There are plenty of people who will test the security of your applications who aren't out for the lulz.