Automated security testing for SaaS applications