Protecting user data through source code analysis at scale

This post details the integration of static analysis tools (Zoncolan for Hack, Pysa for Python) into Meta's workflow to proactively detect potential scraping vectors across codebases. It explains how these tools track data flow by defining sources (user-controlled parameters) and sinks (data returned to the user), identifying potential issues when data flows from source to sink. An example illustrates how a user-controlled 'count' parameter in an API endpoint can be abused by scrapers, and the recommended fix involves capping the maximum results returned to limit data extraction and trigger rate limiting systems. The post acknowledges the limitations of static analysis and emphasizes a holistic approach to combating scraping.