BU Creative Web App Penetration Testing vs fuzz.txt (2026)