diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 34122c2b4..5d6b5c8f8 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -28,3 +28,7 @@
 **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
 **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
 **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.
+## 2026-09-04 - CSV Injection Bypass via Control Characters
+**Vulnerability:** A regex designed to prevent CSV formula injection (`=`, `+`, `-`, `@`) was bypassed by prepending non-printable control characters (like `\x00` or `\x1B`). Since these characters are often ignored by spreadsheet software before formula evaluation, the payload could execute successfully despite the security logic.
+**Learning:** Checking for purely whitespace or printable structural characters is insufficient for security boundaries, as regex engines don't inherently block non-printable prefixes unless instructed.
+**Prevention:** Always explicitly cover control characters (`\x00-\x1F`) when building regex boundary sanitization. Ensure tools like ESLint allow this intention via bypass comments (`// eslint-disable-next-line no-control-regex`).
diff --git a/apps/desktop/src/lib/export.test.ts b/apps/desktop/src/lib/export.test.ts
index 265e983d4..3750ad30e 100644
--- a/apps/desktop/src/lib/export.test.ts
+++ b/apps/desktop/src/lib/export.test.ts
@@ -67,6 +67,8 @@ describe("export sanitization", () => {
       expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)");
       expect(escapeCsvField("\n-100")).toBe("\"'\n-100\"");
       expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\"");
+      expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2");
+      expect(escapeCsvField("\x1B+SUM(A1)")).toBe("'\x1B+SUM(A1)");
     });
 
     it("handles combined scenarios: formula injection with structural characters", () => {
diff --git a/apps/desktop/src/lib/export.ts b/apps/desktop/src/lib/export.ts
index 3d4493b1d..b1ca9ee89 100644
--- a/apps/desktop/src/lib/export.ts
+++ b/apps/desktop/src/lib/export.ts
@@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string {
 export function escapeCsvField(value: string): string {
   let escapedValue = value;
   // Prevent CSV formula injection by prefixing problematic leading characters with a single quote
-  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) {
+  // eslint-disable-next-line no-control-regex
+  if (/^[\s\uFEFF\xA0\x00-\x1F]*[=+\-@\t\r\n]/.test(value)) {
     escapedValue = `'${value}`;
   }
   // Enclose in double quotes if there's a comma, newline, or double quote
diff --git a/services/analysis-engine/tests/test_supply_chain_policy.py b/services/analysis-engine/tests/test_supply_chain_policy.py
index 1d8224c5a..6a0853944 100644
--- a/services/analysis-engine/tests/test_supply_chain_policy.py
+++ b/services/analysis-engine/tests/test_supply_chain_policy.py
@@ -1275,9 +1275,7 @@ def test_workflow_concurrency_cancels_only_superseded_pr_heads() -> None:
         workflow = (workflows_dir / workflow_name).read_text(encoding="utf-8")
         assert "concurrency:" in workflow, workflow_name
         assert "cancel-in-progress: false" in workflow, workflow_name
-        assert "contents: read" in workflow or "permissions: read-all" in workflow, (
-            workflow_name
-        )
+        assert "contents: read" in workflow or "permissions: read-all" in workflow, workflow_name
 
     assert "pull_request:" not in (workflows_dir / "release.yml").read_text(encoding="utf-8")