Business-logic flaws

When it applies

The app works "correctly" per code but the rules can be gamed: paying less, getting more, skipping a required step, or crossing a boundary the designers assumed users would respect.

Why it works

Scanners can't find these — they require understanding intent. Servers trust client-supplied economics/state and assume the happy path; deviate from it and constraints (price, quantity, sequence, ownership) aren't re-enforced.