Business logic threats¶ Missing or broken controls, checked at every entry point. Broken authentication Broken object-level authorization (IDOR) Broken function-level authorization (roles and permissions) Broken tenant isolation Broken property-level authorization (mass assignment and overexposure) Cross-site request forgery (CSRF)