Insecure Design
Flaws in the design itself - missing rate limits, weak business logic, unsafe workflows that no amount of clean code fixes.
OWASP rank: 4
Practical checks
- Map business logic and abuse cases
- Test for missing rate limits on sensitive actions
- Check workflow step-skipping and negative values
- Look for trust assumptions that can be broken