Specification and automatic verification of security guidelines for program certification