A systematic checklist covering every phase of a web application security assessment — from recon and auth testing to business logic flaws and reporting.