⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A06 – Insecure Design

OWASP A06:2025 CWE-770 CWE-837 CWE-841

Insecure design = the architecture forgot a control. The code works; the specification is missing. Each tab shows a workflow where the missing rule lets abuse happen at scale.

CWE-770 No Throttling CWE-837 Single-Action CWE-841 Workflow Violation
CWE-837 Improper Enforcement of a Single, Unique Action

A coupon should apply once per cart. This implementation just adds the discount on every click. Stack it until the price hits zero.

Vulnerable code:
cart.discount += COUPONS[code]   # no per-cart cap

Try it yourself

Apply once

Apply SAVE10 — discount $10, reasonable.

Apply again

Each click adds $10 more. 10 clicks → price $0.

subtotal: $100.00   discount: $0.00   applied: 0   final: $100.00