Application Security without rose colored glasses