1. A computer-implemented method for evaluating a computer program, the method comprising: receiving, into a memory of a computer, source code of the computer program to be analyzed, the source code including invocations of specified methods; automatically analyzing the invocations in the source code in order to assign the specified methods, based on parameters of the specified methods, to different, first and second invocation types; constructing, using a source code analyzer running on the computer, a control flow graph representing a flow of the computer program, while replacing the invocations with stubs of different, first and second stub types, corresponding respectively to the first and second invocation types, in the control flow graph when the source code of the specified methods is unavailable; analyzing the control flow graph containing at least some of the stubs, in order to identify a security vulnerability in the source code; and reporting the identified security vulnerability.