1. A method at least partially implemented by a computing device, the method comprising: automatically generating, by the computing device, valid input data for a software application according to a schema that represents decomposing input data into atomic groups including: groups of groups, groups of elements, and groups of primitive elements; the groups, elements, and primitive elements representing components of a markup language, the valid input data being well-formed for input into the software application; generating a random character for each member of the groups of groups, groups of elements, and groups of primitive elements; and fuzz-testing the software application with corrupted versions of the valid input data, the fuzz-testing identifying any security vulnerabilities associated with the software application independent of any false positive security vulnerability indications.