Standard penetration test of web applications, Comprehensive security audit of web application, Information gathering, Double-standard penetration test of API