The authors present a new taxonomy for source code security defects based on three-dimension-tree, which considers the information of defect’s cause, impact and representation synthetically. Case studies show that a sound system for classifying source code defects could be established with this taxonomy, and it is also good for the prevention and fixing of software vulnerabilities.