Penetration test of two APIs from the banking industry as well as code review of the security-relevant sections in the corresponding source code