Testing for security vulnerabilities in software