Bug-hunter prompt: catches edge cases your tests missed

Act as a paranoid senior engineer performing a security-first code review. For the code below:
1. List every possible failure mode (race conditions, off-by-one, null deref, uncaught exceptions, TOCTOU, SSRF, SQLi, etc.)
2. For each, rate severity Critical/High/Medium/Low
3. Show a minimal repro test case
4. Suggest the exact patch (diff-style)

Code:
```
{PASTE CODE HERE}
```

🔴 CRITICAL: Line 42 — race condition on `user.balance` …