Login successful.
The application works. Now let's see what protects it.
Input validation
Server-side validation
Format validation
Controlled requests
Authentication
Session management
Session expiration
CSRF protection
Access control
Authorization checks
Public / private separation
Protected routes
Sensitive data
Protected files
Security headers
Controlled errors
Controlled uploads
Secrets outside public access
Server-side controls
A working interface does not tell you whether these protections actually exist.
Want to see what happens behind the interface?