race-condition

From README

Race Condition Security Check (CWE-362) What this checks Protects against time-of-check-to-time-of-use (TOCTOU) and other race conditions where concurrent access to shared state creates a window for attackers to manipulate data between a check and its corresponding action. Exploitation leads to privilege escalation, double-spend, and data corruption. Vulnerable patterns File existence checked before opening, deleting, or creating — the file can be swapped between the check and the operation. Balance, quota, or counter read into memory, modified, then written back without locking or a transaction — concurrent updates lose writes or double-spend. "Does this username exist? if not, create it" with no database-level uniqueness constraint — two concurrent callers both see "no" and both create. Privilege or ownership checked in one call, then a separate later call performs the action on the same resource — the resource may have changed between calls.