diff --git a/packages/producer/src/services/renderOrchestrator.test.ts b/packages/producer/src/services/renderOrchestrator.test.ts
index 571994f53..0fa1988e4 100644
--- a/packages/producer/src/services/renderOrchestrator.test.ts
+++ b/packages/producer/src/services/renderOrchestrator.test.ts
@@ -2020,6 +2020,20 @@ describe("shouldPreferSingleWorkerDrawElement (DE priority inversion)", () => {
       expect(countElementTags('<div></div><style>a::after{content:"</div>"}</style>')).toBe(1);
     });
 
+    // CodeQL "incomplete multi-character sanitization": a single-pass replace
+    // can reform the very pattern it removed. Impact is nil here (the stripped
+    // string is counted, never rendered) but a reformed tag would perturb the
+    // count, so the strip runs to a fixed point.
+    it("strips script tags that reform after one pass", () => {
+      // Inner <script> removed by pass 1 leaves "<script>alert(1)</script>",
+      // which pass 2 removes. A single pass would leave a stray tag behind.
+      expect(countElementTags("<div></div><scr<script></script>ipt>alert(1)</script>")).toBe(1);
+    });
+
+    it("terminates on input with no closing tag rather than looping", () => {
+      expect(countElementTags("<div></div><script>unterminated")).toBe(1);
+    });
+
     it("strips multiple and attributed script blocks, not just the first", () => {
       expect(
         countElementTags(
diff --git a/packages/producer/src/services/renderOrchestrator.ts b/packages/producer/src/services/renderOrchestrator.ts
index 8622b7d51..badf49828 100644
--- a/packages/producer/src/services/renderOrchestrator.ts
+++ b/packages/producer/src/services/renderOrchestrator.ts
@@ -1297,7 +1297,18 @@ export function countElementTags(html: string): number {
   // no probe session, for which this scan is the only element signal (review
   // finding). Removing the bodies also drops their own closing tags, which
   // costs 1-2 counts against a threshold in the thousands.
-  const markup = html.replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, "");
+  // Looped to a fixed point rather than a single pass: one pass can REFORM
+  // the pattern it just removed (`<scr<script>ipt>` leaves `<script>`), which
+  // CodeQL flags as incomplete multi-character sanitization. The impact here
+  // is nil — the stripped string is counted and discarded, never rendered —
+  // but the incompleteness is real, and a stray reformed tag would perturb
+  // the count this gate reads. Converges: every iteration strictly shortens
+  // the string or changes nothing and exits.
+  let markup = html;
+  for (let previous = ""; markup !== previous; ) {
+    previous = markup;
+    markup = markup.replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, "");
+  }
   const matches = markup.match(
     /<\/[a-zA-Z]|<(?:img|br|hr|input|source|track|area|base|col|embed|link|meta|param|wbr)\b|<[a-zA-Z][-a-zA-Z0-9]*\b[^>]*\/>/gi,
   );