product's level, but semantically valid at the OS level, since it's well-formed.
Session fixation attacks introduce non-mutability when mutability is required.
Access control can sometimes be bypassed by changing lowercase to uppercase, preserving
equivalence.