Bugs No Scanner Will Find

Technical vulnerabilities—injection, XSS, broken crypto—can often be detected by automated scanners. Business logic flaws cannot, because they are not violations of a specification; they are cases where the specification itself is abusable. The code does exactly what it was written to do, and that behavior is the vulnerability.

Race Conditions and TOCTOU

A time-of-check to time-of-use (TOCTOU) flaw exists when an application verifies a condition and later acts on it, with a gap an attacker can exploit. Classic examples:

  • Coupon reuse: two requests redeem the same one-time coupon simultaneously; both pass the "has this coupon been used?" check before either marks it used.
  • Withdrawal overdraft: two concurrent withdrawal requests each see a balance of $100 and each is approved, producing $200 of withdrawals.
  • Voting/claiming: multiple requests each see a "not yet claimed" flag and all succeed.

The fix is atomicity: make the check and the action a single indivisible operation. Database transactions with row locks, conditional updates (UPDATE ... WHERE used = false), unique constraints, and idempotency keys all prevent the window. Serializing critical operations and verifying an affected-rows count of 1 closes the gap.

Workflow Bypass

Multi-step flows assume steps happen in order, but attackers skip them. Examples: jumping directly to /checkout/confirm without payment, submitting a form at step 4 without completing steps 1–3, or accessing a "post-verification" page before verifying. Defenses: enforce state transitions server-side, never trust a client-supplied step or status, and re-validate prerequisites on the final action.

Abuse of Legitimate Features

Some flaws weaponize features as intended:

  • Negative quantities in a cart that reduce the total.
  • Currency or unit confusion (paying ¥100 where $100 was expected).
  • Refund abuse: refunding an order more than once, or refunding to a different account.
  • Discount stacking: combining promotions the business intended to be exclusive.
  • Referral loops: self-referral or circular referrals that farm credits.

None of these require malformed input; they require understanding the business rules and probing their boundaries.

Parameter Tampering and Trust

Applications often trust client-supplied values they should not: prices, user IDs, roles, discount percentages, or totals. A robust design recomputes every sensitive value on the server from authoritative data and treats any client-provided version as a hint to validate, never a source of truth.

Finding Logic Flaws

Automated tools miss these, so discovery is manual and adversarial. Walk every user journey and ask, at each step: what does the server assume has happened before this? What happens if I do this twice, in parallel, out of order, or with altered values? What if I skip a step? What is the intended invariant, and how could it be broken while still passing every individual check? Threat modeling (covered earlier) is the structured way to generate these questions systematically.

Business logic flaws are often the highest-impact bugs because they directly convert into money or privilege. They are also the most durable, because patching a line of code does not fix a flawed assumption about how users behave.