diff --git a/src/server.ts b/src/server.ts
index 951ba67..9a8f582 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -71,10 +71,10 @@ export interface ServerDeps {
 
 const CHAT_EVENT_TYPES = new Set(['MESSAGE', 'ADDED_TO_SPACE', 'REMOVED_FROM_SPACE', 'CARD_CLICKED', 'UNKNOWN']);
 
-/** Collapse control chars (incl. newlines) and cap length before logging untrusted text — prevents log forging. */
+/** Drop line breaks, blank other control chars and cap length before logging untrusted text — prevents log forging. */
 function logSafe(value: unknown): string {
-  // CodeQL only recognises an explicit line-break replace as cleaning.
-  return String(value).replace(/[\r\n]/g, ' ').replace(/\p{Cc}/gu, ' ').slice(0, 200);
+  // CodeQL only counts a replace that removes line breaks outright as cleaning.
+  return String(value).replace(/[\r\n]/g, '').replace(/\p{Cc}/gu, ' ').slice(0, 200);
 }
 
 export function createServer(deps: ServerDeps): Express {