{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:ZBVKRYQJ6CTPOY2SBN6WJAO4T6","short_pith_number":"pith:ZBVKRYQJ","canonical_record":{"source":{"id":"2506.06247","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-06-06T17:15:59Z","cross_cats_sorted":[],"title_canon_sha256":"a7c3b1944427b140943752d065f6a4dec6baf4a6c21d1cb57c09f77cee0f8acc","abstract_canon_sha256":"d8a58962fb25c5fd8e0b660fbdf7b84737ea1c1ea18e82ee483070cc459a6444"},"schema_version":"1.0"},"canonical_sha256":"c86aa8e209f0a6f763520b7d6481dc9f8584e91d11e24dc073a7a92b0b185d9f","source":{"kind":"arxiv","id":"2506.06247","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.06247","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"arxiv_version","alias_value":"2506.06247v1","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.06247","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"pith_short_12","alias_value":"ZBVKRYQJ6CTP","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"pith_short_16","alias_value":"ZBVKRYQJ6CTPOY2S","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"pith_short_8","alias_value":"ZBVKRYQJ","created_at":"2026-07-05T11:17:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:ZBVKRYQJ6CTPOY2SBN6WJAO4T6","target":"record","payload":{"canonical_record":{"source":{"id":"2506.06247","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-06-06T17:15:59Z","cross_cats_sorted":[],"title_canon_sha256":"a7c3b1944427b140943752d065f6a4dec6baf4a6c21d1cb57c09f77cee0f8acc","abstract_canon_sha256":"d8a58962fb25c5fd8e0b660fbdf7b84737ea1c1ea18e82ee483070cc459a6444"},"schema_version":"1.0"},"canonical_sha256":"c86aa8e209f0a6f763520b7d6481dc9f8584e91d11e24dc073a7a92b0b185d9f","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:17:28.119267Z","signature_b64":"QdvUYB1uBhabYRwwVFSay7wHEq4ZZyUhG/QFWbcKW6/dk8ZJs0ajTuYJyK+mmjCv7JvwSjuRQOTbYnBtvzUACQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c86aa8e209f0a6f763520b7d6481dc9f8584e91d11e24dc073a7a92b0b185d9f","last_reissued_at":"2026-07-05T11:17:28.118866Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:17:28.118866Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.06247","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:17:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Yb5T+DtXbAw3I3XszXcYkCtAGn/w9G3GjaOtDySweikf/NEnh1borSXco8TUd/AG2CCJELBAfPaFleJuvF/1Dw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T04:50:11.041664Z"},"content_sha256":"1dbb587450d075f74da9175591e249951b71112660ed0b9b278dc94cc2925fd9","schema_version":"1.0","event_id":"sha256:1dbb587450d075f74da9175591e249951b71112660ed0b9b278dc94cc2925fd9"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:ZBVKRYQJ6CTPOY2SBN6WJAO4T6","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Scalable Language Agnostic Taint Tracking using Explicit Data Dependencies","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Andrei Michael Dreyer, Fabian Yamaguchi, Sedick David Baker Effendi, Xavier Pinho","submitted_at":"2025-06-06T17:15:59Z","abstract_excerpt":"Taint analysis using explicit whole-program data-dependence graphs is powerful for vulnerability discovery but faces two major challenges. First, accurately modeling taint propagation through calls to external library procedures requires extensive manual annotations, which becomes impractical for large ecosystems. Second, the sheer size of whole-program graph representations leads to serious scalability and performance issues, particularly when quick analysis is needed in continuous development pipelines.\n  This paper presents the design and implementation of a system for a language-agnostic d"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.06247","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.06247/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:17:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"exIwwo3OxfQvhgZ7AIV6SSQ2pswuPXzL5uynIGbAMBXdNVuO5LBVXeJufFHNeltg5eNrEwll6lMOzhRlcRhvCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T04:50:11.042750Z"},"content_sha256":"5f83d608900c400f9806cb7ca9b217eeaeb78083f4a6173254b94fe80b2f6cd0","schema_version":"1.0","event_id":"sha256:5f83d608900c400f9806cb7ca9b217eeaeb78083f4a6173254b94fe80b2f6cd0"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ZBVKRYQJ6CTPOY2SBN6WJAO4T6/bundle.json","state_url":"https://pith.science/pith/ZBVKRYQJ6CTPOY2SBN6WJAO4T6/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ZBVKRYQJ6CTPOY2SBN6WJAO4T6/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T04:50:11Z","links":{"resolver":"https://pith.science/pith/ZBVKRYQJ6CTPOY2SBN6WJAO4T6","bundle":"https://pith.science/pith/ZBVKRYQJ6CTPOY2SBN6WJAO4T6/bundle.json","state":"https://pith.science/pith/ZBVKRYQJ6CTPOY2SBN6WJAO4T6/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ZBVKRYQJ6CTPOY2SBN6WJAO4T6/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:ZBVKRYQJ6CTPOY2SBN6WJAO4T6","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d8a58962fb25c5fd8e0b660fbdf7b84737ea1c1ea18e82ee483070cc459a6444","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-06-06T17:15:59Z","title_canon_sha256":"a7c3b1944427b140943752d065f6a4dec6baf4a6c21d1cb57c09f77cee0f8acc"},"schema_version":"1.0","source":{"id":"2506.06247","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.06247","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"arxiv_version","alias_value":"2506.06247v1","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.06247","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"pith_short_12","alias_value":"ZBVKRYQJ6CTP","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"pith_short_16","alias_value":"ZBVKRYQJ6CTPOY2S","created_at":"2026-07-05T11:17:28Z"},{"alias_kind":"pith_short_8","alias_value":"ZBVKRYQJ","created_at":"2026-07-05T11:17:28Z"}],"graph_snapshots":[{"event_id":"sha256:5f83d608900c400f9806cb7ca9b217eeaeb78083f4a6173254b94fe80b2f6cd0","target":"graph","created_at":"2026-07-05T11:17:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.06247/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Taint analysis using explicit whole-program data-dependence graphs is powerful for vulnerability discovery but faces two major challenges. First, accurately modeling taint propagation through calls to external library procedures requires extensive manual annotations, which becomes impractical for large ecosystems. Second, the sheer size of whole-program graph representations leads to serious scalability and performance issues, particularly when quick analysis is needed in continuous development pipelines.\n  This paper presents the design and implementation of a system for a language-agnostic d","authors_text":"Andrei Michael Dreyer, Fabian Yamaguchi, Sedick David Baker Effendi, Xavier Pinho","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-06-06T17:15:59Z","title":"Scalable Language Agnostic Taint Tracking using Explicit Data Dependencies"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.06247","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1dbb587450d075f74da9175591e249951b71112660ed0b9b278dc94cc2925fd9","target":"record","created_at":"2026-07-05T11:17:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d8a58962fb25c5fd8e0b660fbdf7b84737ea1c1ea18e82ee483070cc459a6444","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2025-06-06T17:15:59Z","title_canon_sha256":"a7c3b1944427b140943752d065f6a4dec6baf4a6c21d1cb57c09f77cee0f8acc"},"schema_version":"1.0","source":{"id":"2506.06247","kind":"arxiv","version":1}},"canonical_sha256":"c86aa8e209f0a6f763520b7d6481dc9f8584e91d11e24dc073a7a92b0b185d9f","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c86aa8e209f0a6f763520b7d6481dc9f8584e91d11e24dc073a7a92b0b185d9f","first_computed_at":"2026-07-05T11:17:28.118866Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:17:28.118866Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"QdvUYB1uBhabYRwwVFSay7wHEq4ZZyUhG/QFWbcKW6/dk8ZJs0ajTuYJyK+mmjCv7JvwSjuRQOTbYnBtvzUACQ==","signature_status":"signed_v1","signed_at":"2026-07-05T11:17:28.119267Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.06247","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1dbb587450d075f74da9175591e249951b71112660ed0b9b278dc94cc2925fd9","sha256:5f83d608900c400f9806cb7ca9b217eeaeb78083f4a6173254b94fe80b2f6cd0"],"state_sha256":"8540b72033b9ce02b97cffb64895e50f11d2a5421cacdb48ddcf84e679add0a2"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Nf7EFeY+1jk3LfXN11fwhdGSqKu0w1+q4P4G5edJUThrtwE7cd5w6nrbzDhw7ENizuUrur1DpKePabHr/BTeCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T04:50:11.048220Z","bundle_sha256":"86d2ba89d17c5dce1be7f7163090569076f2e5774269d3d8e91b6133b9e921a4"}}