1. A computer program for detecting a vulnerability in a software application in a database system, the computer program comprising a set of instructions operable to: receive by the software application in the database system a request from a user system; at runtime of the application, assign input tags to one or more objects associated with the request, wherein the input tags identify the request as potentially malicious and carrying a security risk; at runtime of the application, assign sanitization tags to the objects to indicate security checks performed on the objects; at runtime of the application, compare the input tags assigned to the objects with any of the sanitization tags assigned to the objects; and at runtime of the application, identify a part of the software application as vulnerable to the security risk based on the comparison of the input tags with any of the sanitization tags.