diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 3cfcc2505..18ad93016 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -111,8 +111,18 @@ public function syncData(bool $toModel = false)
             // Validate databases_to_backup to prevent command injection
             if (filled($this->databasesToBackup)) {
                 $databases = str($this->databasesToBackup)->explode(',');
-                foreach ($databases as $db) {
-                    validateShellSafePath(trim($db), 'database name');
+                foreach ($databases as $index => $db) {
+                    $dbName = trim($db);
+                    try {
+                        validateShellSafePath($dbName, 'database name');
+                    } catch (\Exception $e) {
+                        // Provide specific error message indicating which database failed validation
+                        $position = $index + 1;
+                        throw new \Exception(
+                            "Database #{$position} ('{$dbName}') validation failed: ".
+                            $e->getMessage()
+                        );
+                    }
                 }
             }
 
diff --git a/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php b/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
index 5e8a05d2c..c67591cf5 100644
--- a/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
+++ b/app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php
@@ -25,6 +25,11 @@ public function delete(string $fileName)
         $this->authorize('update', $this->server);
         $proxy_path = $this->server->proxyPath();
         $proxy_type = $this->server->proxyType();
+
+        // Decode filename: pipes are used to encode dots for Livewire property binding
+        // (e.g., 'my|service.yaml' -> 'my.service.yaml')
+        // This must happen BEFORE validation because validateShellSafePath() correctly
+        // rejects pipe characters as dangerous shell metacharacters
         $file = str_replace('|', '.', $fileName);
 
         // Validate filename to prevent command injection