diff --git a/website/fetch_github_stars.py b/website/fetch_github_stars.py
index ccff1b6..68d0304 100644
--- a/website/fetch_github_stars.py
+++ b/website/fetch_github_stars.py
@@ -19,6 +19,10 @@ README_PATH = Path(__file__).parent.parent / "README.md"
 GRAPHQL_URL = "https://api.github.com/graphql"
 BATCH_SIZE = 50
 
+# Allowlist for valid GitHub owner/repo name characters.
+# GitHub usernames and repo names only allow letters, digits, hyphens, underscores, and dots.
+_GITHUB_NAME_RE = re.compile(r"^[a-zA-Z0-9._-]+$")
+
 
 def extract_github_repos(text: str) -> set[str]:
     """Extract unique owner/repo pairs from GitHub URLs in markdown text."""
@@ -46,7 +50,7 @@ def build_graphql_query(repos: list[str]) -> str:
     parts = []
     for i, repo in enumerate(repos):
         owner, name = repo.split("/", 1)
-        if '"' in owner or '"' in name:
+        if not _GITHUB_NAME_RE.match(owner) or not _GITHUB_NAME_RE.match(name):
             continue
         parts.append(
             f'repo_{i}: repository(owner: "{owner}", name: "{name}") '