Why I Built a Deterministic CPG-to-Nuclei Compiler in Rust

Description and use

Automated security testing agents often rely on LLMs to generate low‑level templates, causing errors and state changes. A Rust compiler converts Code Property Graphs into correct Nuclei YAML, verifies them in isolated Docker containers, and eliminates these issues.

Problem

Automated security testing agents often rely on LLMs to generate low-level exploit templates, leading to trial‑and‑error, hallucinated syntax, high execution costs, and state‑mutation issues that require manual cleanup.

Outcome

The compiler produced a verified, enterprise‑safe LFI template for CVE‑2024‑51483, eliminating database artifacts and reducing manual cleanup.

Workflow

• 1. Source code (C/C++, Java, Go, Python) is parsed into a Joern CPG.
• 2. The Rust engine extracts DataFlowSlice and SSA paths to compute taint graphs.
• 3. The compiler generates 0‑error Nuclei YAML templates.
• 4. The Docker harness runs the template to produce TP/TN proofs before PR submission.
• 5. The PR is submitted only after successful verification.

Evidence

The Rust engine parses Joern CPG schemas and Single Static Assignment (SSA) dataflow paths to compute taint graphs natively in Rust, generating 0%-error Nuclei YAML templates in milliseconds with minimal memory overhead.

Source

Using my compiled harness, I standardized an enterprise-safe lifecycle: Snapshot, Execute, Teardown.

Source