Trust & quality
TeckPath Logic Catch Score
A published, reproducible measure of how reliably we find business-logic flaws that scanners miss — with proof, not possibilities.
Logic catch rate
100%
10/10 business-logic flaws
False positive rate
0.0%
Gate ≤ 5%
Quality gate
PASS
CI-gated release threshold
Last published
6/27/2026
Commit ef5f26f
Why this score matters
Unlike generic vulnerability scanners, TeckPath is measured against 10 deliberately seeded business-logic flaws in a controlled lab: IDOR, checkout tampering, voucher races, session auth bypass, inventory abuse, and related eCommerce logic. Every caught flaw requires reproducible, non-destructive proof — the same validation gate used on your engagement.
- In-repo teststore (deliberately flawed eCommerce API)
- Production WorkflowEngine — same code path as client engagements
- Post-run only; manifest never read during exploitation
- Business-logic flaws only (baseline XSS tracked separately)
Seeded flaw outcomes
Business-logic manifest — post-run scoring only
| Flaw | Category | Outcome |
|---|---|---|
| IDOR: cross-user order read | IDOR | caught |
| BOLA: cross-user account read | BOLA | caught |
| Checkout price tampering (client-trusted price) | checkout-price-tamper | caught |
| Single-use voucher race condition (TOCTOU) | voucher-race | caught |
| Broken object-level auth on authenticated session | session-auth | caught |
| Multi-step checkout bypass (empty-cart fulfillment) | checkout-chain | caught |
| Inventory oversell via unchecked reservation | inventory-oversell | caught |
| Cart quantity tampering (negative quantity accepted) | quantity-tamper | caught |
| Coupon stacking (duplicate apply) | coupon-stack | caught |
| Currency rounding to zero at checkout | currency-rounding | caught |
Recent runs
For buyers & partners
Use this page in RFP responses, MSP partner decks, and pilot proposals. Every client report includes a platform quality attestation referencing this benchmark.
For operators
Scores are CI-gated on every release. Operators can view the internal dashboard after sign-in.
Operator sign-in →