Active Directory security groups are used to grant users’ permissions to various domain services and resources. Therefore, to understand what permissions are assigned to a specific user in the AD domain, it is enough to look at the groups in which the user account is a member.
Three Steps For Increasing The Security of Your Web Apps – DEV Community 👩💻👨💻
Source: Three Steps For Increasing The Security of Your Web Apps – DEV Community 👩💻👨💻
Also have a look at OWASP Top 10 Most Critical Web Application Security Risks: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project