1. A computer-implemented method for combining static and dynamic code analysis, at least a portion of the method being performed by a computing system comprising at least one computer processor, the method comprising: identifying executable code that is to be analyzed to determine whether the executable code is capable of leaking sensitive data; performing a static analysis of the executable code to identify one or more objects which the executable code may use to transfer sensitive data by: identifying one or more application programming interfaces capable of accessing sensitive data, and identifying one or more code paths capable of leaking sensitive data, the static analysis being performed by analyzing the executable code without executing the executable code; using a result of the static analysis to tune a dynamic analysis by instrumenting the executable code to track access to the one or more objects identified during the static analysis, wherein instrumenting the executable code comprises hooking the one or more application programming interfaces; performing the dynamic analysis by, while the executable code is being executed, activating analysis within the one or more application programming interface hooks to analyze the one or more code paths capable of leaking sensitive data to determine whether the executable code leaks sensitive data via the one or more objects.