The MOVEit hack and what it taught us about application security