Many web sites suffer from critical security holes, allowing hackers to steal customer information, or deface the corporate web site. Most of these security holes stem from security vulnerabilities in commercial products, such as web servers or operating systems. However, there is a class of vulnerabilities that result from insecure programming of the custom applications used by the web site (shopping cart, navigation system, and so on).