Application security audits of two portals