Application functionality and user interaction points, both direct and indirect.
Starting with OWASP Top 10, and more.
Using Common Weakness Enumeration (CWE) and Common Vulnerability Scoring System (CVSS).
Identification of corrective measures and executive and technical reporting.