I noticed that after setting up a couple of employees, the same number pin cannot be used.
Is this behaviour the same as production? If yes, then this is a secutity risk.
Consider the scenario if the employee received this message when adding another employee in the system. He/she could then login in as the employee if they knew the pin was already taken.
The ability to change an employee's PIN is restricted to accounts with the 'admin' role (including the owner's account). These accounts/users can view existing PINs and change PINs. Normal employee logins (with 'manager' or 'employee' role) will never have the ability to change PINs, so they wouldn't be able to see the message about a PIN already being taken.
