1. A computer-implemented method for protecting a runtime Web service application, the method comprising: instrumenting, by a computer, the Web service application to log its operation and create an execution trace; identifying, by the computer, a trace point vulnerability using one or more data payloads and one or more security rules; identifying, by the computer, a first candidate trace point operation associated with the trace point vulnerability; computing, by the computer, a supplementary candidate operation based on the first candidate trace point operation and the trace point vulnerability; and further instrumenting, by the computer, the Web service application with the supplementary candidate operation.