🛡️ Sentinel: [security improvement] Add yaml.unsafe_load and yaml.full_load to serialization sinks

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2026-06-21 - [Add Unsafe PyYAML Loaders to Taint Tracking]
+**Vulnerability:** The static analyzer was missing `yaml.unsafe_load` and `yaml.full_load` in its `_SERIALISATION_SINKS` mapping, potentially leading to false negatives when tracking untrusted data flowing into these dangerous deserialization functions.
+**Learning:** Even if functions are listed in rule specifications (like `_SINK_SPECS`), they also need to be properly categorized in the core taint propagation logic (`_SERIALISATION_SINKS`) to ensure the analyzer correctly sheds validation provenance (converting output to `UNKNOWN_RAW`).
+**Prevention:** When adding new sinks to rule definitions, always verify if they need to be added to core propagation mappings like `_SERIALISATION_SINKS` or `_PROPAGATING_BUILTINS`.

src/wardline/scanner/taint/variable_level.py

@@ -57,6 +57,8 @@
         "yaml.load",
         "yaml.safe_load_all",
         "yaml.load_all",
+        "yaml.unsafe_load",
+        "yaml.full_load",
         "marshal.dumps",
         "marshal.dump",
         "marshal.loads",