#psycopg

Databases Bug Report

Wallet double-spend under READ COMMITTED: a lost update between SELECT and UPDATE

John Nguyen · May 18, 2026 · 10 min read

Two withdrawals hit the same wallet within milliseconds, both saw enough balance, and the user spent more than they had. The code ran inside a transaction, but READ COMMITTED does not protect a read-then-write. We compare atomic updates, row locks and stricter isolation.

Databases Bug Report

SQL injection through the ORDER BY sort parameter in a FastAPI listing endpoint

Daniel Tran · Jul 29, 2025 · 9 min read

Every value in our orders API was a bound parameter, except the sort column, which was pasted into ORDER BY from the query string. A pentest proved it was injectable. We replaced it with an allowlist map and added tests that fuzz the sort input.

Databases Bug Report

Postgres job queue processes the same job twice: fixing it with FOR UPDATE SKIP LOCKED

John Nguyen · Mar 25, 2025 · 9 min read

Customers got two copies of the same invoice email because two workers claimed one job row. The claim query looked atomic but was not under READ COMMITTED. One CTE with FOR UPDATE SKIP LOCKED, plus a lease, fixed it.