Web app security review for login and API flows

I need a focused security check for one small web app before I put it to more users. Main area is login, reset password, session handling and the API endpoints behind the app. Please look for common problems, give me clear findings with steps to reproduce, and a short fix advice for my dev. Scope should be practical, not a huge enterprise report. If you use Burp Suite or similar tools, that is good. I want the result in a simple list with risk level and priority. Budget is fixed, so please only offer if you can keep it inside this range.