Write down the intended rules
Before testing, we wrote the discount rules as the business understood them, then tested each one as a security control with an expected result.
Coupons that stacked forever
A marketplace was losing money on promotions and assumed it was fraud from outside. Most of it was its own discount logic.
Representative engagement. Client names, figures and identifying details are changed or combined; no client findings are published in identifiable form.
- Sector
- E-commerce and retail
- Engagement
- Web app & API pentest
- Frameworks
- OWASP ASVS 5.0, OWASP API Security Top 10 (2023)
- Duration
- 10 test days
An online marketplace.
Sellers could create discount codes, the platform ran its own promotions, and both could apply to one basket. Finance had noticed orders where discounts exceeded the item price.
The client wanted to know whether it was being attacked, or whether the rules were simply broken.
Treat the business rules as security controls.
Combine, repeat, parallelise
Codes could be applied after the basket total was recalculated, reused across parallel sessions, and combined with gift-card credit for negative totals.
Protect the flows, not just the endpoints
Remediation focused on API6:2023 — unrestricted access to sensitive business flows — with limits by account, device and payment method.
What we found
Where the rules and the code disagreed.
| Severity | Finding | Maps to | Status at retest |
|---|---|---|---|
| High | Discount applied after total recalculation, allowing stacking beyond configured limits. | WSTG-BUSL-01 · ASVS V2 | Closed |
| High | Single-use codes redeemable multiple times via parallel checkout requests. | API6:2023 · CWE-362 | Closed |
| High | Seller accounts could create codes against other sellers’ listings. | API5:2023 BFLA | Closed |
| Medium | Account creation unlimited, enabling new-customer promotion farming. | API6:2023 | Closed |
| Medium | Order totals could reach zero or negative values without review. | ASVS V2 | Closed |
What changed.
Pricing is now calculated once, server-side, after all discounts, with an invariant that rejects any order below cost without manual approval. Promotion losses fell sharply the following month.
The written rules document became the specification the engineering team tests against.
Want this for your application?
Tell us what you ship and who is asking for proof. We will come back with a scope and a range.
Let’s Connect
or email hello@penspycyber.com