Raising the Bar for Web App and API Security