sc-business-logic

Detect business logic vulnerabilities in web checkout and payment workflows.

56|5|Updated Apr 8, 2026

Search Tags:#business-logic #web-application #security-testing #checkout-process #price-manipulation #workflow-bypass #cwe-840

Ready to run

npx skills add https://github.com/ersinkoc/security-check --skill sc-business-logic

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sc-business-logic
Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-business-logic
Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-business-logic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Business logic flaws arise when an application's intended workflows and rules are bypassed or manipulated, leading to revenue loss, fraudulent activity, or service abuse.

Core Features & Use Cases

Detects price/quantity manipulation, coupon abuse, workflow step bypass, and negative-value attacks.
Provides structured remediation guidance, severity classification, and CWE-840 reporting for consistent risk assessment.
Use Case: Audit an e-commerce checkout to identify policy violations and generate actionable remediation steps.

Quick Start

Scan your web app for business-logic vulnerabilities like price manipulation and workflow bypass.

Frequently Asked Questions about sc-business-logic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect business logic vulnerabilities in web applications?▼

Detect business logic vulnerabilities by auditing web application workflows to identify flawed rule enforcement, price manipulation, and order-flow bypass. This process targets checkout, payment, and reward systems to expose policy violations.

What is a business logic flaw in a checkout process?▼

A business logic flaw in a checkout process is a vulnerability where intended workflows and rules are bypassed or manipulated. This allows attackers to exploit coupon systems, input negative values, or skip steps to cause revenue loss.

How do I test for price manipulation and negative-value attacks?▼

Test for price manipulation and negative-value attacks by scanning web application checkout and payment workflows. This identifies improper server-side validation and workflow state checks that permit fraudulent quantity or price modifications.

Can I generate CWE-840 reporting for business logic security testing?▼

You can generate CWE-840 reporting for business logic security testing by evaluating flawed workflows and rule enforcement. This provides structured remediation guidance and severity classification to drive consistent risk assessment.

Does this approach work for auditing e-commerce coupon and reward workflows?▼

This approach works for auditing e-commerce coupon and reward workflows by targeting rule enforcement and workflow step bypasses. It identifies policy violations and provides actionable remediation steps to prevent service abuse.