[vezzy-fnord]

The Art of Software Security Assessment is a gold standard in infosec that goes well beyond simply web applications, but it does cover those, as well.

Definitely read that to get a holistic image.