Your Ultimate Pentesting Arsenal
Architecture that doesn't implement layered authentication
Design that allows direct access to sensitive resources
Lack of validation in system design