diff --git a/src/__tests__/no-control-bytes-guard.test.ts b/src/__tests__/no-control-bytes-guard.test.ts
new file mode 100644
index 000000000..25982880d
--- /dev/null
+++ b/src/__tests__/no-control-bytes-guard.test.ts
@@ -0,0 +1,41 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+import { walkSourceFiles } from "@/__tests__/helpers/source-files";
+
+/**
+ * No raw control byte in a source file, apart from tab, newline and carriage
+ * return.
+ *
+ * A control byte typed into a string literal is invisible in an editor, a
+ * diff and a review, renders as nothing or as a box, and survives copy and
+ * paste unseen; the same value written as an escape (`"\x01"`) is the same
+ * string and can be read. Three such bytes had crept in, one of them in a
+ * production join key.
+ */
+const CONTROL = /[\x00-\x08\x0b\x0c\x0e-\x1f]/;
+
+describe("source files carry no raw control bytes", () => {
+  it("every file under src/ is free of them", () => {
+    const src = join(process.cwd(), "src");
+    const files = walkSourceFiles(src, {
+      floor: 3000,
+      extensions: [".ts", ".tsx", ".js", ".mjs", ".css", ".json", ".md"],
+    }).filter((file) => !file.startsWith("generated/"));
+    const offenders: string[] = [];
+    for (const file of files) {
+      const lines = readFileSync(join(src, file), "utf8").split("\n");
+      lines.forEach((line, i) => {
+        if (CONTROL.test(line)) offenders.push(`${file}:${i + 1}`);
+      });
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  it("recognises a control byte when one is there", () => {
+    expect(CONTROL.test("a\u0001b")).toBe(true);
+    expect(CONTROL.test("tab\tnewline\ncr\r")).toBe(false);
+  });
+});
diff --git a/src/lib/clinician-share/__tests__/exif-strip.test.ts b/src/lib/clinician-share/__tests__/exif-strip.test.ts
index 5948ad966..e03a86e21 100644
--- a/src/lib/clinician-share/__tests__/exif-strip.test.ts
+++ b/src/lib/clinician-share/__tests__/exif-strip.test.ts
@@ -53,7 +53,7 @@ describe("stripImageMetadata — passthrough", () => {
 describe("stripImageMetadata — JPEG", () => {
   // SOI + APP0(JFIF) + APP1(Exif w/ GPS) + APP2(ICC) + COM + DQT + SOS + scan.
   const soi = Buffer.from([0xff, 0xd8]);
-  const app0 = jpegSegment(0xe0, Buffer.from("JFIF\0

\0\0
\0
\0\0"));
+  const app0 = jpegSegment(0xe0, Buffer.from("JFIF\0\x01\x01\0\0\x01\0\x01\0\0"));
   const exifPayload = Buffer.concat([
     Buffer.from("Exif\0\0"),
     // A recognisable GPS marker string we can assert is gone.
diff --git a/src/lib/geo/__tests__/geolite2-fetch.test.ts b/src/lib/geo/__tests__/geolite2-fetch.test.ts
index 8caed00e3..f9ea0572d 100644
--- a/src/lib/geo/__tests__/geolite2-fetch.test.ts
+++ b/src/lib/geo/__tests__/geolite2-fetch.test.ts
@@ -31,8 +31,8 @@ import {
   MAXMIND_DOWNLOAD_BASE,
 } from "@/lib/geo/geolite2-fetch";
 
-const CITY_BYTES = Buffer.from("CITY-MMDB-CONTENT-
");
-const ASN_BYTES = Buffer.from("ASN-MMDB-CONTENT-");
+const CITY_BYTES = Buffer.from("CITY-MMDB-CONTENT-\x01\x02\x03");
+const ASN_BYTES = Buffer.from("ASN-MMDB-CONTENT-\x04\x05\x06");
 
 /** Build a MaxMind-shaped tar.gz: `<Edition>_<date>/<Edition>.mmdb`. */
 function buildEditionTarball(
diff --git a/src/lib/jobs/feedback-aggregator.ts b/src/lib/jobs/feedback-aggregator.ts
index 6e4d7ec8b..f1e18452e 100644
--- a/src/lib/jobs/feedback-aggregator.ts
+++ b/src/lib/jobs/feedback-aggregator.ts
@@ -110,7 +110,7 @@ export function buildFeedbackBuckets(
       row.metricSourceType,
       row.providerType,
       row.promptVersion,
-    ].join("
");
+    ].join("\x01");
     const existing = map.get(key);
     if (existing) {
       if (row.helpful) existing.helpful += 1;