Which code in a Visualforce page and/or controller might present a security vulnerability?