diff --git a/deploy/convert_server.py b/deploy/convert_server.py
index 04fabf4..c92f552 100755
--- a/deploy/convert_server.py
+++ b/deploy/convert_server.py
@@ -7,7 +7,7 @@ class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):
     """Многопоточный HTTP-сервер."""
     daemon_threads = True
 from urllib.parse import urlparse, parse_qs
-import subprocess, tempfile, os, sys, json, time
+import subprocess, tempfile, os, sys, json, time, re
 
 import httpx
 from llm_prompt import build_prompt
@@ -91,6 +91,10 @@ class Handler(BaseHTTPRequestHandler):
         if not cid:
             self.send_error(400, "contract_id required")
             return
+        # Validate UUID to prevent SQL injection
+        if not re.fullmatch(r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}', cid, re.I):
+            self.send_error(400, "invalid contract_id format")
+            return
 
         self.send_response(200)
         self.send_header("Content-Type", "text/event-stream; charset=utf-8")