How SAST Finds Tainted Data Flows