Application penetration test of a web service in a payment environment incl. code review