hunt-business-logic

## Crown Jewel Targets Business logic vulnerabilities pay highest in platforms where financial transactions, identity verification, and access controls intersect with real-world consequences. The richest targets are: - **E-commerce & payment platforms** (Valve/Steam, Shopify) — payment flow manipulation, free goods, price tampering - **Marketplace & gig economy apps** (Airbnb, Uber) — identity/verification bypass enabling fraud or unsafe interactions - **SaaS with tiered access** (Mozilla Monitor) — bypassing verification to unlock monitoring features without entitlement - **High-traffic consumer apps** (Snapchat, Yelp) — rate-limit bypass enabling spam, enumeration, or abuse at scale Asset types that pay: checkout flows, subscription endpoints, callback/verification systems, webhook handlers, employee/internal portals exposed to the internet, and any endpoint that trusts client-supplied data to make authorization decisions. --- ## Attack Surface Signals **URL patterns to watch:** - `/checkout`, `/order`, `/subscribe`, `/payment`, `/verify`, `/confirm`, `/callback` - `/internal`, `/employee`, `/summit`, `/staff`, `/admin` — internal pages accidentally public - `/api/v*/payment`, `/api/v*/notify`, `/webhook` — payment provider callbacks - Endpoints accepting `X-Forwarded-For`, `X-Real-IP`, `CF-Connecting-IP` headers **Response/header signals:** - `Set-Cookie` with unvalidated session state tied to cart or order data - Payment provider names in responses: `Smart2Pay`, `S...