1. A computer-implemented process for verifying application security vulnerabilities of a source code, comprising: generating, responsive to all static analysis results not being validated, mock objects using a vulnerability call trace for the source code; creating a unit test using the generated mock objects; executing the unit test using the generated mock objects to determine whether an identified vulnerability was validated; and selecting, responsive to a determination that the identified vulnerability was validated, a next static analysis result.