example relations control flow: can we hit a use before alloc data flow: can a user controlled value end up here # target vuln formulate vuln as query use MRVA https://securitylab.github.com/ctf/