1. A method, comprising: performing a static analysis on a program having sources and sinks to track string flow from the sources to the sinks, comprising: for string variables in the program that begin at sources, computing grammar of all possible string values for each of the string variables; for methods in the program operating on any of the string variables, computing grammar of string variables returned by the methods; in response to one of the string variables reaching a sink that performs a security-sensitive operation, comparing current grammar of the one string variable with a policy corresponding to the security-sensitive operation; and performing a reporting operation based on the comparing.