1. A computer-implemented method for analyzing data to determine data security, the method comprising computer-implemented operations for: obtaining the data to be tested, the data comprising a client-side script and a document; performing, using an analysis tool executing at a computing device, a dynamic analysis of a first portion of the data by executing test execution flows against the first portion of the data; tracking, during the dynamic analysis, dynamic execution flows corresponding to the test execution flows and variable values associated with variables referenced during the test execution flows; performing, using the analysis tool, a static analysis of the same first portion of the data analyzed using the dynamic analysis to determine static flows corresponding to execution paths associated with the first portion of the data; building a model of one of the static flows by mapping at least a portion of one of the dynamic execution flows to at least a portion of the one of the static flows; analyzing the model to determine if a variable associated with the model has a taint status determined to be unsafe when last referenced in the model; and identifying a vulnerability in the first portion of the data corresponding to the one of the static flows, in response to determining the variable has the taint status.