Web Application Security Auditing Done Right — Expose Weaknesses Before Hackers Do