You can look at it from a pen testers point of view.

Here's a checklist for a web pentest. https://pentestbook.six2dez.com/others/web-checklist