diff --git a/backend/handlers/notifications/notifications.go b/backend/handlers/notifications/notifications.go
index 95d41a3..f654777 100644
--- a/backend/handlers/notifications/notifications.go
+++ b/backend/handlers/notifications/notifications.go
@@ -47,7 +47,7 @@ func GetNotifications(w http.ResponseWriter, r *http.Request) {
 	if p, err := strconv.Atoi(r.URL.Query().Get("page")); err == nil && p > 0 {
 		page = p
 	}
-	if pp, err := strconv.Atoi(r.URL.Query().Get("per_page")); err == nil && pp > 0 {
+	if pp, err := strconv.Atoi(r.URL.Query().Get("per_page")); err == nil && pp > 0 && pp <= 100 {
 		perPage = pp
 	}
 
@@ -211,13 +211,12 @@ func GetUnreadCount(w http.ResponseWriter, r *http.Request) {
 func AcknowledgeNotification(w http.ResponseWriter, r *http.Request) {
 	idStr := chi.URLParam(r, "id")
 	if idStr == "" {
-		http.Error(w, "Notification ID is required", http.StatusBadRequest)
+		http.Error(w, "missing notification ID", http.StatusBadRequest)
 		return
 	}
-
 	id, err := strconv.Atoi(idStr)
-	if err != nil {
-		http.Error(w, "Invalid notification ID", http.StatusBadRequest)
+	if err != nil || id <= 0 {
+		http.Error(w, "invalid notification ID", http.StatusBadRequest)
 		return
 	}
 
diff --git a/backend/handlers/notifications/notifications_test.go b/backend/handlers/notifications/notifications_test.go
index 5ca7320..ea168f0 100644
--- a/backend/handlers/notifications/notifications_test.go
+++ b/backend/handlers/notifications/notifications_test.go
@@ -456,8 +456,8 @@ func TestNotifications_AcknowledgeInvalidID(t *testing.T) {
 		expectCode  int
 	}{
 		{"non_numeric_id", "abc", http.StatusBadRequest}, // Invalid format
-		{"negative_id", "-1", http.StatusNotFound},     // Valid int, not found
-		{"zero_id", "0", http.StatusNotFound},           // Valid int, not found
+		{"negative_id", "-1", http.StatusBadRequest},   // Invalid (non-positive)
+		{"zero_id", "0", http.StatusBadRequest},         // Invalid (non-positive)
 	}
 
 	for _, tt := range tests {