Test payment flows for price manipulation - Check coupon/discount codes for abuse - Test rate limiting on sensitive endpoints - Check for race conditions in concurrent requests - Test file upload for type bypass, path traversal - Check for information disclosure in error messages, API responses