Robert Marsh

Is the BQRS the most useful thing? I'd expect most users to want a SARIF or CSV export more than a BQRS. (see https://github.com/github/securitylab/discussions/164)

I like the idea but I'm not following the parameterized module tricks you're doing.

Needs a .expected file

I'd expect to see a destructor call for the temporary string at line 1369 of ir.cpp. The AST otherwise looks good to me.

> Instead, how about we create an IR query that tracks flow from an InitializeDynamicAllocation that isn't conflated with all-aliased- memory, and find all the ones that don't flow to...