Tag static analysis in software security