Concurrent team creation can generate duplicate slugs and cause team namespace collisions

[Ridanshi]

Summary

Team slug generation relies on availability checks performed separately from persistence.

Under concurrent team creation requests, multiple operations can generate identical slugs.

Affected Files

• teamService.ts
• slug.ts

Root Cause

The slug allocation flow performs uniqueness validation before record creation.

Concurrent requests can observe the same available slug and attempt insertion simultaneously.

The workflow lacks transactional slug allocation guarantees.

Reproduction

1. Create multiple teams with identical or similar names simultaneously.
2. Observe slug generation.
3. Inspect resulting team records.
4. Observe duplicate slug attempts or creation failures.

Expected Behavior

Slug allocation should remain unique under concurrent creation.

Actual Behavior

Concurrent requests can collide on slug generation.

Why This Is Difficult To Detect

Sequential creation behaves correctly.

The issue only appears under concurrency.

Production Impact

• Team creation failures
• Namespace collisions
• Inconsistent URLs
• User confusion

Suggested Fix

Introduce atomic slug allocation or retry generation on collision.

Severity

Medium-High

[Ridanshi]

I investigated this issue and would like to work on it.

The current team slug allocation workflow appears vulnerable to concurrent creation races.

I plan to:

• review slug generation logic
• preserve existing URL behavior
• enforce uniqueness under concurrency
• add regression tests covering simultaneous team creation

Please assign this issue to me.