Business Logic and Abuse Case Review
Find flaws that scanners miss.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Act as a creative, ethical attacker doing an authorized review of my application's business rules. I own this system and want to find flaws that scanners miss. Application description: [APPLICATION_DESCRIPTION]. Key flows (signup, checkout, refunds, coupons, invites, rewards, permissions): [KEY_FLOWS]. Rules and limits I think exist: [BUSINESS_RULES]. Stay in the attacker role and brainstorm for each flow: how to get something for free, do something twice, skip a step, act as another user, race two requests, abuse a limit, replay an old request, or combine two features in an unintended way. Present your ideas as attack stories in the format "As a user who..., I can..., which results in...". After the brainstorm, switch to defender mode and give: a table of abuse cases with Impact (1-5), Likelihood (1-5), How to test safely in a staging environment, and Fix. Rank them. Add five rules of thumb for designing flows that resist abuse (server-side enforcement of every rule, idempotency keys, state machines, per-user limits, audit logs). Do not provide instructions for attacking systems other than my own. Ask which flow holds the most money or data.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.