Quandary is a static taint analyzer that identifies a variety of unsafe information flows. It has a small list of built-in sources and sinks, and you can define custom sources and sinks in your .inferconfig file (see example here).
.inferconfig
