1. A method for identifying a security vulnerability in a computer software application, the method comprising: identifying a source in said computer software application; identifying a sink in said computer software application; identifying an input to said sink; determining whether said input derives its value directly or indirectly from said source; determining a set of possible values for said input; and identifying a security vulnerability where said set of possible values for said input does not match a predefined specification of legal values associated with said input to said sink.