Breaking things
carefully,
then writing
about it.

function withdraw() external {
    require(balances[msg.sender] > 0);

    (bool success, ) = msg.sender.call{
        value: balances[msg.sender]
    }("");

    balances[msg.sender] = 0;  // state updated after external call
}

// Fix: checks-effects-interactions pattern
function withdrawSafe() external {
    uint256 amount = balances[msg.sender];
    balances[msg.sender] = 0;  // state first
    (bool success, ) = msg.sender.call{value: amount}("");
}