Find IDOR/BOLA, missing or incorrect authorization, horizontal and vertical privilege escalation, and multi-tenant isolation bypass — the bug is usually an absent check.
Find defects specific to batch and ETL paths: unvalidated bulk input, injection through generated statements, and trust placed in upstream-written data.
Weaknesses in browser-delivered code — JS/TS, JSX/TSX, Vue, Svelte, Angular, HTML, templates, bundler and Docker config. DOM XSS and code-exec sinks, secrets in bundles or config.js, build-inlined REACT_APP_/NEXT_PUBLIC_/VITE_ env, source maps and dev servers…
Exhaustive repository exploration procedure — Glob the whole tree into a written inventory, group it by directory, and account for every file including templates, Dockerfiles, compose and k8s manifests, nginx/uwsgi/gunicorn config, CI workflows, dotfiles, SQL…
Find broken or misused cryptography: weak hashes and ciphers, unsalted password storage, predictable randomness, bad key or IV handling, disabled certificate verification.
Find state-changing requests that a third-party origin can forge: missing or unverified CSRF tokens, unsafe SameSite, and CORS that trusts a reflected Origin with credentials.
Find unsafe deserialization of untrusted data: pickle, yaml.load, native object streams, and type-confusable decoders that instantiate attacker-chosen classes.
Find credentials, keys, tokens and signing secrets committed in source, config, manifests or deployment files.