diff --git a/app/api/url_upload.py b/app/api/url_upload.py
index f47e92e0..162d44ea 100644
--- a/app/api/url_upload.py
+++ b/app/api/url_upload.py
@@ -187,10 +187,11 @@ async def process_url(request: Request, url_request: URLUploadRequest):
                 # Generate unique filename
                 unique_id = str(uuid.uuid4())
                 if "." in safe_filename:
-                    file_extension = safe_filename.rsplit(".", 1)[1]
-                    target_filename = f"{unique_id}.{file_extension}"
+                    # Sanitize extension to prevent path traversal (CodeQL alert)
+                    file_extension = os.path.basename(safe_filename.rsplit(".", 1)[1])
+                    target_filename = os.path.basename(f"{unique_id}.{file_extension}")
                 else:
-                    target_filename = unique_id
+                    target_filename = os.path.basename(unique_id)
 
                 target_path = os.path.join(settings.workdir, target_filename)
 
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 72d8d3af..b653a90f 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -37,3 +37,4 @@ pip-licenses==5.5.1  # For license compliance checking
 
 # Release automation
 python-semantic-release>=9.0.0
+types-aiofiles>=23.2.0.20240106
diff --git a/requirements.txt b/requirements.txt
index 3448ae0a..3d8e9b24 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -58,3 +58,4 @@ sentry-sdk[fastapi,celery,sqlalchemy]>=2.20.0,<3.0.0
 
 # GraphQL API
 strawberry-graphql[fastapi]>=0.243.0,<1.0.0
+aiofiles>=23.2.1