Penetration test with partial code review of a database application