diff --git a/.github/workflows/codeql-backfill.yml b/.github/workflows/codeql-backfill.yml
index 8fa203c7b..367358520 100644
--- a/.github/workflows/codeql-backfill.yml
+++ b/.github/workflows/codeql-backfill.yml
@@ -38,11 +38,13 @@ jobs:
       - name: Enumerate target commits
         id: commits
         shell: bash
+        env:
+          TARGET_BRANCH: ${{ inputs.branch }}
         run: |
           set -euo pipefail
 
           count="${{ inputs.commit_count }}"
-          branch="${{ inputs.branch }}"
+          branch="${TARGET_BRANCH}"
 
           if ! [[ "${count}" =~ ^[0-9]+$ ]]; then
             echo "commit_count must be a positive integer" >&2
diff --git a/frontend/src/erd/securityUtils.test.ts b/frontend/src/erd/securityUtils.test.ts
new file mode 100644
index 000000000..b6085fe28
--- /dev/null
+++ b/frontend/src/erd/securityUtils.test.ts
@@ -0,0 +1,31 @@
+import { describe, it, expect } from "vitest";
+import { sanitizeTableName } from "./securityUtils";
+
+describe("sanitizeTableName", () => {
+  it("should keep alphanumeric characters and underscores", () => {
+    expect(sanitizeTableName("Users_Table_123")).toBe("Users_Table_123");
+  });
+
+  it("should remove spaces", () => {
+    expect(sanitizeTableName("My Table Name")).toBe("MyTableName");
+  });
+
+  it("should remove special characters", () => {
+    expect(sanitizeTableName("Table!@#$%^&*()-=Name")).toBe("TableName");
+    expect(sanitizeTableName("Drop Table;--")).toBe("DropTable");
+    expect(sanitizeTableName("<script>alert(1)</script>")).toBe("scriptalert1script");
+  });
+
+  it("should remove unicode/emojis", () => {
+    expect(sanitizeTableName("Table_🌟")).toBe("Table_");
+    expect(sanitizeTableName("사용자")).toBe("");
+  });
+
+  it("should handle empty strings", () => {
+    expect(sanitizeTableName("")).toBe("");
+  });
+
+  it("should handle strings with only special characters", () => {
+    expect(sanitizeTableName("!!!***@@@")).toBe("");
+  });
+});