Insecure design = the architecture forgot a control. The code works; the specification is missing. Each tab shows a workflow where the missing rule lets abuse happen at scale.
A coupon should apply once per cart. This implementation just adds the discount on every click. Stack it until the price hits zero.
cart.discount += COUPONS[code] # no per-cart cap
Apply SAVE10 — discount $10, reasonable.
Each click adds $10 more. 10 clicks → price $0.
subtotal: $100.00 discount: $0.00 applied: 0 final: $100.00