Web application security audit of a complex workflow system