Web application security testing for bug bounty