Tenant creation is validated and rate-limited

Tenant creation endpoints with no rate limiting and application-only slug uniqueness checks are vulnerable to two distinct attacks: bulk tenant creation to exhaust system resources or claim desirable slug namespaces (CWE-770), and concurrent-request slug duplication that bypasses the select-then-insert uniqueness check (CWE-20, OWASP A04). In freemium SaaS products, unthrottled tenant creation is also a primary spam and abuse vector that inflates billing, corrupts benchmark data, and degrades performance for legitimate tenants.

Enforce slug uniqueness at the database level and add a per-user rate limit on tenant creation:

// schema.prisma — database-enforced unique constraint
model Organization {
  slug String @unique
}

// src/app/api/orgs/route.ts — rate limit tenant creation per user
const ratelimit = new Ratelimit({
  redis,
  limiter: Ratelimit.fixedWindow(3, '1 d')
})
const { success } = await ratelimit.limit(`create-org:${session.user.id}`)
if (!success) return new Response('Too many organizations created today', { status: 429 })

The @unique constraint eliminates the race condition — the database rejects a duplicate slug with a constraint violation, which you catch and return as a 409 Conflict. Never rely on a prior SELECT check for uniqueness when concurrent inserts are possible.