1. A method comprising: determining, via one or more computing devices, one or more values associated with a web application that flow to response data associated with the web application, wherein the one or more values are modifiable by unreliable input; generating, via the one or more computing devices, a representation of the response data associated with the web application; and determining, via the one or more computing devices, one or more potentially vulnerable portions of the response data based upon, at least in part, the one or more values modifiable by the unreliable input that flow to the response data associated with the web application, and the representation of the response data associated with the web application.