Insecure Design
Was 4th in 2021. Missing limits, unsafe workflows, and trust assumptions that correct syntax will not fix. This is where business logic, step skipping, and client-trusted prices live.
OWASP rank: 6
Practical checks
- Write the intended state machine before you touch a parameter
- Test step skipping, replay of completed steps, and negative quantities on accounts you own
- Find values the client is trusted to send: price, role, discount, feature flag
- Check whether a limit exists on password reset, OTP, invite, and export
- A design flaw needs a violated rule, not a stack trace