diff --git a/js/utils/profileMedia.js b/js/utils/profileMedia.js
index 4de331ed..a496f326 100644
--- a/js/utils/profileMedia.js
+++ b/js/utils/profileMedia.js
@@ -33,7 +33,7 @@ export function sanitizeProfileMediaUrl(value) {
     return "";
   }
 
-  trimmed = trimmed.replace(/^['"]+|['"]+$/g, "");
+  trimmed = trimmed.replace(/^['"]+|['"]+$/g, "").trim();
   if (!trimmed) {
     return "";
   }
@@ -50,7 +50,7 @@ export function sanitizeProfileMediaUrl(value) {
     return "";
   }
 
-  if (/^ipfs:\/\//i.test(trimmed)) {
+  if (/^ipfs(\/|:\/\/)/i.test(trimmed)) {
     return normalizeIpfsGatewayUrl(trimmed);
   }
 
diff --git a/tests/utils/profileMedia.test.mjs b/tests/utils/profileMedia.test.mjs
new file mode 100644
index 00000000..c85c3343
--- /dev/null
+++ b/tests/utils/profileMedia.test.mjs
@@ -0,0 +1,74 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { sanitizeProfileMediaUrl } from "../../js/utils/profileMedia.js";
+
+test("sanitizeProfileMediaUrl handles non-string inputs", () => {
+  assert.equal(sanitizeProfileMediaUrl(null), "");
+  assert.equal(sanitizeProfileMediaUrl(undefined), "");
+  assert.equal(sanitizeProfileMediaUrl(123), "");
+  assert.equal(sanitizeProfileMediaUrl({}), "");
+});
+
+test("sanitizeProfileMediaUrl handles empty or whitespace-only strings", () => {
+  assert.equal(sanitizeProfileMediaUrl(""), "");
+  assert.equal(sanitizeProfileMediaUrl("   "), "");
+  assert.equal(sanitizeProfileMediaUrl("\t\n"), "");
+});
+
+test("sanitizeProfileMediaUrl trims whitespace and removes quotes", () => {
+  assert.equal(sanitizeProfileMediaUrl("  http://example.com  "), "https://example.com");
+  assert.equal(sanitizeProfileMediaUrl("'http://example.com'"), "https://example.com");
+  assert.equal(sanitizeProfileMediaUrl('"http://example.com"'), "https://example.com");
+  assert.equal(sanitizeProfileMediaUrl(" ' http://example.com ' "), "https://example.com");
+});
+
+test("sanitizeProfileMediaUrl allows data:image/ URLs", () => {
+  const dataUrl = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=";
+  assert.equal(sanitizeProfileMediaUrl(dataUrl), dataUrl);
+});
+
+test("sanitizeProfileMediaUrl allows blob: URLs", () => {
+  const blobUrl = "blob:http://example.com/550e8400-e29b-41d4-a716-446655440000";
+  assert.equal(sanitizeProfileMediaUrl(blobUrl), blobUrl);
+});
+
+test("sanitizeProfileMediaUrl rejects specific placeholder images", () => {
+  assert.equal(sanitizeProfileMediaUrl("images/robot.png"), "");
+});
+
+test("sanitizeProfileMediaUrl normalizes IPFS URLs", () => {
+  assert.equal(sanitizeProfileMediaUrl("ipfs://CID"), "https://ipfs.io/ipfs/CID");
+  assert.equal(sanitizeProfileMediaUrl("ipfs/CID"), "https://ipfs.io/ipfs/CID");
+});
+
+test("sanitizeProfileMediaUrl handles protocol-relative URLs", () => {
+  assert.equal(sanitizeProfileMediaUrl("//example.com/image.jpg"), "https://example.com/image.jpg");
+});
+
+test("sanitizeProfileMediaUrl allows relative paths", () => {
+  assert.equal(sanitizeProfileMediaUrl("/assets/image.jpg"), "/assets/image.jpg");
+  assert.equal(sanitizeProfileMediaUrl("./image.jpg"), "./image.jpg");
+  assert.equal(sanitizeProfileMediaUrl("../image.jpg"), "../image.jpg");
+  assert.equal(sanitizeProfileMediaUrl("assets/image.jpg"), "assets/image.jpg");
+});
+
+test("sanitizeProfileMediaUrl adds protocol to domains and localhost", () => {
+  assert.equal(sanitizeProfileMediaUrl("localhost:8080/image.jpg"), "http://localhost:8080/image.jpg");
+  assert.equal(sanitizeProfileMediaUrl("example.com/image.jpg"), "https://example.com/image.jpg");
+  assert.equal(sanitizeProfileMediaUrl("sub.example.com/image.jpg"), "https://sub.example.com/image.jpg");
+  // IP address pattern in code: (?:\d{1,3}\.){3}\d{1,3}
+  assert.equal(sanitizeProfileMediaUrl("127.0.0.1:8080/image.jpg"), "http://127.0.0.1:8080/image.jpg");
+});
+
+test("sanitizeProfileMediaUrl coerces http to https except for localhost", () => {
+  assert.equal(sanitizeProfileMediaUrl("http://example.com/image.jpg"), "https://example.com/image.jpg");
+  assert.equal(sanitizeProfileMediaUrl("http://localhost:8080/image.jpg"), "http://localhost:8080/image.jpg");
+  assert.equal(sanitizeProfileMediaUrl("http://127.0.0.1:8080/image.jpg"), "http://127.0.0.1:8080/image.jpg");
+});
+
+test("sanitizeProfileMediaUrl rejects unsupported patterns", () => {
+   // The code logs a warning and returns "" for things that don't match localhost or domain patterns
+   // if they don't start with http/https
+   assert.equal(sanitizeProfileMediaUrl("javascript:alert(1)"), "");
+   assert.equal(sanitizeProfileMediaUrl("ftp://example.com/file"), ""); // Starts with ftp, not http/https/ipfs
+});