diff --git a/.jules/pre_commit_instructions.md b/.jules/pre_commit_instructions.md
new file mode 100644
index 00000000..d4564908
--- /dev/null
+++ b/.jules/pre_commit_instructions.md
@@ -0,0 +1,3 @@
+# Pre-Commit Instructions
+
+Please review your work and ensure all tests pass.
diff --git a/frontend/src/erd/securityUtils.test.ts b/frontend/src/erd/securityUtils.test.ts
new file mode 100644
index 00000000..1c23f682
--- /dev/null
+++ b/frontend/src/erd/securityUtils.test.ts
@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeTableName } from './securityUtils';
+
+describe('sanitizeTableName', () => {
+  it('allows alphanumeric characters and underscores', () => {
+    expect(sanitizeTableName('valid_table_name_123')).toBe('valid_table_name_123');
+    expect(sanitizeTableName('Users')).toBe('Users');
+    expect(sanitizeTableName('table_1')).toBe('table_1');
+  });
+
+  it('removes spaces', () => {
+    expect(sanitizeTableName('table name')).toBe('tablename');
+    expect(sanitizeTableName('  padded  ')).toBe('padded');
+  });
+
+  it('removes special characters', () => {
+    expect(sanitizeTableName('table-name')).toBe('tablename');
+    expect(sanitizeTableName('user@domain')).toBe('userdomain');
+    expect(sanitizeTableName('drop table;--')).toBe('droptable');
+    expect(sanitizeTableName('SELECT * FROM users')).toBe('SELECTFROMusers');
+    expect(sanitizeTableName('table!@#$%^&*()_+={}|[]\\:";\'<>?,./')).toBe('table_');
+  });
+
+  it('handles empty strings', () => {
+    expect(sanitizeTableName('')).toBe('');
+  });
+
+  it('returns empty string if input contains only invalid characters', () => {
+    expect(sanitizeTableName('!@#$%^&*()')).toBe('');
+  });
+});