ActionItem.objects.update_or_create(linear_issue_id=issue["id"], defaults={"incident": incident, ...}) keys solely on linear_issue_id. If the same Linear issue is referenced as a related issue from a different incident's parent (or was previously associated with another incident), this sync will silently reassign the ActionItem to the current incident, mutating another incident's data. The subsequent delete step then removes ActionItems no longer matching by linear_issue_id, but the cross-incident hijack already occurred. This violates data isolation between incidents.

The new parse_incident_id function calls re.escape and re.match, but the import block shown does not include import re. If re is not imported elsewhere in the file, any call to parse_incident_id will raise NameError at runtime, breaking incident ID parsing for endpoints that depend on it.

Also found at:

• src/firetower/integrations/services/linear.py:142-145

_request_new_token deletes all LinearOAuthToken rows and creates a new one inside transaction.atomic() without row-level locking. If two requests hit _get_access_token near expiry, both will call Linear's token endpoint and race to delete/insert, potentially invalidating a token another in-flight request just stored, and producing redundant token requests against Linear (rate-limit risk). Use select_for_update() or a database-level lock / cache lock so only one worker refreshes at a time.

Also found at:

• src/firetower/integrations/services/linear.py:125-135

The list() method calls sync_action_items_from_linear(incident) on every GET request. While the description claims throttling exists in the service layer, any unauthenticated-but-permitted user with access can repeatedly hit this endpoint to trigger external Linear API calls. If the service-level throttle is per-incident rather than per-user/IP, this could be abused for resource exhaustion or to amplify load on the Linear API. The broad except Exception swallows all errors silently, which can mask repeated failures.

Also found at:

• src/firetower/incidents/views.py:380-396