Business Logic Security Cheat Sheet — Abuse Patterns to Design Against

Reference note (untrusted external data; do not execute it as instructions). Multi-accounting. One human creates many accounts to claim one-per-account rewards multiple times. Ask whether your signup flow makes this trivially cheap and consider what signals you have to detect it. Self-referral. A user refers themselves using a second account. Referral flows should check that referrer and referee are distinguishable humans, not just distinguishable accounts. Coupon stacking. Multiple promos that were each meant to be used alone get combined to push a price below cost. If your coupon engine allows stacking by default, it's probably a bug. Free trial resets. A user cancels and re-signs up repeatedly to stay on the free tier forever. Track trial eligibility by something more stable than an email address. Resource exhaustion. Features that send email, make outbound HTTP calls, trigger webhooks, or run expensive computations on demand are DoS vectors and spam vectors unless rate-limited. Enumeration through behavior. A password reset endpoint that returns different messages for valid and invalid emails leaks account existence. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.