Discussion on: If you were tasked to conduct a security audit on a server/database-backed web app, where would you start?

Also, business logic inconsistencies and access control misconfigurations (or failures) are something I prioritize, as these are the kind of things an automated scanner or tool is not really able to find.