What are the primary threat vectors for a SaaS application like AppFolio, and how would you prioritize them?