1. A method at least partially implemented by a computing device, the method comprising: automatically generating valid input data for a software application according to a schema, the valid input data being well-formed for input into the software application; and wherein the valid input data is for fuzz-testing the software application with corrupted versions of the valid input data, the fuzz-testing identifying any security vulnerabilities associated with the software application independent of any false positive security vulnerability indications.