{
  "id": 2977611,
  "title": "The Scanner Came Back Clean. The Discount Code Still Worked 40 Times.",
  "url": "https://urgent.news/2026/08/24/the-scanner-came-back-clean-the-discount-code-still-worked-40-times",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-24T08:01:08.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/rockyyy/the-scanner-came-back-clean-the-discount-code-still-worked-40-times-p9g"
  },
  "original_language": "en",
  "account": "A junior pentester on the engagement was ready to write \"no significant findings\" and move to the next target after an automated scan on a checkout flow came back clean. However, someone noticed an issue with the \"apply discount code\" endpoint not invalidating a single-use code until after the order confirmed. Curiosity led them to question what would happen if the request was sent multiple times before any of them finished. The answer was surprising: a single-use 50% code was redeemed forty times in under a second through concurrent requests. This vulnerability, a race condition, was missed by automated scanning as it tests requests one at a time. The gap between checking if a code is valid and marking it as used can be exploited if requests are sent simultaneously. Business logic that touches money or scarcity is often built with separate check and act steps, making it susceptible to this type of vulnerability. To find such issues, testers must send requests at the same instant, use tools specifically designed for race condition testing, and examine actual state changes rather than just success codes. This finding highlights the importance of considering concurrency in penetration testing, as automated scanners often miss vulnerabilities that occur only under concurrent request conditions.",
  "summary": "The automated scan on a checkout flow came back with nothing above low. No SQLi, no reflected XSS, no broken authentication, every OWASP Top 10 box quietly green. A junior pentester on the engagement was ready to write \"no significant findings\" and move to the next target, and honestly, most scanners would have agreed with them. Then someone on the team noticed the \"apply discount code\" endpoint…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}