One of the main things I do when doing any application security tests is - you guessed it - read the documentation and source code (if it's open source). It's

One of the main things I do when doing any application security tests is - you guessed it - read the documentation and source code (if it's open source). It's basically like reading a manual on how to exploit the application.