Penetration test of a API with a partial code review