What security testing do you do as part of normal QA, without being a security specialist?

Focus on what functional testing naturally reaches. Test authorization by requesting another user's resources with a valid token, check that IDs in URLs cannot simply be swapped, try injection payloads in inputs that reach a query or a template, confirm sensitive data is not in logs or URLs, verify session expiry and logout, and check security headers and TLS enforcement.

I focus on the classes I can reach from normal testing, and top of the list is broken access control, because it is common and it is severe. The concrete test is simple: log in as one user, note the ID in a URL or payload, then repeat the request with a second user's valid token and see whether the object comes back. I do the same for role boundaries, so a standard user hitting an admin endpoint directly rather than through a hidden button. Next is injection anywhere input reaches a query, a template, or a shell, plus stored cross site scripting where a value gets rendered somewhere else in the app, which is the case people miss because they only check the field they typed into. Then data exposure: sensitive values in URLs, in logs, in stack traces returned to the client, or in a response carrying far more fields than the UI shows. Session handling, so logout invalidating server side and tokens genuinely expiring. And I check headers and TLS enforcement, which is quick. Anything approaching real penetration testing I escalate, because pretending otherwise gives false assurance.