Applications that care about length extension attacks: https://en.wikipedia.org/wiki/Length_extension_attack (though most applications shouldn't care about it, and not all functions in the SHA-2 family are vulnerable to it, as tptacek notes. See https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functi...).