Spot TOCTOU and check-then-act races in code

Jun 29, 2026 · 1 min read

Look for a read or check followed by a dependent write without a lock or atomic operation. Money, quotas, and file creation are the usual victims.

bash

grep -rEn "if .*balance|exists(|SELECT .*FOR UPDATE|lock(|transaction" --include=*.{py,java,js,ts,go,rb} .

The vulnerable shape checks then acts.

python

if account.balance >= amount:      # window here
    account.balance -= amount      # concurrent requests both pass the check
    account.save()

Pro note: the fix is a single atomic update with a conditional (UPDATE ... WHERE balance >= amount) or a row lock, not application-level checks. Flag file operations that check existence before create as symlink and TOCTOU risks, especially in shared temp directories.