Coupon Stacking Abuse in Bug Bounty: Combining Codes That Should Not Combine
Marketing wants stacking campaigns. Finance wants one code per cart. Engineering sometimes ships both intentions at once. Your job is to find the cart that applies SAVE20 and FREESHIP and a referral credit until the payable amount collapses.
Read the public coupon rules first. If the site says "cannot be combined," that sentence is your severity anchor.
Apply codes like a hostile customer
Capture POST /cart/coupons or whatever mutation attaches a code. Apply code A, then code B without removing A. Some UIs hide the second input; the API may still accept another promo field or a repeated array element.
Patterns that work:
- Two percentage coupons on one order
- Percentage plus fixed amount
- Free shipping plus a cart-wide percent
- Referral credit applied after a coupon
- The same code twice with different case or Unicode lookalikes
Check whether removing a code in the UI actually clears server state. I've cleared the badge in the browser and still seen both discounts on GET /cart.
Race the apply endpoint too. Fire two different codes in parallel against an empty coupon slot. The winner might be "both" if the write is not transactional.
Affiliate cookies that silently inject a partner code on top of a typed coupon are easy to miss. Clear marketing cookies, apply your test code, then reintroduce the affiliate parameter and reload the cart. If a second discount appears without a second explicit apply, treat it as stacking.
Abuse limits and audience gates
Single-use codes reused across accounts, first-order coupons on a second purchase, and employee codes accepted without an email domain check are cousins of stacking. Test one owned account, then a second fresh account, and keep codes inside the program's allowed test set—do not burn partner coupons harvested from public Slack leaks unless the program scopes that.
Watch minimum-spend rules. A coupon that requires $50 sometimes still sticks after you remove items below the threshold. That is a stacking-adjacent logic flaw: the discount remains while the constraint evaporated.
Prove policy violation, not "I saved money"
Merchants expect discounts. Your report must show the combination violates stated policy or internal exclusivity flags. Quote the FAQ line. Show cart JSON with two discounts[] entries and the final amount_due. If you can complete a sandbox purchase, include the order summary.
Nice extras: whether stacking works only via API, whether a third code still applies, and whether the discount can push the total to zero while shipping physical goods.
Fixes are usually exclusivity groups in the pricing engine, server-side revalidation on every cart mutation, and atomic coupon attachment. Client-side "one coupon" UX is not a control.
Gift cards plus coupons count as stacking when marketing copy forbids combining "promotional offers." Test a store credit residual with a percent-off code. If both reduce the same payable total past the published ceiling, say so with arithmetic.
When you write it up, keep the narrative tight: rule → two codes → stacked total → payable proof. Coupon bugs are easy to overclaim; numbers beat adjectives.