diff --git a/src/services/governance/index.js b/src/services/governance/index.js
index dd3290b..4d498da 100644
--- a/src/services/governance/index.js
+++ b/src/services/governance/index.js
@@ -354,6 +354,9 @@ export async function rollbackPrompt(target, hashOrStrategy = 'latest') {
   // Fallback to Git
   try {
     const commit = hashOrStrategy === 'latest' ? 'HEAD' : hashOrStrategy;
+    if (commit.startsWith('-')) {
+      throw new Error(`Invalid commit/strategy: ${commit} (cannot start with '-')`);
+    }
     execFileSync('git', ['checkout', commit, '--', target]);
     return { success: true, source: 'git', restored: commit };
   } catch (e) {