diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 1c145b3a0..80edc7233 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,7 @@
 **Vulnerability:** User-provided string fields (like project and connection names) lacked strict validation against control characters, only relying on length constraints.
 **Learning:** This could potentially lead to Log Injection (CRLF injection), Null Byte Injection, or terminal escape injection if these strings are subsequently logged or rendered directly.
 **Prevention:** Use explicit regex validation `pattern=r'^[^\x00-\x1F\x7F]+$'` on Pydantic string fields to strictly reject control characters.
+## 2025-02-18 - Hardening Pydantic String Fields Against Control Characters (Continued)
+**Vulnerability:** User-provided string fields for diagram views, API keys, and table annotations lacked strict validation against control characters.
+**Learning:** This extends the log injection and terminal escape vulnerability surface to these additional API endpoints.
+**Prevention:** Apply the `pattern=r'^[^\x00-\x1F\x7F]+$'` regex constraint to all relevant string fields in Pydantic schemas (excluding multiline fields like markdown bodies or layout JSON).
diff --git a/backend/app/schemas.py b/backend/app/schemas.py
index d7c6de77d..5fd3a7922 100644
--- a/backend/app/schemas.py
+++ b/backend/app/schemas.py
@@ -190,7 +190,11 @@ class IndexRedundancyOut(BaseModel):
 class DiagramViewCreateIn(BaseModel):
     """Request body for saving an ERD canvas view."""
 
-    name: str = Field(min_length=1, max_length=200)
+    name: str = Field(
+        min_length=1,
+        max_length=200,
+        pattern=r"^[^\x00-\x1F\x7F]+$",
+    )
     # Opaque client layout (node positions, hidden tables, viewport). The API
     # bounds the serialized size in the endpoint to prevent abuse.
     layout_json: dict
@@ -214,8 +218,16 @@ class DiagramViewDetailOut(DiagramViewOut):
 class TableAnnotationUpsertIn(BaseModel):
     """Request body for creating/updating a table annotation."""
 
-    schema_name: str = Field(min_length=1, max_length=255)
-    relation_name: str = Field(min_length=1, max_length=255)
+    schema_name: str = Field(
+        min_length=1,
+        max_length=255,
+        pattern=r"^[^\x00-\x1F\x7F]+$",
+    )
+    relation_name: str = Field(
+        min_length=1,
+        max_length=255,
+        pattern=r"^[^\x00-\x1F\x7F]+$",
+    )
     body: str = Field(min_length=1, max_length=10_000)
 
 
@@ -302,7 +314,11 @@ class DbmlConvertOut(BaseModel):
 class ApiKeyCreateIn(BaseModel):
     """Request body for creating an API key."""
 
-    key_name: str = Field(min_length=1, max_length=128)
+    key_name: str = Field(
+        min_length=1,
+        max_length=128,
+        pattern=r"^[^\x00-\x1F\x7F]+$",
+    )
 
 
 class ApiKeyOut(BaseModel):