Abstract: A method of testing a web application, wherein a web application is a program that operates on a server and interacts with clients that access the program over a network, wherein further the web application accepts parameters that define results generated from the web application, the method comprising determining which web application uniform resource identifiers (“URIs”) are used to access various web applications on a system, selecting a subset of less than all of the URIs for the common web, wherein the subset is selected at least in part independently of the order generated, performing a security scan on a first URI of the subset of URIs, comparing locality-sensitive hash (“LSH”) signatures of responses to the first URI, determine if the differences between responses exceed a threshold and performing a security scan on a second URI of the subset if the responses exceed the threshold.