A computer-implemented method for detecting security vulnerabilities in a computer program, comprising the steps of: receiving into a memory source code of said computer program to be analyzed, said source code comprising code elements and statements, at least a portion of said statements referencing variables, wherein said variables comprise data structures having member variables, said member variables having member names; constructing, using a source code analyzer running on a processor, an object-oriented model of said source code, wherein said code elements are represented by respective objects, wherein said constructing an object-oriented model comprises assigning unique instance identifiers to each of said member variables; and using said model, constructing at least a control flow graph representing a flow of said computer program, characterized in that the method includes: storing the object-oriented model in an object-oriented database; receiving a source code database query, in a predefined code graph query language, with respect to a security vulnerability in which a member name of a predetermined member variable is identical to said member name of another member variable; analyzing said at least a control flow graph responsively to said source code databased query so as to identify a portion of said source code having said security vulnerability by identifying references to said predetermined member variable using said unique instance identifiers thereof; and reporting said security vulnerability. receiving into a memory source code of said computer program to be analyzed, said source code comprising code elements and statements, at least a portion of said statements referencing variables, wherein said variables comprise data structures having member variables, said member variables having member names; constructing, using a source code analyzer running on a processor, an object-oriented model of said source code, wherein said code elements are represented by respective objects, wherein said constructing an object-oriented model comprises assigning unique instance identifiers to each of said member variables; and using said model, constructing at least a control flow graph representing a flow of said computer program, characterized in that the method includes: storing the object-oriented model in an object-oriented database; receiving a source code database query, in a predefined code graph query language, with respect to a security vulnerability in which a member name of a predetermined member variable is identical to said member name of another member variable; analyzing said at least a control flow graph responsively to said source code databased query so as to identify a portion of said source code having said security vulnerability by identifying references to said predetermined member variable using said unique instance identifiers thereof; and reporting said security vulnerability. storing the object-oriented model in an object-oriented database; receiving a source code database query, in a predefined code graph query language, with respect to a security vulnerability in which a member name of a predetermined member variable is identical to said member name of another member variable; analyzing said at least a control flow graph responsively to said source code databased query so as to identify a portion of said source code having said security vulnerability by identifying references to said predetermined member variable using said unique instance identifiers thereof; and reporting said security vulnerability.