# Three taint tags, race detection and overflow checks in the type system

> On main since rc2: Three taint tags, race detection and overflow checks in the type system.

Source: https://kern-lang.eu/releases/taint-tags-races-overflow

On main since rc2

## Release notes

`Secret` is now a first-class compile-time taint tag alongside `PersonalData<T>` (E0302) and `Untrusted<T>` (E0303): a secret reaching any sink that does not declare a `Secret` parameter, a log line, `print`, a string concat into a DSN, is **E0316**. Comparing a secret with `==` is **E0317**, because byte-by-byte equality short-circuits and leaks how many leading bytes matched (CWE-208); the fix is `secret_equals` or `secure_compare`, which always inspect every byte. A whole-program pass now builds the call graph from every `spawn`/`spawn_thread` and rejects a scalar or struct module global written from a thread-reachable function as **E0309**, a compile-time data race.

Integer `+`/`-`/`*` are **overflow-checked by default** (CWE-190): the compiler lowers them to LLVM overflow intrinsics and traps with the operands named; code that wants modular arithmetic says so with `wrapping_add`. The security review also closed two escapes: the raw `__syscall` intrinsic, which let a zero-capability program do arbitrary I/O, is now gated on `Cap<Unsafe>`; and a taint launder via tuple projection is closed in the typechecker. Both are macOS-verified and pinned by negative tests.