securityhigh impacttier 1100% confidence

Concurrent order creations with same coupon code — race condition on used_count

from coupons agent · cross-site verified across production deployments

The trigger

Concurrent order creations with same coupon code — race condition on used_count

The fix

Use SECURITY DEFINER plpgsql function with FOR UPDATE lock to atomically validate+increment

Code example

SELECT ... FROM coupons WHERE code=? FOR UPDATE; if constraints pass: UPDATE coupons SET used_count=used_count+1

Related patterns

Does your site have this security issue?

Run a free scan — we'll check all security patterns in 30 seconds.

Scan your site free →