Reasoning about Accidental and Malicious Misuse via Formal Methods