Security blind spot: Web applications