1. A method for determining whether code is safe to be called by an untrusted program, the method comprising: accessing a set of code stored in at least one computer-readable medium of a computing system having a processor communicatively coupled to the at least one computer-readable medium; evaluating a plurality of code paths corresponding to one or more callers of the set of code, wherein evaluating the one or more callers of the set of code comprises: identifying direct callers of the set of code; evaluating all direct callers of the set of code and determining whether the set of code leaks critical data to such direct callers; after identifying direct callers of the set of code, recursively identifying all indirect callers of the set of code by using the set of code, wherein indirect callers are identified as being distinguished from direct callers and includes any callers that: (a) call direct callers; or (b) call other indirect callers; evaluating indirect callers of the set of code and determining whether the set of code leaks critical data to such indirect callers; and determining that at least one direct caller or indirect caller is marked with a TreatAsSafe or Demand attribute and, in response, abstaining from further recursive evaluation of indirect callers above such at least one direct caller or indirect caller; and evaluating at least one code path corresponding to one or more callees of the set of code, wherein evaluating the at least one code path corresponding to the one or more callees of the set of code includes determining whether the set of code leaks critical data to the one or more callees of the set of code.