Risks from missing or ineffective security design — flaws that no perfect implementation can fix because the design itself is unsafe.