The Promo Exclusion Breach

Finance found that last week's FLASH20 promotion was applied to some product categories that were explicitly excluded from it. The frontend showed the promo as valid for all categories — the backend never re-checked the exclusion list. Find the violations.