Taint tracking is a security analysis technique that follows untrusted data as it moves through an application. The “taint” usually starts at an input source such as a form field, API request, file upload, or header, and the analysis checks whether that data reaches a sensitive sink like SQL execution, command execution, template rendering, or file access.
This matters because many exploits depend on unsafe data flow rather than a single bad line of code. If an attacker can control input and push it into a dangerous operation, the result may be injection, remote code execution, or data exposure. Defenders use taint tracking in interactive testing, runtime monitoring, and some secure code analysis tools to spot risky paths before release. In practice, it helps teams answer a simple question: where can untrusted data go, and did the application sanitize it before it reached something dangerous?