Trusting Unverified Inputs

Client-controlled or out-of-order signals get treated as authoritative (e.g., success redirects, query-string parameters, fake referers, or webhook timing), so logic advances despite missing proof or race conditions. Security and user state become unreliable.