Upload a codebase. An AST call-graph traces multi-hop taint paths and an LLM judges, hop by hop, whether input is genuinely sanitized before it reaches a dangerous sink.