1. A method comprising: A processor examining graphic user interface (GUI) logic; identifying flaws in the logic that expose security damage; mapping a visual invariant to a program invariant; discovering inputs to the GUI logic that include a user action and an execution context to cause the program invariant to be violated; and uncovering browser address bar spoofing by examining for logic correctness as to navigation functionality that includes loading a new page, travelling back in the history log, and opening a new window.