Compile-time Security Analysis and Optimization of Sensitive String Producers

Batch of PL/SE research (arXiv May 19, 2026) covering: (1) a practical framework for compile-time security analysis and optimized primitives for “sensitive string producers” to prevent content-composition/template-injection vulnerabilities by extending string-expression syntax, combining static analyses, runtime performance near naive concatenation, and compiler diagnostics to shift security into reusable libraries; (2) IsalProgram, an assembly-like regular-language programming model with a CDLL-based VM and no explicit addresses, intended as a neural-synthesis-friendly target; (3) a modern re