Weaknesses that stem from missing or flawed security thinking in the design rather than from coding mistakes.