API

Business Logic

• When there's a limited invitation functionality try sending the invitation to multiple people exceeding the limit , if it let's you one by one invite over you may bypass them. refer

  • If the functionality is for premium users , try adding free one , maybe they can get benefited too. refer

• If there's a functionality where api gives specific number of some service try race condition vulnerability . refer