Hi,
A customer was not charged shipping on a product (cart 4.28). I could not figure out how. We have custom shipping setup with 3 preset shipping amounts. Then I figured out how the customer was able to do it, whether it was inadvertent or not.
If you setup a cart session, when you checkout and the shipping is displayed, simply go to your browser (such as Firefox which does not require restart), and turn off Javascript. Bingo, shipping is not enforced and you can checkout without shipping! In Firefox, you can disable/enable Javascript on the fly.
Now, I cannot be certain that the customer deliberately tried to get $6.95 savings, but this means that Javascript is part of the validation of shipping, which means if there is a javascript error in a users browser, they can still proceed to pay without shipping.
I am bringing this up because although not super urgent, you can get around required shipping. There should maybe be another check that does not allow 0 shipping on packaged items. One that checks without javascript when a user presses the button to go to the next step after shipping selection.