One coupon, fifty orders
You posted a single-use 100%-off code for a launch giveaway. Within one second it was used for fifty free orders.
This answers: Why was a single-use coupon used many times? No coding needed. 3 quick decisions.
- Where your data lives
- Payments and webhooks
Checking your access…
Why was a single-use coupon used many times?
Because the code checks whether the coupon was used and marks it used in two separate steps. When many requests arrive at once, they all pass the check before any update happens. Make the database enforce it in one step, for example an update that only succeeds where used is false, or a unique constraint on redemptions.
Breaks at Your server: Check and update are two separate steps
Why AI tools write this bug
AI-generated code reads, checks and writes in sequence, which is correct one request at a time and is rarely tested with parallel requests.
How to fix it
- Find check-then-update code for coupons, credits, stock and invites.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Doesn't disabling the button prevent double redemption?
- Only for people clicking it. Scripts send requests directly, so the protection has to live in the database.