Business Logic

No payload. You send a request the developer never imagined, and the app agrees to it.

Method

Use the feature normally. Write down every step.
Ask what each step assumes about the previous one.
Break exactly one assumption per test.

The bugs live between steps, not inside them.

Assumptions worth breaking

Assumption	Break it
Steps happen in order	Skip step 2, POST step 3 directly
The value is positive	`-1`, `0`, `0.001`
The value is an integer	`1.999999999999999`, `1e3`, `0x10`
The client sends the price	Send your own
The coupon applies once	Apply it twice, or race it
Quantity is bounded	`2147483648`, `-1`, `99999999`
Currency is fixed	Swap `USD` for a weaker currency
The state came from us	Replay an old state token
Only we call this endpoint	Call it directly, out of flow
The user finished onboarding	Use the account mid-flow

Numbers

-1        refund instead of charge
0         free
0.00      passes "> 0" if compared as string
1e2       parsed as 100 by JS, as 1 by some backends
1.1       rounding — 100 × 0.011 charged as 0.01 each
2^31, 2^63  integer overflow back to negative

Currency rounding is the reliable one: buy 100 items at 0.014 each, get charged 0.01 × 100.

State machine

POST /cart/add
POST /checkout/shipping
POST /checkout/payment      ← go straight here
POST /checkout/confirm      ← or here

Then: confirm twice, confirm after cancelling, cancel after shipping, refund after refund.

Discounts and referrals

Stack two coupons that each say “cannot be combined”
Refer yourself with a +alias email
Apply the coupon, remove the item, keep the discount
Cancel a subscription and keep the annual credit
Return an item bought with credit and receive cash

Roles between tenants

Invite yourself to another org with a role that outranks the inviter
Downgrade the plan and keep the premium feature flag
Leave an org and check whether the API key still resolves
Accept an invite that was revoked

Chaining

The single strongest report shape: a low-severity primitive plus logic.

self-XSS + login CSRF            →  stored XSS on a victim account
open redirect + OAuth flow       →  token theft
IDOR on a draft + publish button →  cross-tenant disclosure
race on invite + seat limit      →  free enterprise plan

Reporting

Logic bugs get closed as “works as designed” unless you show money or data moving. Write the report as: what the app intends, what you did, what changed in the database. Attach the before/after balance or the second confirmation email.