1. A computer-implemented method for analyzing source code of an application, the method being executed using one or more processors and comprising: determining, for at least one procedure invoked by the source code, a procedure specification specifying one or more conditions under which one or more parameters of the procedure are exploitable according to a parameter security specification, the one or more parameters comprising a data sink having a data source as a predecessor in a control flow graph; performing static application security testing on the source code by using the procedure specification on reaching an invocation of the procedure in the source code, comprising: comparing one or more invoking parameters of the invocation of the procedure to the conditions of the procedure specification; and determining whether, in at least one context of the application, the invocation of a first condition associated to the data sink indicating that the data sink is exploitable is simultaneously satisfied with a second condition associated to the data source indicating that the data source is exploitable based on an analysis of an exclusion criteria.