A 404 that lies on purpose is more honest than a 403
Fixing a cross-tenant IDOR taught me that 'access denied' and 'does not exist' are the same message when the requester should never learn which one is true.
#data-integrity
2 posts tagged this topic.
One writer, one lock: a race-proof FIFO stock ledger on plain PostgreSQL
Two POS terminals sell the last unit in the same second. Inventory survives that only if every stock mutation goes through one function, one advisory lock, and one idempotency key — and if sub-cent rounding residue dies the moment stock hits zero.