Your checkout page has a discount field: type a code, the price drops 10%; type a wrong one, the button greys out. You tested it and it works — what you probably didn't test is the backend validation behind it. Now look at what the browser actually sends on "Pay": the cart, the code, and in a surprising number of apps, a total the page worked out for itself. If the server accepts that number as-is, the only thing stopping a 100% discount is JavaScript running in a browser the customer contr...