diff --git a/backend/tests/unit/replay/test_api.py b/backend/tests/unit/replay/test_api.py
index 0cf6db4..412938e 100644
--- a/backend/tests/unit/replay/test_api.py
+++ b/backend/tests/unit/replay/test_api.py
@@ -156,5 +156,21 @@ class TestGetReplay:
 
         with TestClient(app) as client:
             resp = client.get("/api/replay/missing")
-        body = resp.json()
-        assert "detail" in body or "error" in body or resp.status_code == 404
+        assert resp.status_code == 404
+        assert "detail" in resp.json()
+
+    def test_invalid_thread_id_returns_400(self) -> None:
+        app = _build_app()
+        app.state.pool = _make_mock_pool([])
+
+        with TestClient(app) as client:
+            resp = client.get("/api/replay/id%20with%20spaces")
+        assert resp.status_code == 400
+
+    def test_thread_id_special_chars_returns_400(self) -> None:
+        app = _build_app()
+        app.state.pool = _make_mock_pool([])
+
+        with TestClient(app) as client:
+            resp = client.get("/api/replay/id;DROP TABLE")
+        assert resp.status_code == 400