A computer-implemented method for identifying a security vulnerability in an application executing on a host computing device in a distributed computing environment, comprising: - registering, by a source sensor, input data in a security status repository on the host computing device, where the input data is received from a source external to the host computing device, an entry for the input data in the security status repository includes a reference to a data object which store the input data, and the source sensor is instrumented in a request handling method of the application; - logging, by a sanitization sensor, sanitization of the input data in the security status repository, where the logging of the sanitization is in response to execution of a data sanitization method within the application and the sanitization sensor is instrumented in the data sanitization method; - logging, by a sink sensor, a sink call made by the application in the security status repository, where the logging of the sink call is in response to execution of the sink call and the execution of the sink call uses at least a portion of the input data; - determining, by an agent, whether parameter values for the sink call were sanitized using data in the security status repository, where a portion of the parameter values for the sink call are from the input data and the agent is deployed in an execution environment shared with the application; - identifying, by the agent, a security vulnerability in the application in response to a determination that at least a portion of one parameter value for the sink call was not sanitized; and - reporting, by the agent, the security vulnerability to a monitoring server, where the monitoring server is located remotely from the host computing device. - registering, by a source sensor, input data in a security status repository on the host computing device, where the input data is received from a source external to the host computing device, an entry for the input data in the security status repository includes a reference to a data object which store the input data, and the source sensor is instrumented in a request handling method of the application; - logging, by a sanitization sensor, sanitization of the input data in the security status repository, where the logging of the sanitization is in response to execution of a data sanitization method within the application and the sanitization sensor is instrumented in the data sanitization method; - logging, by a sink sensor, a sink call made by the application in the security status repository, where the logging of the sink call is in response to execution of the sink call and the execution of the sink call uses at least a portion of the input data; - determining, by an agent, whether parameter values for the sink call were sanitized using data in the security status repository, where a portion of the parameter values for the sink call are from the input data and the agent is deployed in an execution environment shared with the application; - identifying, by the agent, a security vulnerability in the application in response to a determination that at least a portion of one parameter value for the sink call was not sanitized; and - reporting, by the agent, the security vulnerability to a monitoring server, where the monitoring server is located remotely from the host computing device.