Detecting Security Defects in Code