Business Logic Review
Focus
- state machine gaps
- approval or refund bypasses
- replay and duplicate processing
- quota and entitlement circumvention
- race conditions around credits, inventory, or invitations
- UI-only controls missing server-side enforcement
Method
- Identify the invariant the product is trying to preserve.
- Trace where the invariant is enforced.
- Look for alternate paths, retries, replays, and admin shortcuts.
- Confirm whether enforcement survives background jobs and webhooks.