A06:2025: Insecure Design

Lack of threat modeling, missing security requirements, fundamentally insecure architecture.

Identified through threat modeling of the attack surface and authentication flows, flagging missing security requirements that automated tooling alone cannot catch.

A06:2025 maps to CWE-657, CWE-841, CWE-434.

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.