Should you arm your SaaS software engineers with a web app vulnerability scanner?