Business Logic Testing (FIND/EXPLOIT — the pro's bread and butter)

Overview

Find flaws in what the app allows, not how it's coded. These are valid requests that produce invalid outcomes — buying for $0, refunding twice, skipping a required step. No scanner finds them because each is unique to your business rules.

Core principle: The app enforces the intended flow; you test every unintended path that still "works." Think: "what does this feature assume, and what if I break that assumption?"

Applies when / Skip when

• Applies when: the app has multi-step workflows, money/credits/quotas, stateful processes, or business rules that can be abused.
• Skip when: it's a stateless single-action utility with no rules or state → N/A (rare — most apps have some logic; double-check before skipping).
• If N/A: report "business-logic-testing: N/A — no stateful workflow/rules" and stop.

⚠️ Authorization

Your own app/test data. Logic abuse can move money/state — use a non-production environment.