@@ -334,6 +334,15 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
 
     dast_risk.annotate(findings, getattr(asset, "exposure", "") or "")
     risk_matrix = dast_risk.matrix(findings)
+    # Code sinks from the mapped repositories, split by whether the scan reached
+    # the route they sit behind.  Reachable ones are leads to prove; the rest
+    # are context to review, not dynamic bugs.
+    try:
+        code_sinks = json.loads(scan.code_sinks or "[]") or []
+    except (ValueError, TypeError):
+        code_sinks = []
+    reachable_sinks = [s for s in code_sinks if s.get("reachable")]
+    context_sinks = [s for s in code_sinks if not s.get("reachable")]
     from app.core.external_decisions import counted as _counted
 
     by_sev = {s: sum(1 for f in findings if f.get("severity") == s and _counted(f))
@@ -416,6 +425,7 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
         "asset": asset, "scan": scan, "view": view, "findings": findings,
         "overall": overall, "by_sev": by_sev, "categories": categories,
         "risk_matrix": risk_matrix,
+        "reachable_sinks": reachable_sinks, "context_sinks": context_sinks,
         "heat_max": heat_max, "triaged": triaged, "ai_summary": ai_summary,
         "narrative": narrative(asset.host, view, overall, by_sev, triaged, profile_words),
         "top": [f for f in findings if f.get("severity") in ("critical", "high")
 
@@ -63,6 +63,32 @@
 
 _PARAM = re.compile(r"\{[^}/]*\}|<[^>/]*>|:[A-Za-z_]\w*|\*\*?|\(\?[^)]*\)")
 
+MAX_SINKS = 200
+# High signal dangerous patterns, tagged by type.  These are not a SAST engine:
+# they mark where code does something a dynamic test wants aimed at it.  The
+# reachability of the route in the same file decides whether a sink matters or
+# is only context, so a loose match that is not reachable costs nothing.
+SINK_PATTERNS = [
+    ("sql-injection", re.compile(
+        r"\b(?:execute|executeQuery|query|rawQuery|prepare|mysqli_query|pg_query)\s*\("
+        r"[^)\n]{0,160}?(?:\+|%[sd]?|\$\{|\bf[\"']|\.format\(|\|\|)", re.I)),
+    ("command-injection", re.compile(
+        r"\b(?:os\.system|subprocess\.(?:call|run|Popen)|child_process\.exec(?:Sync)?|"
+        r"Runtime\.getRuntime\(\)\.exec|ProcessBuilder|shell_exec|passthru|\bpopen|"
+        r"\bsystem|\beval|\bexec)\s*\(", re.I)),
+    ("deserialization", re.compile(
+        r"\b(?:pickle\.loads|yaml\.load\s*\((?![^)\n]*Safe)|unserialize|"
+        r"ObjectInputStream|readObject|Marshal\.load|cPickle\.loads)\b", re.I)),
+    ("template-injection", re.compile(
+        r"\b(?:render_template_string|Template\s*\([^)\n]*\)\.render|Handlebars\.compile)\b", re.I)),
+    ("xss-sink", re.compile(
+        r"\b(?:innerHTML\s*=|outerHTML\s*=|document\.write|insertAdjacentHTML|"
+        r"dangerouslySetInnerHTML|v-html)\b", re.I)),
+    ("path-traversal", re.compile(
+        r"\b(?:open|readFile(?:Sync)?|sendFile|include(?:_once)?|require(?:_once)?|"
+        r"file_get_contents|fopen)\s*\([^)\n]{0,120}?(?:\+|\$\{|\breq\.|request\.|params|\binput|\.\.\/)", re.I)),
+]
+
 
 def _clean_route(raw: str) -> str:
     """A route as a path that can be requested.  Parameters become 1."""
@@ -106,9 +132,21 @@ def _openapi_paths(text: str, name: str) -> list:
     return out
 
 
+def _sinks_in(text: str, rel: str, file_routes: list) -> list:
+    """Dangerous patterns in one file, each tagged with the routes that file
+    declares (its reachability decides later whether the sink matters)."""
+    out = []
+    for kind, pattern in SINK_PATTERNS:
+        for m in pattern.finditer(text):
+            line = text.count("\n", 0, m.start()) + 1
+            out.append({"file": rel, "line": line, "type": kind,
+                        "routes": file_routes[:8]})
+    return out
+
+
 def read(root: Path, host: str = "") -> dict:
-    """-> {routes: [path], host_files: [file], files: read, frameworks: [...]}"""
-    routes, host_files, read_count = [], [], 0
+    """-> {routes: [path], sinks: [...], host_files: [file], files: read}"""
+    routes, sinks, host_files, read_count = [], [], [], 0
     host_re = re.compile(r"(?<![A-Za-z0-9.-])" + re.escape(host.lower()) + r"(?![A-Za-z0-9-])",
                          re.I) if host else None
     for dirpath, dirnames, filenames in os.walk(root):
@@ -133,19 +171,27 @@ def read(root: Path, host: str = "") -> dict:
             rel = str(path.relative_to(root)).replace(os.sep, "/")
             if host_re is not None and len(host_files) < 10 and host_re.search(text):
                 host_files.append(rel)
+            file_routes = []
             if path.suffix.lower() in (".json", ".yaml", ".yml"):
                 for p in _openapi_paths(text, filename):
                     cleaned = _clean_route(p)
-                    if cleaned and cleaned not in routes:
-                        routes.append(cleaned)
+                    if cleaned:
+                        file_routes.append(cleaned)
+                        if cleaned not in routes:
+                            routes.append(cleaned)
                 if path.suffix.lower() == ".json":
                     continue
             for pattern in ROUTE_PATTERNS:
                 for m in pattern.finditer(text):
                     cleaned = _clean_route(m.group("p"))
-                    if cleaned and cleaned != "/" and cleaned not in routes:
-                        routes.append(cleaned)
-            if len(routes) >= MAX_ROUTES * 2:
+                    if cleaned and cleaned != "/":
+                        if cleaned not in file_routes:
+                            file_routes.append(cleaned)
+                        if cleaned not in routes:
+                            routes.append(cleaned)
+            if len(sinks) < MAX_SINKS:
+                sinks += _sinks_in(text, rel, file_routes)
+            if len(routes) >= MAX_ROUTES * 2 and len(sinks) >= MAX_SINKS:
                 break
-    return {"routes": routes[:MAX_ROUTES], "host_files": host_files,
-            "files": read_count}
+    return {"routes": routes[:MAX_ROUTES], "sinks": sinks[:MAX_SINKS],
+            "host_files": host_files, "files": read_count}
@@ -110,6 +110,7 @@ def default_environment(db) -> str:
 # it counts without anybody saying so.  Below this it is a suggestion.
 LINK_THRESHOLD = 60
 MAX_WHITEBOX_REPOS = 3
+MAX_WHITEBOX_SINKS = 300
 MAX_FINDINGS = 3000
 
 
@@ -1964,7 +1965,7 @@ def _whitebox(scan_id: int, asset_id: int, host: str) -> dict:
             for branch in (l.get("branches") or [l["repo"].default_branch or ""]):
                 plan.append((l["repo"].id, l["full_name"], l["repo"].connection or "", branch))
         plan = plan[:MAX_WHITEBOX_REPOS]
-    out = {"repos": [], "routes": [], "by_repo": {}}
+    out = {"repos": [], "routes": [], "by_repo": {}, "sinks": []}
     for repo_id, name, connection, branch in plan:
         if scan_id in _stopping:
             break
@@ -1984,6 +1985,9 @@ def _whitebox(scan_id: int, asset_id: int, host: str) -> dict:
                     for route in got["routes"]:
                         if route not in out["routes"]:
                             out["routes"].append(route)
+                    for sink in got.get("sinks") or []:
+                        if len(out["sinks"]) < MAX_WHITEBOX_SINKS:
+                            out["sinks"].append(dict(sink, repository=name))
         except Exception as exc:  # noqa: BLE001 - the scan carries on without it
             entry["error"] = f"{type(exc).__name__}: {exc}"[:200]
         out["repos"].append(entry)
@@ -2685,11 +2689,30 @@ def fetch(path):
         dast_paths.verify(records, controls, fetch, first)
     paths = {"control": {p: c["status"] for p, c in controls.items()},
              "paths": records, "counts": dast_paths.counts(records)}
+    sinks = _correlate_sinks(wb.get("sinks") or [], records)
     _update(scan_id, paths=json.dumps(paths), paths_count=paths["counts"]["answered"],
-            paths_real=paths["counts"]["reachable"], code_matches=json.dumps(
+            paths_real=paths["counts"]["reachable"],
+            code_sinks=json.dumps(sinks), code_matches=json.dumps(
         _code_matches(asset_id, records, index, names)))
 
 
+def _correlate_sinks(sinks: list, records: list) -> list:
+    """Mark each code sink reachable when the dynamic scan reached one of the
+    routes its file declares.  A reachable sink is a lead worth proving; one
+    that is not reachable is context, a thing to look at, not a dynamic bug."""
+    reached = {r["p"] for r in records if r.get("r") is True}
+    out = []
+    for s in sinks:
+        hit = sorted(set(s.get("routes") or []) & reached)
+        out.append({"file": s.get("file"), "line": s.get("line"),
+                    "type": s.get("type"), "repository": s.get("repository", ""),
+                    "routes": (s.get("routes") or [])[:4],
+                    "reachable": bool(hit), "reached_route": hit[0] if hit else ""})
+    # Reachable ones first, then by type, so the report leads with what matters.
+    out.sort(key=lambda s: (not s["reachable"], s["type"], s["file"]))
+    return out
+
+
 def code_index(db, extra: dict = None):
     """Every repository's declared routes, with the routes the scan just read
     from the ones linked to the site.  -> (dast_paths.Index, {id: name})"""
 
@@ -2608,6 +2608,9 @@ class ExternalDastScan(Base):
     # Both JSON, and only for a scan run here.
     paths = Column(LONG_JSON, default="")
     code_matches = Column(LONG_JSON, default="")
+    # Dangerous code sinks from the mapped repositories, each marked reachable
+    # by the dynamic scan or not, for the risk read and the areas to review.
+    code_sinks = Column(LONG_JSON, default="")
     # The two counts out of paths, so a list of sites does not read every
     # scan's paths to say how big each one is: every path with an answer,
     # and the ones that were reachable (a 200 that was a real page).
 
@@ -262,6 +262,37 @@ <h3>{{ f.ref }}  {{ f.title }}</h3>
 </div>
 {% endfor %}
 
+{% if reachable_sinks or context_sinks %}
+<h2 class="new-page">5.  Code and the scan</h2>
+<p class="faint">{{ "Dangerous patterns read from the mapped code, split by whether the scan reached the route they sit behind.  Reachable means a dynamic test can get to that code, so it is a lead worth proving.  The rest is context: a thing to look at by hand, not a dynamic finding." | sentence_spaced }}</p>
+{% if reachable_sinks %}
+<h3>5.1  Reached by the scan (leads to prove)</h3>
+<table>
+  <thead><tr><th>Type</th><th>Where</th><th>Reached route</th></tr></thead>
+  <tbody>
+  {% for s in reachable_sinks %}
+    <tr><td><span class="badge r-high">{{ s.type }}</span></td>
+      <td class="mono">{{ s.repository }} {{ s.file }}:{{ s.line }}</td>
+      <td class="mono">{{ s.reached_route }}</td></tr>
+  {% endfor %}
+  </tbody>
+</table>
+{% endif %}
+{% if context_sinks %}
+<h3>5.2  Areas to review (not reached by the scan)</h3>
+<p class="faint">{{ "Not confirmed, and not counted toward the grade.  These are leads for a code review, not proven bugs, because the scan could not reach them from the outside." | sentence_spaced }}</p>
+<table>
+  <thead><tr><th>Type</th><th>Where</th></tr></thead>
+  <tbody>
+  {% for s in context_sinks[:60] %}
+    <tr><td>{{ s.type }}</td><td class="mono">{{ s.repository }} {{ s.file }}:{{ s.line }}</td></tr>
+  {% endfor %}
+  </tbody>
+</table>
+{% if context_sinks | length > 60 %}<p class="faint">{{ context_sinks | length - 60 }} more not shown.</p>{% endif %}
+{% endif %}
+{% endif %}
+
 <h2 class="new-page">Appendix A.  The scan underneath</h2>
 <table>
   <tr><td class="k">Scan number</td><td>{{ scan.id }}</td></tr>