diff --git a/apps/blog/features/layouts/user-profile/profile-layout.tsx b/apps/blog/features/layouts/user-profile/profile-layout.tsx
index c06377285713db877f4e507135c97e971037e6a3..40f578fb984d07598cd12d44df19d7e5f6c593d0 100644
--- a/apps/blog/features/layouts/user-profile/profile-layout.tsx
+++ b/apps/blog/features/layouts/user-profile/profile-layout.tsx
@@ -8,7 +8,7 @@ import { useQuery } from '@tanstack/react-query';
 import env from '@beam-australia/react-env';
 
 import { useTranslation } from '@/blog/i18n/client';
-import { Avatar, AvatarFallback, AvatarImage, proxifyImageSrc, getUserAvatarUrl, escapeCssUrl, isSafeImageUrl } from '@ui/components';
+import { Avatar, AvatarFallback, AvatarImage, proxifyImageSrc, getUserAvatarUrl, escapeCssUrl, isSafeImageUrl, isSafeExternalUrl } from '@ui/components';
 import { Separator } from '@hive/ui/components/separator';
 import TimeAgo from '@ui/components/time-ago';
 import { Icons } from '@hive/ui/components/icons';
@@ -172,7 +172,7 @@ const ProfileLayout = ({ children }: { children: ReactNode }) => {
                 />
               </Link>
             ) : null}
-            {twitterData ? (
+            {twitterData && isSafeExternalUrl(twitterData.twitter_profile) ? (
               <Link
                 href={twitterData.twitter_profile}
                 title={t('user_profile.twitter_badge_title')}
diff --git a/packages/ui/lib/css-utils.ts b/packages/ui/lib/css-utils.ts
index 3724baee647ce43cc5fd06d93d30ff9ca152a78b..6274f5b28a0a788444abd4d2bc4c0f748f54506a 100644
--- a/packages/ui/lib/css-utils.ts
+++ b/packages/ui/lib/css-utils.ts
@@ -31,3 +31,17 @@ export function isSafeImageUrl(url: string): boolean {
     return false;
   }
 }
+
+/**
+ * Validates that a URL is safe for use as an external link.
+ * Only allows http/https protocols to prevent javascript: and other dangerous schemes.
+ */
+export function isSafeExternalUrl(url: string | null | undefined): boolean {
+  if (!url) return false;
+  try {
+    const parsed = new URL(url);
+    return ['http:', 'https:'].includes(parsed.protocol);
+  } catch {
+    return false;
+  }
+}