Exercise 3: Same Vulnerabilities, Still a Necessary Chapter — Possible Solution
====================================================================

WHY NONE OF THE VULNERABILITY CLASSES ARE NEW
------------------------------
Per this chapter's own closing synthesis, every issue it covers maps
directly onto categories OWASP Top 10 already taught in general -
Broken Access Control, Injection, Security Misconfiguration/
Vulnerable Components, and Cryptographic Failures. The chapter states
this outright: "None of it is new to e-commerce specifically."

WHY THIS CHAPTER IS STILL NECESSARY
------------------------------
Per this chapter, what changes on a store is "what a successful
exploit is actually worth to an attacker: real payment fraud, a real
customer PII breach with genuine legal exposure under regimes like
GDPR, and direct revenue loss - not merely reputational
embarrassment." The chapter is necessary not because it teaches new
attack techniques, but because it applies the already-known
techniques to specific, concrete store surfaces (checkout, order
lookup, saved account fields) where the general principle alone
doesn't make clear exactly where and how severely it applies.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly states that the vulnerability classes are the same ones
already taught elsewhere on the site, and correctly explains that the
chapter's real value is applying those same classes to store-specific
surfaces and consequences, not inventing new categories of
vulnerability.