Why this matters
The bug. Pre-Go 1.22, for _, item := range items reuses the same item storage across iterations. By the time the goroutine runs, the loop has moved on and item holds the final value. All goroutines process the same input.
The fix. Pass the value as a goroutine argument, or shadow it with item := item before the go. Both copy the value at the right moment.
Modern Go. 1.22 changed the spec to capture per-iteration. If your go.mod declares go 1.22+, the original code is correct. Otherwise: still a bug, still ships.
Review heuristic
Every check-then-act over shared state is a race waiting for production load. Look for read-then-write pairs that aren't inside a transaction, a lock, or an atomic CAS. If you can articulate the bug as "if two requests arrive at the same time, both will...", it's a race.
External reference: CWE-362: Concurrent Execution using Shared Resource.