The Business-logic class covers flaws in the rules of your app rather than in a single bad input. The in-app documentation lists payment, pricing and quota bypass, replay, race conditions and workflow state flaws. It is one of the ten vulnerability classes on the profile form.
The short version
Business-logic flaws are not about one malformed input. They appear when every single request looks valid, yet the sequence or the numbers let someone do something your product never meant to allow. A scanner that only matches known patterns tends to miss them, which is why this class has its own specialist agent. Short version: it tests the rules, not the syntax.
How it works in Cyberlop
Four areas make up this class, according to the in-app documentation.
- Payment, pricing and quota bypass: paying less than the price, or using more than a plan allows.
- Replay: sending a valid request again to get the same effect twice.
- Race conditions: two requests that arrive together and break a check.
- Workflow state flaws: skipping or repeating a step in a multi-step process.
During vulnerability analysis, one of eight specialist agents reads your code for this class. It writes hypotheses with an exact file and line. If the exploitation phase is on, a later agent tests each hypothesis against the live app and records the evidence. That is how a logic flaw ends up with a request, a response and a code location rather than a vague warning.
| Area | Plain example |
|---|---|
| Pricing bypass | A discount code that stacks |
| Replay | One payment confirmation accepted twice |
| Race condition | Two redemptions of a single-use voucher |
| Workflow state | Reaching the final step without paying |
What to do next
Tick Business-logic in the Scope section of a profile. Or leave every class unticked to cover all ten, which is a sensible default for a first audit of a checkout, a sign-up flow or any process that moves money. Add the rules of your product to Application context, especially the Business-critical flows field, so the agents know which flows matter most. See how to fill the application context.
For the full list of classes, read which vulnerability classes Cyberlop can test for. The glossary entry on a business-logic flaw explains the idea in plain English.
Related questions
- Which vulnerability classes can Cyberlop test for?
- How do I fill in the Application context for a profile?
- How do I choose which vulnerability classes a profile tests?
- What's the difference between the Auth and Authz classes?
- What does the exploitation phase do?
Choose vulnerability classes in a Cyberlop scan profile
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.