The things I have found after being a security reviewer (In Progress)

Most common risks

OAuth

AWS Security features

The security scan methods