README

Drives real Express request handling with the tracer loaded, measuring IAST's per-request taint-tracking overhead -- IAST off vs on (default sampling, and always-active), across a non-vulnerable endpoint and one with a command-injection sink that triggers vulnerability reporting.