I am not a security expert but I always start with OWASP Top 10 for bare minimum:

https://owasp.org/www-project-top-ten/

Go through each item and test your application for vulnerabilities against those.