The IDE extension that saw every attack on your app.

// controllers/transactions.ts  —  candidate patch
// Generated by ShieldProbe Fix · references 4 adjacent routes

import { validateAmount } from '@/lib/validators';

export async function withdraw(req, res) {
  const { account, amount } = req.body;

+ const parsed = validateAmount(amount, { min: 0.01, max: LIMITS.withdraw });
+ if (!parsed.ok) return res.status(400).json({ error: parsed.reason });

- if (balance < amount) return res.status(402).send();
+ if (balance < parsed.value) return res.status(402).send();

  // ... existing logic, now safe against negative/oversized amounts
}

// Fix also drafts companion patches for:
//   controllers/transfer.ts, refund.ts, credit.ts, adjust.ts

Reuses your helper. Catches every sibling route that shares the flaw. Preserves your existing 402 response shape. A generic assistant pointed at a finding summary would only patch the one file — and might even reinvent the validator.