1router.get('/invoices/:id', async (req, res) => {
2  const invoice = await db.invoices
3    .findById(req.params.id);
4  return res.json(invoice);
5});
6
7
8

IDOR

Object references checked across services, not just within one handler.

1const reply = await llm.complete(`
2  You are a support agent with tools.
3  Ticket: ${ticket.body}
4`, { tools: [refundTool, lookupTool] });
5
6
7
8

Prompt injection

Untrusted text flowing into prompts, tool calls, and agent decisions.

1const total = cart.lockTotal();
2await payments.charge(card, total);
3applyCoupon(order, req.body.coupon);
4await order.confirm();
5
6
7
8

Logic flaws

Abuse paths that only appear when you reason about what the code is meant to do.

1const sort = sanitizeHtml(req.query.sort);
2const rows = await db.raw(
3  `SELECT * FROM repos ORDER BY ${sort}`
4);
5
6
7
8

Injection chains

Tainted input traced through helpers and layers to the query it finally reaches.

1const { url } = req.body;
2const img = await fetch(url);
3res.type('png').send(await img.buffer());
4
5
6
7
8

SSRF

Request builders that let user input steer internal traffic.

1const balance = await wallet.balance(user);
2if (balance >= amount) {
3  await wallet.debit(user, amount);
4}
5
6
7
8

Race conditions

Check-then-act windows an attacker can win with parallel requests.

1router.get('/invoices/:id', async (req, res) => {
2  const invoice = await db.invoices
3    .findById(req.params.id);
4  return res.json(invoice);
5});
6
7
8

IDOR

Object references checked across services, not just within one handler.

1const reply = await llm.complete(`
2  You are a support agent with tools.
3  Ticket: ${ticket.body}
4`, { tools: [refundTool, lookupTool] });
5
6
7
8

Prompt injection

Untrusted text flowing into prompts, tool calls, and agent decisions.

1const total = cart.lockTotal();
2await payments.charge(card, total);
3applyCoupon(order, req.body.coupon);
4await order.confirm();
5
6
7
8

Logic flaws

Abuse paths that only appear when you reason about what the code is meant to do.

1const sort = sanitizeHtml(req.query.sort);
2const rows = await db.raw(
3  `SELECT * FROM repos ORDER BY ${sort}`
4);
5
6
7
8

Injection chains

Tainted input traced through helpers and layers to the query it finally reaches.

1const { url } = req.body;
2const img = await fetch(url);
3res.type('png').send(await img.buffer());
4
5
6
7
8

SSRF

Request builders that let user input steer internal traffic.

1const balance = await wallet.balance(user);
2if (balance >= amount) {
3  await wallet.debit(user, amount);
4}
5
6
7
8

Race conditions

Check-then-act windows an attacker can win with parallel requests.

1router.get('/invoices/:id', async (req, res) => {
2  const invoice = await db.invoices
3    .findById(req.params.id);
4  return res.json(invoice);
5});
6
7
8

IDOR

Object references checked across services, not just within one handler.

1const reply = await llm.complete(`
2  You are a support agent with tools.
3  Ticket: ${ticket.body}
4`, { tools: [refundTool, lookupTool] });
5
6
7
8

Prompt injection

Untrusted text flowing into prompts, tool calls, and agent decisions.

1const total = cart.lockTotal();
2await payments.charge(card, total);
3applyCoupon(order, req.body.coupon);
4await order.confirm();
5
6
7
8

Logic flaws

Abuse paths that only appear when you reason about what the code is meant to do.

1const sort = sanitizeHtml(req.query.sort);
2const rows = await db.raw(
3  `SELECT * FROM repos ORDER BY ${sort}`
4);
5
6
7
8

Injection chains

Tainted input traced through helpers and layers to the query it finally reaches.

1const { url } = req.body;
2const img = await fetch(url);
3res.type('png').send(await img.buffer());
4
5
6
7
8

SSRF

Request builders that let user input steer internal traffic.

1const balance = await wallet.balance(user);
2if (balance >= amount) {
3  await wallet.debit(user, amount);
4}
5
6
7
8

Race conditions

Check-then-act windows an attacker can win with parallel requests.