What
The single highest-impact feature on the roadmap. Today the Code Property Graph resolves calls within a single file (_call_graph_builder.py is best-effort, same-file, name-based). Real Flask/Django vulnerabilities route through function-call boundaries across modules — so taint analysis is silent whenever source and sink live in different files. Closing this unlocks the TAINT_CONFIRMED rung on realistic codebases.
Scope (can be split into PRs)
- Multi-file import resolution — follow
import / from ... import statements to map call sites to definitions in other modules of the same package.
- Inter-module
CALLS edges — populate cross-file edges in the graph.
- Inter-procedural taint — extend
InMemoryCodeGraph.taint() to propagate across CALLS edges.
- Cross-file fixtures — add multi-module fixtures to the CPG conformance suite (e.g.
app.py imports db.py; a request.args value reaches cursor.execute across the boundary).
Deliberately over-approximate on ambiguous names rather than miss a real edge, matching the existing builder's stance. Keep the one-directional-proof discipline: False/no-path means "not proven", never "proven safe".
Why help-wanted, not good-first-issue
It's meaty and design-bearing (3–6 weeks of focused work per the roadmap), but very well-scoped and genuinely interesting program-analysis work. Happy to discuss design in Discussions before you start.
Pointers
packages/cortexward-cpg/src/cortexward/languages/python/_call_graph_builder.pypackages/cortexward-cpg/src/cortexward/cpg/graph.py (InMemoryCodeGraph.taint)- Roadmap context:
PROJECT_ROADMAP.md (Milestone 1), ROADMAP.md (Phase 2)
What
The single highest-impact feature on the roadmap. Today the Code Property Graph resolves calls within a single file (
_call_graph_builder.pyis best-effort, same-file, name-based). Real Flask/Django vulnerabilities route through function-call boundaries across modules — so taint analysis is silent whenever source and sink live in different files. Closing this unlocks theTAINT_CONFIRMEDrung on realistic codebases.Scope (can be split into PRs)
import/from ... importstatements to map call sites to definitions in other modules of the same package.CALLSedges — populate cross-file edges in the graph.InMemoryCodeGraph.taint()to propagate acrossCALLSedges.app.pyimportsdb.py; arequest.argsvalue reachescursor.executeacross the boundary).Deliberately over-approximate on ambiguous names rather than miss a real edge, matching the existing builder's stance. Keep the one-directional-proof discipline:
False/no-path means "not proven", never "proven safe".Why help-wanted, not good-first-issue
It's meaty and design-bearing (3–6 weeks of focused work per the roadmap), but very well-scoped and genuinely interesting program-analysis work. Happy to discuss design in Discussions before you start.
Pointers
packages/cortexward-cpg/src/cortexward/languages/python/_call_graph_builder.pypackages/cortexward-cpg/src/cortexward/cpg/graph.py(InMemoryCodeGraph.taint)PROJECT_ROADMAP.md(Milestone 1),ROADMAP.md(Phase 2)