WAF Test: Try manipulating the category parameter with path traversal (e.g., ?category=../../etc/passwd) or injection payloads.