1. A system for preventing security flaws in computer source code, the system comprising: one or more processors and a non-transitory memory having instructions such that when the instructions are executed, the one or more processors perform operations of: implementing a security information flow library embedded in a host programming language; typechecking, with a host programming language typechecker algorithm, at least one security policy written in the host programming language; typechecking, with the host programming language typechecker algorithm, at least one untrusted module written in a restricted subset of the host programming language; wherein the at least one untrusted module cannot access confidential data in the host programming language; wherein typechecking of the at least one untrusted module enforces the at least one security policy with the security information flow library; and wherein confidentiality and integrity are encoded separately into the security information flow library; and incrementally adding information flow security to an existing computer program by implementing at least one security policy to direct information flow between untrusted modules.