I'd start with the basics - are any secrets/credentials visible in plain text? - how is input handled (escaping HTML etc) - how are headers and cookies being

I'd start with the basics - are any secrets/credentials visible in plain text? - how is input handled (escaping HTML etc) - how are headers and cookies being handled if any