Application security audit of a mortgage credit portal (incl. code review)