From f71ca51b3282789cf355e4a1d12d30514de032cf Mon Sep 17 00:00:00 2001
From: Donovan! <thatgamer253@gmail.com>
Date: Mon, 20 Jul 2026 02:33:50 -0400
Subject: [PATCH] Potential fix for code scanning alert no. 12: Incomplete
 string escaping or encoding

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/hybrid-search-sources.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/hybrid-search-sources.ts b/src/hybrid-search-sources.ts
index 035887d..8efb42d 100644
--- a/src/hybrid-search-sources.ts
+++ b/src/hybrid-search-sources.ts
@@ -121,7 +121,8 @@ export async function entityMatchBoost(
   searchMode?: MemorySearchMode,
 ): Promise<BoostedId[]> {
   try {
-    const escaped = `%${query.replace(/[%_]/g, '\\$&')}%`;
+    const escapedQuery = query.replace(/\\/g, '\\\\').replace(/[%_]/g, '\\$&');
+    const escaped = `%${escapedQuery}%`;
     const params: unknown[] = [escaped];
     const filters = buildWhereClause(db.dialect, params, projectId, type, tags, minImportance, searchMode);
     params.push(limit);