlobalSummaries>,
+    caller_lang: Lang,
+    caller_namespace: &str,
+    interop_edges: &[InteropEdge],
+) -> HashMap<String, Cap> {
+    debug!(target: "taint", "Applying taint to node: {:?}", node);
+    debug!(target: "taint", "Taint: {:?}", taint);
+    let mut out = taint.clone();
+
+    let caller_func = node.enclosing_func.as_deref().unwrap_or("");
+
+    match node.label {
+        // A new untrusted value enters the program
+        Some(DataLabel::Source(bits)) => {
+            if let Some(v) = &node.defines {
+                out.insert(v.clone(), bits);
+            }
+        }
+        // Sanitizer: propagate input taint through the assignment FIRST,
+        // then strip the sanitizer's capability bits.  This ensures that
+        // `let y = sanitize_html(&x)` gives y the taint of x minus the
+        // HTML_ESCAPE bit — rather than leaving y completely clean (which
+        // would hide "wrong sanitiser for this sink" bugs).
+        Some(DataLabel::Sanitizer(bits)) => {
+            if let Some(v) = &node.defines {
+                // 1. Propagate: union taint from all read variables
+                let mut combined = Cap::empty();
+                for u in &node.uses {
+                    if let Some(b) = out.get(u) {
+                        combined |= *b;
+                    }
+                }
+                // 2. Strip the sanitiser's bits
+                let new = combined & !bits;
+                if new.is_empty() {
+                    out.remove(v);
+                } else {
+                    out.insert(v.clone(), new);
+                }
+            }
+        }
+
+        // A function call — resolve against local + global summaries
+        _ if node.kind == StmtKind::Call => {
+            if let Some(callee) = &node.callee
+                && let Some(resolved) = resolve_callee(
+                    callee,
+                    caller_lang,
+                    caller_namespace,
+                    caller_func,
+                    node.call_ordinal,
+                    local_summaries,
+                    global_summaries,
+                    interop_edges,
+                )
+            {
+                // Build the return value's taint bits in stages, then
+                // write once at the end.  Order matters:
+                //
+                //   1. Start with fresh source taint (if the callee is a source)
+                //   2. Union with propagated arg taint (if the callee propagates)
+                //   3. Strip sanitizer bits last (so sanitization always wins)
+
+                let mut return_bits = Cap::empty();
+
+                // ── 1. Source behaviour ──
+                return_bits |= resolved.source_caps;
+
+                // ── 2. Propagation ──
+                if resolved.propagates_taint {
+                    for u in &node.uses {
+                        if let Some(bits) = out.get(u) {
+                            return_bits |= *bits;
+                        }
+                    }
+                }
+
+                // ── 3. Sanitizer behaviour (applied last so it always wins) ──
+                return_bits &= !resolved.sanitizer_caps;
+
+                // ── Write the result ──
+                if let Some(v) = &node.defines {
+                    if return_bits.is_empty() {
+                        out.remove(v);
+                    } else {
+                        out.insert(v.clone(), return_bits);
+                    }
+                }
+
+                // ── Sink behaviour: handled in the main analysis loop
+                //    (checked via node.label or resolved summary) ──
+
+                return out;
+            }
+
+            // Unresolved call — fall through to default gen/kill below
+        }
+
+        // All other statements: classic gen/kill for assignments
+        _ => {}
+    }
+
+    // Default gen/kill: propagate taint through variable assignments
+    if !matches!(
+        node.label,
+        Some(DataLabel::Source(_)) | Some(DataLabel::Sanitizer(_))
+    ) && let Some(d) = &node.defines
+    {
+        let mut combined = Cap::empty();
+        for u in &node.uses {
+            if let Some(bits) = out.get(u) {
+                combined |= *bits;
+            }
+        }
+        if combined.is_empty() {
+            out.remove(d);
+        } else {
+            out.insert(d.clone(), combined);
+        }
+    }
+
+    out
+}
+
+/// Run taint analysis on a single file's CFG.
+///
+/// `global_summaries` is `None` for pass‑1 / single‑file mode and
+/// `Some(&map)` for pass‑2 cross‑file analysis.
+pub fn analyse_file(
+    cfg: &Cfg,
+    entry: NodeIndex,
+    local_summaries: &FuncSummaries,
+    global_summaries: Option<&GlobalSummaries>,
+    caller_lang: Lang,
+    caller_namespace: &str,
+    interop_edges: &[InteropEdge],
+) -> Vec<Finding> {
+    use std::collections::{HashMap, HashSet, VecDeque};
+
+    /// Queue item: current CFG node + taint map that holds here
+    #[derive(Clone)]
+    struct Item {
+        node: NodeIndex,
+        taint: HashMap<String, Cap>,
+    }
+
+    // (node, taint_hash)  →  predecessor key   (for path rebuild)
+    type Key = (NodeIndex, u64);
+    let mut pred: HashMap<Key, Key> = HashMap::new();
+
+    // Seen states so we do not revisit them infinitely
+    let mut seen: HashSet<Key> = HashSet::new();
+
+    // Resulting findings: (sink_node, source_node, full_path)
+    let mut findings: Vec<Finding> = Vec::new();
+
+    let mut q = VecDeque::new();
+    q.push_back(Item {
+        node: entry,
+        taint: HashMap::new(),
+    });
+    seen.insert((entry, 0));
+
+    while let Some(Item { node, taint }) = q.pop_front() {
+        let caller_func = cfg[node].enclosing_func.as_deref().unwrap_or("");
+        let out = apply_taint(
+            &cfg[node],
+            &taint,
+            local_summaries,
+            global_summaries,
+            caller_lang,
+            caller_namespace,
+            interop_edges,
+        );
+
+        // ── Sink check ──────────────────────────────────────────────────
+        // Two ways a node can be a sink:
+        //   1. Its AST label says Sink (existing inline labels)
+        //   2. Its callee resolves to a function with sink_caps (cross-file)
+        let sink_caps = match cfg[node].label {
+            Some(DataLabel::Sink(caps)) => caps,
+            _ => {
+                // check if callee resolves to a sink
+                cfg[node]
+                    .callee
+                    .as_ref()
+                    .and_then(|c| {
+                        resolve_callee(
+                            c,
+                            caller_lang,
+                            caller_namespace,
+                            caller_func,
+                            cfg[node].call_ordinal,
+                            local_summaries,
+                            global_summaries,
+                            interop_edges,
+                        )
+                    })
+                    .filter(|r| !r.sink_caps.is_empty())
+                    .map(|r| r.sink_caps)
+                    .unwrap_or(Cap::empty())
+            }
+        };
+
+        if !sink_caps.is_empty() {
+            let bad = cfg[node]
+                .uses
+                .iter()
+                .any(|u| out.get(u).is_some_and(|b| (*b & sink_caps) != Cap::empty()));
+            if bad {
+                // Reconstruct path backwards from sink to source.
+                //
+                // A node is considered a "source" if:
+                //   1. It has an inline DataLabel::Source (same-file), OR
+                //   2. It is a Call whose callee resolves to a source via
+                //      local or global summaries (cross-file).
+                let sink_node = node;
+                let mut path = vec![node];
+                let mut source_node = node; // fallback: sink itself
+                let mut key = (node, taint_hash(&taint));
+
+                while let Some(&(prev, prev_hash)) = pred.get(&key) {
+                    path.push(prev);
+
+                    // Check inline source label
+                    if matches!(cfg[prev].label, Some(DataLabel::Source(_))) {
+                        source_node = prev;
+                        break;
+                    }
+
+                    // Check cross-file source via resolved callee summary
+                    let prev_caller_func = cfg[prev].enclosing_func.as_deref().unwrap_or("");
+                    if cfg[prev].kind == StmtKind::Call
+                        && let Some(callee) = &cfg[prev].callee
+                        && let Some(resolved) = resolve_callee(
+                            callee,
+                            caller_lang,
+                            caller_namespace,
+                            prev_caller_func,
+                            cfg[prev].call_ordinal,
+                            local_summaries,
+                            global_summaries,
+                            interop_edges,
+                        )
+                        && !resolved.source_caps.is_empty()
+                    {
+                        source_node = prev;
+                        break;
+                    }
+
+                    key = (prev, prev_hash);
+                }
+
+                path.reverse();
+                findings.push(Finding {
+                    sink: sink_node,
+                    source: source_node,
+                    path,
+                });
+            }
+        }
+
+        // enqueue successors
+        for succ in cfg.neighbors(node) {
+            let h = taint_hash(&out);
+            let key = (succ, h);
+            if !seen.contains(&key) {
+                seen.insert(key);
+                pred.insert(key, (node, taint_hash(&taint)));
+                let item = Item {
+                    node: succ,
+                    taint: out.clone(),
+                };
+                q.push_back(item);
+            }
+        }
+    }
+
+    findings
+}
+
+#[cfg(test)]
+mod tests;

src/utils/ext.rs

@@ -9,6 +9,7 @@ pub fn lowercase_ext(path: &std::path::Path) -> Option<&'static str> {
         "py" | "PY" => Some("py"),
         "ts" | "TSX" | "tsx" => Some("ts"),
         "js" => Some("js"),
+        "rb" | "RB" => Some("rb"),
         _ => None,
     })
 }

src/walk.rs

@@ -1,62 +1,82 @@
+use crate::utils::Config;
 use crossbeam_channel::{Receiver, Sender, bounded};
 use ignore::{WalkBuilder, WalkState, overrides::OverrideBuilder};
+use std::thread::JoinHandle;
 use std::{
     mem,
     path::{Path, PathBuf},
     thread,
 };
 
-use crate::utils::Config;
-
 // ---------------------------------------------------------------------------
 // Internal constants / helpers
 // ---------------------------------------------------------------------------
 
-type Batch = Vec<PathBuf>;
+type Paths = Vec<PathBuf>;
 
-struct Batcher {
-    tx: Sender<Batch>,
-    batch: Batch,
+struct BatchSender {
+    tx: Sender<Paths>,
+    batch: Paths,
+    batch_size: usize,
 }
-impl Batcher {
-    fn push(&mut self, p: PathBuf, batch_size: usize) {
-        self.batch.push(p);
-        if self.batch.len() == batch_size {
+impl BatchSender {
+    fn new(tx: Sender<Paths>, batch_size: usize) -> Self {
+        Self {
+            tx,
+            batch: Vec::with_capacity(batch_size),
+            batch_size,
+        }
+    }
+
+    fn push_path(&mut self, path: PathBuf) {
+        self.batch.push(path);
+        if self.batch.len() >= self.batch_size {
             self.flush();
         }
     }
+
     fn flush(&mut self) {
         if !self.batch.is_empty() {
+            tracing::debug!(n_paths = self.batch.len(), "flushing batch");
             let _ = self.tx.send(mem::take(&mut self.batch));
         }
     }
 }
-impl Drop for Batcher {
+impl Drop for BatchSender {
     fn drop(&mut self) {
         self.flush();
     }
 }
 
-// ---------------------------------------------------------------------------
-/// Walk `root` and send *batches* of paths through the returned channel.
-pub fn spawn_senders(root: &Path, cfg: &Config) -> Receiver<Batch> {
-    // ----- 1  build ignore/override rules ----------------------------------
+fn build_overrides(root: &Path, cfg: &Config) -> ignore::overrides::Override {
     let mut ob = OverrideBuilder::new(root);
+
     for ext in &cfg.scanner.excluded_extensions {
         if let Err(e) = ob.add(&format!("!*.{ext}")) {
-            tracing::warn!("cannot add ignore pattern ‘{ext}’: {e}");
+            tracing::warn!("invalid exclude‐extension pattern ‘{ext}’: {e}");
         }
     }
     for dir in &cfg.scanner.excluded_directories {
         if let Err(e) = ob.add(&format!("!**/{dir}/**")) {
-            tracing::warn!("cannot add ignore pattern ‘{dir}’: {e}");
+            tracing::warn!("invalid exclude‐dir pattern ‘{dir}’: {e}");
         }
     }
-    let overrides = ob.build().unwrap();
+
+    ob.build().unwrap_or_else(|e| {
+        tracing::error!("failed to build ignore overrides: {e}");
+        ignore::overrides::Override::empty()
+    })
+}
+
+// ---------------------------------------------------------------------------
+/// Walk `root` and send *batches* of paths through the returned channel.
+pub fn spawn_file_walker(root: &Path, cfg: &Config) -> (Receiver<Paths>, JoinHandle<()>) {
+    let _span = tracing::info_span!("spawn_file_walker", root = %root.display()).entered();
+    let overrides = build_overrides(root, cfg);
 
     // ----- 2  channel & thread pool parameters -----------------------------
     let workers = cfg.performance.worker_threads.unwrap_or(num_cpus::get());
-    let (tx, rx) = bounded::<Batch>(workers * cfg.performance.channel_multiplier);
+    let (tx, rx) = bounded::<Paths>(workers * cfg.performance.channel_multiplier);
 
     let root = root.to_path_buf();
     let scan_hidden = cfg.scanner.scan_hidden_files;
@@ -65,45 +85,48 @@ pub fn spawn_senders(root: &Path, cfg: &Config) -> Receiver<Batch> {
     let batch_size = cfg.performance.batch_size;
 
     // ----- 3  the background walker thread ---------------------------------
-    thread::spawn(move || {
+    let handle = thread::spawn(move || {
+        tracing::info!(
+            root = ?root,
+            workers = workers,
+            scan_hidden = scan_hidden,
+            follow_links = follow,
+            max_bytes = max_bytes,
+            batch_size = batch_size,
+            "starting directory walk"
+        );
+
         WalkBuilder::new(root)
             .hidden(!scan_hidden)
             .follow_links(follow)
             .threads(workers)
             .overrides(overrides)
+            .filter_entry(|e| {
+                e.file_type()
+                    .map(|ft| ft.is_dir() || ft.is_file())
+                    .unwrap_or(true)
+            })
             .build_parallel()
             .run(move || {
-                let mut b = Batcher {
-                    tx: tx.clone(),
-                    batch: Vec::with_capacity(batch_size),
-                };
+                let mut bs = BatchSender::new(tx.clone(), batch_size);
 
                 Box::new(move |entry| {
-                    tracing::debug!("walking {:?}", entry);
-                    let entry = match entry {
-                        Ok(e) if e.file_type().map(|ft| ft.is_file()).unwrap_or(false) => e,
-                        _ => return WalkState::Continue,
-                    };
+                    if let Ok(e) = entry {
+                        let is_file = e.file_type().is_some_and(|ft| ft.is_file());
+                        let under_limit = max_bytes == 0
+                            || e.metadata().map(|m| m.len() <= max_bytes).unwrap_or(true);
 
-                    if max_bytes != 0 {
-                        match entry.metadata() {
-                            Ok(m) if m.len() > max_bytes => return WalkState::Continue,
-                            Err(e) => {
-                                tracing::debug!("metadata failed for {:?}: {e}", entry.path());
-                                return WalkState::Continue;
-                            }
-                            _ => {}
+                        if is_file && under_limit {
+                            bs.push_path(e.into_path());
                         }
                     }
-
-                    tracing::debug!("sending {:?}", entry);
-                    b.push(entry.into_path(), batch_size);
                     WalkState::Continue
                 })
             });
+        tracing::info!("directory walk complete");
     });
 
-    rx
+    (rx, handle)
 }
 
 #[test]
@@ -118,7 +141,10 @@ fn walker_respects_excluded_extensions() {
     cfg.performance.channel_multiplier = 1;
     cfg.performance.batch_size = 2;
 
-    let rx = spawn_senders(tmp.path(), &cfg);
+    let (rx, handle) = spawn_file_walker(tmp.path(), &cfg);
+    if let Err(err) = handle.join() {
+        tracing::error!("walker thread panicked: {:#?}", err);
+    }
 
     let all: Vec<_> = rx.into_iter().flatten().collect();