Web App and API Security Done Right