diff --git a/packages/2-sql/1-core/contract/test/default-sql-body.test.ts b/packages/2-sql/1-core/contract/test/default-sql-body.test.ts
index d555dcd06c31..5a64d504defa 100644
--- a/packages/2-sql/1-core/contract/test/default-sql-body.test.ts
+++ b/packages/2-sql/1-core/contract/test/default-sql-body.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { reservedSqlDefaultBody } from '../src/default-sql-body';
+import { checkSqlDefaultBody, reservedSqlDefaultBody } from '../src/default-sql-body';
 
 describe('reservedSqlDefaultBody', () => {
   it.each([
@@ -23,3 +23,22 @@ describe('reservedSqlDefaultBody', () => {
     expect(reservedSqlDefaultBody(body)).toBeUndefined();
   });
 });
+
+describe('checkSqlDefaultBody', () => {
+  it('returns undefined for a safe body with no unsafe tokens', () => {
+    expect(checkSqlDefaultBody('now()')).toBeUndefined();
+  });
+
+  it.each([
+    ['id = 1; DROP TABLE users'],
+    ['1 -- comment'],
+    ['/* comment */ 1'],
+    ['$$ dollar quoted $$'],
+    ['SELECT 1'],
+    ['select 1'],
+  ])('flags %j as unsafe', (body) => {
+    expect(checkSqlDefaultBody(body)).toBe(
+      'Default SQL must not contain semicolons, SQL comment tokens, dollar-quoting, or subqueries.',
+    );
+  });
+});