Business logic testing, as a first-class scan type
Twenty-nine abuse patterns (race conditions, IDOR, price manipulation, workflow bypass) now run as their own scan phase, against the class of flaw that has no CVE and no signature.
- Version
- 5.2
- Released
- February 12, 2026
- New features
- 4
- Category
- Detection
What's new
Features and improvements in this update
New features
429 business logic abuse patterns
Concurrent redemption, TOCTOU on balance operations, price and quantity manipulation between cart and capture, refund replay, coupon stacking, workflow step skipping and horizontal privilege drift each run as a modelled abuse case rather than a payload list.
Race condition detection with controlled concurrency
Endpoints that mutate shared state are hit with tuned parallel requests and the resulting state is read back, which catches the double-spend class of flaw that a sequential scanner cannot observe by construction.
IDOR testing across authenticated identities
Two or more authenticated sessions are used to attempt access to each other's objects across every discovered identifier, including nested and encoded ones, with the result verified against the expected authorisation outcome.
Workflow state modelling
Multi-step flows (checkout, onboarding, approval chains) are modelled as state machines so the scanner can attempt to skip, replay or reorder steps rather than testing each endpoint in isolation.
Improvements
2Non-destructive by default on every pattern
Each pattern stops at proof. A race condition is demonstrated by observing inconsistent state, not by draining a balance, and destructive variants stay off unless explicitly enabled for a test environment.
Findings carry the reproduction sequence
Logic findings include the ordered request sequence, the timing, and the state observed before and after, because a logic flaw described in prose is not reproducible by the engineer who has to fix it.
Benefits
What it changes for you
Stated as work removed rather than capability added, the only version of a benefit that can be checked.
Coverage of the flaws that cost money
Logic flaws do not appear in dependency scans or CVE feeds. They are found by abusing the application as designed, which until now meant paying for a manual assessment to look for them once a year.
Continuous, not annual
Because the patterns are automated, they run nightly against the application rather than during a scoped engagement window, so a logic flaw introduced in a sprint is found in that sprint.
Reproducible findings your engineers accept
The recorded sequence and observed state make the finding testable locally, which is the difference between a ticket that gets fixed and one that gets debated.
Upgrade
Getting it
Getting this update
Available on the CLI from 5.2.0 and enabled by default for new scan profiles. Existing profiles keep their configuration until logic testing is added explicitly.
pip install --upgrade aiptxRelated
Other updates
90+ SAST rules across Python, JavaScript, Java and Go
Static analysis with rules written against real exploit conditions rather than pattern matches, wired to the same validation and ranking as everything else.
ReadDAST for applications that stopped being pages
GraphQL, WebSocket and single-page application scanners ship together, so the parts of a modern application a crawler never reached are now tested like the rest of it.
ReadNothing gets reported until it has been exploited
Every candidate finding is now validated by replay before it reaches your queue. Unreproducible candidates are dropped rather than downgraded, which is what takes a scanner queue from thousands to dozens.
ReadSee Your Attack Surface in Real-Time
Run a comprehensive VAPT assessment powered by advanced security tools. Get actionable findings in hours, not weeks. No credit card required.