Does your site protect critical user data? Does it not? It doesn’t matter! All sites should have good security, and you’d be surprised at how often one can find vulnerabilities in sites run by large corporations. I test for a bank of major vulnerabilities, and if there’s a specific area you’re worried about, I’ll do manual request/response analysis to look for anything that needs patching! Additionally, I can look for exploitable areas in desktop and mobile apps that communicate to servers. Developers often forget to secure app endpoints!