Percentage inputs reject unrealistic range

An APY input that accepts 500% or a discount input that accepts -20% doesn't just produce wrong results — it can crash downstream calculations, trigger integer overflow in cents conversion, or be exploited to generate artificially favorable rates. OWASP A03 covers unvalidated numeric inputs. Even without malicious intent, an accidental entry of 5 instead of 0.05 for a decimal rate doubles or quintuples a fee, producing silent data corruption that's hard to detect in logs.

Add explicit range constraints to all percentage fields in both the form schema and the API validation. Determine whether the field uses 0-100 percent notation or 0-1 decimal notation and constrain accordingly.

// src/lib/schemas.ts
// For user-facing APY / interest rate inputs (0-100%)
export const aprSchema = z.number()
  .min(0, 'Rate cannot be negative')
  .max(100, 'Rate cannot exceed 100%');

// For internal decimal representation (0-1)
export const decimalRateSchema = z.number().min(0).max(1);

Apply these schemas in the relevant API routes under src/app/api/ and add corresponding min / max attributes to the form inputs in src/components/.