One of the main things I do when doing any application security tests is - you guessed it - read the documentation and source code (if it's open source).

It's basically like reading a manual on how to exploit the application.