# `@contrast/assess`

Vulnerability detection for the Contrast Node.js agent using dataflow analysis.

- Source tracking (user input)
- Propagation through operations
- Sink detection (dangerous operations)
- Vulnerability reporting

Assess registers `@contrast/rewriter` transforms (for example `+` to
`ContrastMethods.add()`) so that propagation through language operators can be
instrumented. Enabled by the `assess.enable` configuration option. If unset, the
Contrast UI decides.