1. A system for protecting a runtime Web service application, the system comprising: a memory configured to store an application and an instrumented version of the application; a processor in communication with the memory, wherein the memory storing processor-executable program instructions, that when executed, configure the processor to perform functions of: a trace instrumenter for enabling the application to log its operation and to create an execution trace; a vulnerability detector for identifying a trace point vulnerability using one or more data payloads, each data payload comprising an example set of data; a taint analyzer for identifying a candidate trace point operation associated with the trace point vulnerability by checking data flow through the application and the instrumented version of the application using one of the one or more data payloads and specifying a security rule to define the data flow, wherein the candidate trace point operation is an operation for which a payload value has been rejected by a validator or has been sanitized by a sanitizer; a string analyzer for computing a supplementary candidate operation based on the existing trace point operation and the trace point vulnerability; and a defensive instrumenter for instrumenting the runtime Web service application with the supplementary candidate operation, wherein the defensive instrumenter is further configured to apply a fix in the form of a trace point operation to the runtime Web service application.