Web application security audit of a client portal