The process of software engineers checking the flow of user input in application code to determine if unanticipated input can affect program execution in malicious ways.