Insecure design

Some weaknesses are not defects. They are decisions.

A rate limit that was never specified, an approval step nobody asked for, a workflow that assumes good faith. The code does exactly what it was meant to. You cannot patch this, because nothing is broken; you have to change what the system does, which is why finding it late is so expensive.