Mobile App Security Testing

I have an app with local iis server where my api hosted in

The app suppose to run and shows videos hosted in my private channel in vimeo

Only enroled students to my app suppose to run my videos and see them running through enrolment code we provide and videos should run by demonstrating the student number who loggged on top of the video

I can provide you with the server ip and port plus i can provide the api source code plus the apk file and you do complete test try to find the possible bugs in my system to either pull out the videos or run them without any student number demonstrated