I'm sure there are web apps which will find security flaws; but you shouldn't trust their results.  Finding security flaws is equivalent to determining whether a Turing machine will halt -- i.e., there is no algorithm which can guarantee to give you the right answer.