1. A computer program product comprising a program stored on a non-transitory computer-readable medium containing an executable set of instructions for detecting a vulnerability in a software application in a database system, the set of instructions operable to: store defined vulnerabilities that identify operations in the software application vulnerable to the security risk and are each associated with one or more input tags and one or more sanitization tags; receive by the software application in the database system a request from a user system; at runtime of the application, assign one or more of the input tags to one or more objects associated with the request, wherein the input tags identify the request as potentially malicious and carrying a security risk; at runtime of the application, assign one or more of the sanitization tags to the one or more objects associated with the request to indicate security checks performed on the objects; at runtime of the application, compare the input tags assigned to the objects with any of the sanitization tags assigned to the objects; and at runtime of the application, identify at least one of the defined vulnerabilities as a vulnerability in a part of the software application when the assigned input tag for an identified one of the objects matches the input tag associated with an identified one of the defined vulnerabilities, and one or more of the sanitization tags associated with the identified one of the defined vulnerabilities is not an assigned sanitization tag for the identified one of the objects; and generating a report identifying the vulnerability in a part of the software application.