race condition in adding team members

Summary

The researcher reported a race condition when adding new staff members that would allow bypassing the staff account limit for all plans. We fixed this issue by adding an exclusive lock around the account creation process.

Note: Shopify no longer accepts reports regarding race conditions bypassing plan limits to this bug bounty program. Please make sure to check that your report has additional merchant impact beyond bypassing a plan limit before reporting.