Determining application attack surfaces