Sale prices are validated to be less than base prices

A sale price equal to or greater than the base price (salePrice >= basePrice) is a deceptive pricing display: the customer sees a crossed-out "original" price that is lower than or equal to the "sale" price. The FTC Act prohibits deceptive pricing, and several state consumer protection statutes specifically require that a reference price must reflect a genuine prior offer. CWE-20 (Improper Input Validation) covers this at the technical layer — the API accepts a logically invalid price relationship with no rejection. Even without legal exposure, a visible sale price of $60 crossed out next to a regular price of $50 destroys customer trust immediately.

Add a validation guard in src/app/api/products/route.ts that rejects product updates where salePrice >= basePrice.

if (salePrice !== undefined && salePrice >= basePrice) {
  return Response.json(
    { error: 'Sale price must be strictly less than base price' },
    { status: 400 }
  )
}

Also add a database-level check constraint if your Postgres version supports it:

ALTER TABLE products
  ADD CONSTRAINT sale_price_less_than_base
  CHECK (sale_price IS NULL OR sale_price < price);