@@ -42,6 +42,20 @@ function fail(error: unknown): AltimateCoreResult {
   return { success: false, data: {}, error: String(error) }
 }
 
+/** Redact raw-input echoes from a scan result's threats (see EngineCoerce.redactThreatText). */
+function redactScan(scan: Record<string, unknown>): Record<string, unknown> {
+  const threats = (scan.threats as any[] | undefined)?.map((t: any) => ({
+    ...t,
+    message: typeof t.message === "string" ? EngineCoerce.redactThreatText(t.message) : t.message,
+    detail: typeof t.detail === "string" ? EngineCoerce.redactThreatText(t.detail) : t.detail,
+    // For multi_statement the matched pattern IS the raw input line — an
+    // arbitrary-file content echo. Injection rules keep their SQL-shaped
+    // patterns (useful, and inherently query-derived).
+    matched_pattern: t.rule === "multi_statement" ? "<redacted>" : t.matched_pattern,
+  }))
+  return threats ? { ...scan, threats } : scan
+}
+
 // ---------------------------------------------------------------------------
 // IFF / QUALIFY transpile transforms (ported from Python guard.py)
 // ---------------------------------------------------------------------------
@@ -114,7 +128,7 @@ export function registerAll(): void {
   register("altimate_core.safety", async (params) => {
     try {
       const raw = core.scanSql(params.sql)
-      const data = toData(raw)
+      const data = redactScan(toData(raw))
       return ok(true, data)
     } catch (e) {
       return fail(e)
@@ -193,7 +207,7 @@ export function registerAll(): void {
       // occurrence, so a PR that ADDS a second identical injection still
       // reports it. Recompute safe/risk_score from the surviving threats so a
       // fully pre-existing threat set doesn't leave a stale unsafe verdict.
-      let safety: Record<string, unknown> = toData(core.scanSql(params.sql))
+      let safety: Record<string, unknown> = redactScan(toData(core.scanSql(params.sql)))
       if (params.base_sql) {
         try {
           const baseCounts = new Map<string, number>()
 
@@ -59,4 +59,23 @@ export function piiColumnsFromReport(piiData: unknown): Array<Record<string, any
   return columns.filter((c) => c && c.classification !== "None")
 }
 
+/**
+ * Redact raw input echoed inside engine threat messages.
+ *
+ * The engine's `multi_statement` rule quotes the offending "statement type"
+ * verbatim — for non-SQL input (e.g. `altimate check /etc/passwd`) that
+ * reflects arbitrary file content back into CLI/tool output. Keep the token
+ * only when it looks like a SQL keyword phrase; otherwise redact.
+ */
+const SQL_KEYWORD_LIKE = /^[A-Za-z_][A-Za-z0-9_$ ]{0,31}$/
+export function redactThreatText(text: string): string {
+  return text
+    .replace(/(Disallowed statement type: )(.+)$/i, (_m, prefix: string, tok: string) =>
+      SQL_KEYWORD_LIKE.test(tok.trim()) ? `${prefix}${tok}` : `${prefix}<non-SQL content redacted>`,
+    )
+    .replace(/(Statement type ')([^']*)(')/i, (_m, a: string, tok: string, c: string) =>
+      SQL_KEYWORD_LIKE.test(tok) ? `${a}${tok}${c}` : `${a}<non-SQL content redacted>${c}`,
+    )
+}
+
 export * as EngineCoerce from "./engine-coerce"
@@ -0,0 +1,71 @@
+import { describe, expect, test, beforeAll } from "bun:test"
+import { EngineCoerce } from "../../src/altimate/native/engine-coerce"
+
+let coreAvailable = false
+try {
+  require.resolve("@altimateai/altimate-core")
+  coreAvailable = true
+} catch {}
+const describeIf = coreAvailable ? describe : describe.skip
+
+describe("redactThreatText", () => {
+  test("keeps SQL-keyword-like statement types", () => {
+    expect(EngineCoerce.redactThreatText("Disallowed statement type: DROP")).toBe("Disallowed statement type: DROP")
+    expect(EngineCoerce.redactThreatText("Statement type 'ALTER TABLE' is not in the allowed list")).toBe(
+      "Statement type 'ALTER TABLE' is not in the allowed list",
+    )
+  })
+
+  test("redacts non-SQL content (e.g. /etc/passwd lines)", () => {
+    const msg = "Disallowed statement type: ROOT:X:0:0:ROOT:/ROOT:/BIN/BASH"
+    expect(EngineCoerce.redactThreatText(msg)).toBe("Disallowed statement type: <non-SQL content redacted>")
+    const detail = "Statement type 'ROOT:X:0:0:ROOT:/ROOT:/BIN/BASH' is not in the allowed list: [\"SELECT\"]"
+    expect(EngineCoerce.redactThreatText(detail)).toContain("'<non-SQL content redacted>'")
+    expect(EngineCoerce.redactThreatText(detail)).not.toContain("ROOT:X:0")
+  })
+
+  test("leaves unrelated messages untouched", () => {
+    expect(EngineCoerce.redactThreatText("Tautology attack detected (numeric constant comparison)")).toBe(
+      "Tautology attack detected (numeric constant comparison)",
+    )
+  })
+})
+
+// Sanity security test [6/15] regression: `altimate check /etc/passwd` must not
+// reflect file contents in threat messages (found by the main-only Verdaccio
+// sanity job after PR #1090 surfaced real threat messages).
+describeIf("safety handlers redact raw-input echoes (real engine)", () => {
+  beforeAll(async () => {
+    process.env.ALTIMATE_TELEMETRY_DISABLED = "true"
+    const { registerAll } = await import("../../src/altimate/native/altimate-core")
+    registerAll()
+  })
+
+  const PASSWD = "root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n"
+
+  test("altimate_core.safety does not echo non-SQL file content", async () => {
+    const { Dispatcher } = await import("../../src/altimate/native")
+    const r = await Dispatcher.call("altimate_core.safety", { sql: PASSWD })
+    const text = JSON.stringify((r.data as any).threats ?? [])
+    expect(text.toLowerCase()).not.toContain("root:x:0")
+    expect(text).toContain("redacted")
+  })
+
+  test("composite check does not echo non-SQL file content in threats", async () => {
+    const { Dispatcher } = await import("../../src/altimate/native")
+    const r = await Dispatcher.call("altimate_core.check", { sql: PASSWD })
+    const threats = JSON.stringify(((r.data as any).safety?.threats ?? []))
+    expect(threats.toLowerCase()).not.toContain("root:x:0")
+  })
+
+  test("real SQL statement types are preserved in messages", async () => {
+    const { Dispatcher } = await import("../../src/altimate/native")
+    const r = await Dispatcher.call("altimate_core.safety", { sql: "SELECT 1; DROP TABLE users;" })
+    const threats = ((r.data as any).threats ?? []) as any[]
+    const messages = threats.map((t) => `${t.message} ${t.detail}`).join(" ")
+    // SQL-keyword statement types stay useful in messages/details
+    // (matched_pattern is always redacted for multi_statement by design).
+    expect(messages).toContain("DROP")
+    expect(messages).not.toContain("redacted")
+  })
+})