diff --git a/server/src/module/ats/__tests__/ats.service.test.ts b/server/src/module/ats/__tests__/ats.service.test.ts
index 5e9148aee..1dc24c963 100644
--- a/server/src/module/ats/__tests__/ats.service.test.ts
+++ b/server/src/module/ats/__tests__/ats.service.test.ts
@@ -106,11 +106,12 @@ function mockCacheMiss() {
 
 function mockValidPdf(text = VALID_RESUME_TEXT) {
   vi.mocked(PDFParse).mockImplementation(
-    () =>
-      ({
+    function () {
+      return {
         getText: vi.fn().mockResolvedValue({ text }),
         destroy: vi.fn().mockResolvedValue(undefined),
-      }) as any,
+      } as any;
+    }
   );
 }
 
@@ -183,11 +184,12 @@ describe("AtsService", () => {
       mockUserOwnsResume();
       mockCacheMiss();
       vi.mocked(PDFParse).mockImplementation(
-        () =>
-          ({
+        function () {
+          return {
             getText: vi.fn().mockResolvedValue({ text: "too short" }),
             destroy: vi.fn().mockResolvedValue(undefined),
-          }) as any,
+          } as any;
+        }
       );
 
       await expect(
@@ -466,11 +468,12 @@ describe("AtsService", () => {
     it("throws when PDF text extraction yields insufficient content", async () => {
       mockUserOwnsResume();
       vi.mocked(PDFParse).mockImplementation(
-        () =>
-          ({
+        function () {
+          return {
             getText: vi.fn().mockResolvedValue({ text: "tiny" }),
             destroy: vi.fn().mockResolvedValue(undefined),
-          }) as any,
+          } as any;
+        }
       );
 
       await expect(
diff --git a/server/src/module/leetcode/leetcode.validation.ts b/server/src/module/leetcode/leetcode.validation.ts
index 27d3339b0..49baaa5fd 100644
--- a/server/src/module/leetcode/leetcode.validation.ts
+++ b/server/src/module/leetcode/leetcode.validation.ts
@@ -1,7 +1,7 @@
 import { z } from "zod";
 
 export const leetcodeCalendarSchema = z.object({
-  username: z.string().min(1).max(50, "Username too long"),
+  username: z.string().min(1).max(50, "Username too long").regex(/^[a-zA-Z0-9_-]+$/, "Invalid username format"),
 });
 
 export const leetcodeCalendarQuerySchema = z.object({