Bytecode is injected to create a source tracking object for a data object received from a data source and to record information associated with the data source into the source tracking object. Bytecode is injected to create a copy of the data object for a tracking event in an application program, to create a flow tracking object for the tracking event, and to record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object. Bytecode is injected to create a sink tracking object for outputting the copy of the data object to a data sink and to record information associated with the data sink into the sink tracking object. Bytecode is injected to output the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.