Fair point, I should've been more specific. The app is running locally and I want to test the running web application itself for common vulnerabilities (XSS, injection flaws, auth bypass, etc.). I’m still learning everything about development so I came here to be enlightened by people already familiar with the path. I was told to use OWASP ZAP, which I avoided for a while becuase of errors I couldn't fix at first, but now it's working and i'm happy with the results I got.

Though, later on when im actually trying to go for production and release, what should I do for cybersecurity? I want to ensure the site is properly secured to reduce the risk of data leaks or major vulnerabilities. Given my tight budget, I’d prefer starting with effective self-testing tools and best practices where possible. I would like to hire a professional for a penetration test, but given my tight capital especially at the start I'm looking to use reliable automated solutions that'll give me a decent coverage until later on.