As I have repeated a lot of times, there are interactions between applications. It is necessary to review all of them, looking for potential vectors, such as the following:
- Email services used for notifications
- SMS services used for notifications or to recover features
- HTTP redirects
- Information shared between applications due to central services being consumed
- Shared data storage
- APIs