How to secure SaaS applications with penetration testing