diff --git a/app/api/phishing/campaigns/route.ts b/app/api/phishing/campaigns/route.ts
index 56e8c04..aac35d2 100644
--- a/app/api/phishing/campaigns/route.ts
+++ b/app/api/phishing/campaigns/route.ts
@@ -28,7 +28,8 @@ export async function GET(request: NextRequest) {
 
   try {
     const url = request.nextUrl;
-    const limit = Math.min(parseInt(url.searchParams.get('limit') ?? '50', 10) || 50, 200);
+    const rawLimit = parseInt(url.searchParams.get('limit') ?? '50', 10);
+    const limit = Math.min(Math.max(Number.isFinite(rawLimit) ? rawLimit : 50, 0), 200);
     const offset = Math.max(parseInt(url.searchParams.get('offset') ?? '0', 10) || 0, 0);
     const status = url.searchParams.get('status');