Once you accept that data is code, the familiar shift-left tool kit applies: Static analysis parses application code to identify data-producing structures before execution.