thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Unrestricted Access to Sensitive Business Flows

API6:2023, exposure of a business flow (such as purchasing or posting) to automated abuse that harms the business, even without a code bug.

Definition

Examples include scalping limited inventory, mass account creation and referral fraud. Mitigations include identifying sensitive flows, device fingerprinting, bot detection, CAPTCHA or human-verification challenges, rate limits per user and per flow, and blocking non-human patterns.

Example

Bots buy all concert tickets within seconds of release via the checkout API.

Exam tip

This is a design/business logic issue; the fix is anti-automation, not input validation.

Related terms