Static and dynamic vulnerability analysis, information gathering through OSInt and public research, configuration management, temp files, logs, network & infrastructure configuration, HTTP methods, HTTP headers (ex. HSTS, CORS, XSS, X-frame, etc.), identity management, user registration & account provisioning process, account enumeration & guessable user accounts, authentication & authorization, brute-force, authentication bypass, privilege escalation, 2FA/MFA, cache weakness, password policy, directory traversal, insecure direct object references, secure session management, session timeout & logout, session fixation, CSRF, session control, puzzling & hijacking, input & data validation, sanitization, & format string attacks, XSS, SQL, command, & other forms of injection, SSRF, file inclusion, buffer, heap, & stack overflow, error handling, cryptography, secure data at rest (ex. local store), in use (ex. IPC) and in transit (ex. SSL/TLS), secure network communications, certificate trusts, protocols, ciphers, protocols, etc., MiTM attacks, risky business functions and logic, file uploads, process timing attacks, reverse engineering, user accessible logs and alerts for authentication history, password resets, account changes, account lockout, etc., DoS, and more.