1. A computer-implemented method for identifying a security vulnerability pertaining to a processor executing a computer software application comprising: identifying a source in said computer software application providing information; identifying a sink in said computer software application processing information, wherein said sink includes one or more inputs; identifying an input to said sink; determining whether said input derives its value directly or indirectly from said source; determining a set of possible values for said input in response to said value of said input being derived from said source; comparing the set of possible values to a predefined specification of legal values associated with said input to said sink; and identifying a security vulnerability pertaining to a processor executing the computer software application in response to one or more values of said set of possible values for said input not being included within said predefined specification of legal values associated with said input to said sink.