Business Flow Security (cross-endpoint analysis)

Audits multi-step business flows for vulnerabilities that are invisible when endpoints are checked in isolation — order/payment/invoice state-machine violations, cross-step data provenance (stale or client-supplied totals at terminal steps), chained/association IDOR (ownership through entity joins), replay and duplication across steps, step-skipping via direct access, post-payment mutation, amount drift, and privilege transitions between hops. Use when the app has stateful workflows (checkout, signup/verify, submit/approve/publish, request/approve/execute, refunds, provisioning) — the classic case is "order, payment, and invoice each look fine alone, but order → payment →…