1. A method, comprising: determining selected global variables in a program for which flow of the selected global variables through the program is to be tracked, the selected global variables being less than all the global variables in the program, wherein a given one of the selected global variables comprises at least one key of a map object; and using a static analysis performed on the program, comprising tracking flow through the program for the selected global variables, tracking flow through the program for a selected one of the at least one key of a map object of the given one of the selected global variables, and determining and updating grammar for the selected key for each string manipulation in which the selected key is involved; in response to the tracking of the one or more of the selected global variables, when the one or more of the selected global variables is used in security-sensitive operations in the flow, analyzing use of each one of the selected global variables in corresponding security-sensitive operations, wherein in response to the analyzing, if the use may be a potential security violation, then reporting the potential security violation; and in response to the tracking of the selected key, when the selected key is used in a security-sensitive operation in the flow, comparing a current grammar of the selected key with a specified grammar corresponding to the security-sensitive operation, wherein when the comparison indicates a security violation, then reporting a potential security violation based on the comparison.