securityhigh impacttier 1100% confidence
Concurrent order creations with same coupon code — race condition on used_count
from coupons agent · cross-site verified across production deployments
The trigger
Concurrent order creations with same coupon code — race condition on used_count
The fix
Use SECURITY DEFINER plpgsql function with FOR UPDATE lock to atomically validate+increment
Code example
SELECT ... FROM coupons WHERE code=? FOR UPDATE; if constraints pass: UPDATE coupons SET used_count=used_count+1Related patterns
Does your site have this security issue?
Run a free scan — we'll check all security patterns in 30 seconds.
Scan your site free →