Remove ^, +, ~, :, @ from the allowed charset. The ^ character breaks SQLAlchemy DATABASE_URL parsing, + becomes space in URL query strings, : and @ are URL delimiters. The remaining charset (A-Za-z0-9._-) is safe in URLs, database connection strings, YAML, JSON, and shell without any encoding. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>