diff --git a/backend/app/services/library_layout.py b/backend/app/services/library_layout.py
index 4e00dc3..f1c2eeb 100644
--- a/backend/app/services/library_layout.py
+++ b/backend/app/services/library_layout.py
@@ -54,6 +54,12 @@ def _misplaced_conditions(images_root: Path, artist_id: int, slug: str) -> list:
     `ara` would match every path under `arbuzbudesh/`, and the sweep would
     report one artist's whole library as correctly placed while quietly
     skipping another's.
+
+    `startswith` compiles to LIKE, where `_` and `%` are wildcards, and this
+    does not escape them. That is safe ONLY because `utils.slug.slugify`
+    reduces a slug to `[a-z0-9-]` — neither character can reach the pattern.
+    Widen that charset and this needs `autoescape=True`, or `poch4n_art`
+    starts matching `poch4nXart` too.
     """
     prefix = f"{canonical_dir(images_root, slug)}/"
     return [