Insecure Design
The application's architecture has fundamental security flaws — business logic on the client side, missing server-side validation, or no threat modeling.
How It Works
Insecure design is different from implementation bugs — it's a flaw in the architecture itself. Common patterns include putting authorization logic only in the frontend (React conditionals), relying on client-side validation without server-side checks, or designing flows that can be abused (like unlimited password reset attempts). No amount of perfect implementation can fix a fundamentally insecure design.
// React component — auth check only in frontend
{user.role === 'admin' && (
<button onClick={deleteAllUsers}>
Delete All Users
</button>
)}// API route — auth check on the server
app.delete('/api/users', async (req, res) => {
if (req.auth.role !== 'admin') {
return res.status(403).json({ error: 'Forbidden' });
}
await db.users.deleteMany();
});Real-World Example
Snapchat's Find Friends feature (2014) had an insecure design that allowed attackers to enumerate all phone numbers by brute-forcing the API. 4.6 million usernames and phone numbers were leaked because the API had no rate limiting by design.
How to Prevent It
- Always validate authorization on the server, never only in the frontend
- Implement rate limiting on sensitive operations
- Use threat modeling during the design phase
- Apply defense in depth — multiple layers of security
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Broken Access Control
highUsers can act outside their intended permissions, accessing other users' data or admin functionality without proper authorization checks.
Cryptographic Failures
highSensitive data is exposed due to weak or missing encryption — using outdated algorithms like MD5/SHA1, storing passwords in plaintext, or transmitting data without TLS.
Supply Chain Failures
mediumYour application inherits vulnerabilities from third-party dependencies — outdated packages with known CVEs that attackers actively exploit.
Security Misconfiguration
mediumDefault configurations, open CORS policies, debug mode in production, or verbose error messages expose your application to attackers.