Home / Knowledge hub / Inventory hoarding
Knowledge hub
Inventory hoarding
Holding stock in carts or bookings so real buyers cannot get it.
What it means
Inventory hoarding is when someone reserves stock they have no intention of buying. Items sit in a cart, a ticket is held during checkout, a table or room is booked and never used. The system sets the goods aside, and nobody else can have them.
OWASP lists it as denial of inventory. It needs no stolen data and no broken code. The attacker simply uses a reservation feature exactly as designed, but in bulk and without paying.
Why it matters
Real buyers find the product sold out when it is not, and go elsewhere. Sales are lost, and the stock may sit unsold until the holds expire. For limited drops, bookings and ticketing the loss lands at the moment of highest demand.
It can also be used by a competitor to block your sales or by resellers to keep stock out of customers' reach. Because the holds are real, the dashboard shows high demand while revenue stays flat.
How it shows up
You meet it, often driven by bots, in e-commerce carts, ticketing, travel and hotel booking, appointment and restaurant systems, and flash sales. Weak points are holds with no time limit, no cap on how much one account can reserve, and reservations that need no sign-in or payment.
Keep holds short and visible, cap quantities per account and per payment method, require sign-in, release stock if a step is abandoned and watch for repeat holders who never pay. Test by creating many reservations as one account, and by resubmitting the hold to extend it, as in limit overrun.
Questions people ask
Inventory hoarding, answered
Is inventory hoarding a hack?
Not in the usual sense. No protection is bypassed. A feature is used in bulk for a purpose it was not designed for, which makes it a business-logic problem.
How long should a cart hold last?
As short as your checkout allows. Many sites hold stock for minutes, not hours, and release it when a step is abandoned. The right figure depends on how long a genuine purchase takes.
Does a bot defence solve it?
It helps, because hoarding is often automated. But a person with several accounts can do it by hand, so you also need quantity caps and consequences for holds that never convert.
How do we know it is happening?
Look for a high rate of holds that expire unpaid, a few accounts holding large amounts, and sell-outs that do not match payments.
How do we test our reservation flow?
Create holds repeatedly with one account and with several, try to extend an expiring hold, and check whether quantity limits apply on the API as well as on the page.
Sources
Where this comes from
Related
Terms that sit next to this one
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
Business logic flaw
Nothing is technically broken, but your own rules turn against you.
Limit overrun
Exceeding a cap, such as one redemption per customer, with parallel requests.
Ticket scalping
Bots buying scarce items or tickets in bulk to resell them.
Workflow bypass
Skipping a required step, such as payment or approval, by calling a later one directly.
How much can one account hold?
Reservation and limit logic is part of what we test. We try to exceed caps, extend holds and skip steps, and report only what actually worked, with the requests. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.