Discovery
- Collect specs (OpenAPI / GraphQL introspection)
- Enumerate endpoints, methods, and versions
Authorization
- Broken object-level authorization (BOLA / IDOR)
- Function-level authorization gaps
- Token and scope handling
Input & logic
- Injection and mass assignment
- Rate limiting and business-logic abuse
- Excessive data exposure
Reporting
- Concrete requests, impact, and remediation