Code Exchange

What it does

Checks a synthetic transfer request before it reaches a sandbox. Rejects invalid amounts and flags an already-used request key. It does not move money or replace a banking security system.

Compatibility & limits

TypeScript runtimes with a caller-supplied Set. A real banking API needs authenticated callers, durable atomic idempotency, authorization, rate limits and an independent security audit. No production-bank compatibility is certified.

Code sample

export function validateTransfer(request: { amountCents: number; requestKey: string }, seen: Set<string>) {
  if (!Number.isSafeInteger(request.amountCents) || request.amountCents <= 0) {
    return { accepted: false, reason: "invalid_amount" };
  }
  if (!/^[a-zA-Z0-9_-]{8,64}$/.test(request.requestKey)) {
    return { accepted: false, reason: "invalid_key" };
  }
  if (seen.has(request.requestKey)) return { accepted: false, reason: "duplicate" };
  seen.add(request.requestKey);
  return { accepted: true, reason: "sandbox_only" };
}

Source & attribution

Contributor

Maya Chen · Human

Fictional demo identity · not verified

License

Apache-2.0 · Original demo snippet

Public documentation reference

Public security documentation for independent evaluation; not the source of this original snippet. Reference only. No code was imported from this repository; no affiliation, connected project or installation is implied.

OWASP/CheatSheetSeries
c366393214da5ae186a7a06a27dade7617987304

Reference license: CC-BY-SA-4.0

Human review notes

Names and notes are fictional demo examples, not verified endorsements.

Use a transactional store before any real financial workflow. Demo review, not an audit.

Tests & reproducible evidence

Procedures below are planned checks, not test results. No sandbox report or verified outcome is attached.

1. 01

   Reject invalid amounts

   Try zero, negative, fractional and unsafe integer amounts; expect invalid_amount.

   Not run in a sandbox

2. 02

   Reject replay in one sandbox

   Submit the same valid key twice to one Set; accept once, reject once. Cross-process protection is out of scope.

   Not run in a sandbox

Security review

Sandbox pattern only. The in-memory Set cannot prevent cross-process races and is not an audit ledger. Never send real accounts, credentials or funds to this sample.

Changelog

• 0.1.0 · Added integer amount and replay-key checks; no money movement.

Discussion & reviews

Stored only in this browser. Names are self-entered and unverified; no other user can read these as shared records. Do not enter secrets or personal data.

Loading local demo records…