Testing for business logic flaws