diff --git a/backend_api_python/app/routes/backtest.py b/backend_api_python/app/routes/backtest.py
index ebc5d7982..7d21d7ae2 100644
--- a/backend_api_python/app/routes/backtest.py
+++ b/backend_api_python/app/routes/backtest.py
@@ -13,6 +13,7 @@
 from app.utils.logger import get_logger
 from app.utils.db import get_db_connection
 from app.utils.auth import login_required
+from app.utils.safe_exec import validate_code_safety
 import requests
 
 logger = get_logger(__name__)
@@ -174,6 +175,13 @@ def run_backtest():
         # Extract params - use current user's ID
         user_id = g.user_id
         indicator_code = data.get('indicatorCode', '')
+        is_safe_code, unsafe_reason = validate_code_safety(indicator_code or '')
+        if not is_safe_code:
+            return jsonify({
+                'code': 0,
+                'msg': f'Unsafe indicator code: {unsafe_reason}',
+                'data': None
+            }), 400
         indicator_id = data.get('indicatorId')
         symbol = data.get('symbol', '')
         market = data.get('market', '')
diff --git a/backend_api_python/app/utils/safe_exec.py b/backend_api_python/app/utils/safe_exec.py
index f4dffb9d4..8ba541250 100644
--- a/backend_api_python/app/utils/safe_exec.py
+++ b/backend_api_python/app/utils/safe_exec.py
@@ -411,11 +411,12 @@ def validate_code_safety(code: str) -> Tuple[bool, Optional[str]]:
     try:
         tree = ast.parse(code)
     except SyntaxError as e:
-        return False, f"代码语法错误: {e}"
+        logger.warning(f"Code syntax validation failed: {e}")
+        return False, "代码语法错误"
     except Exception as e:
         # AST parse failure → reject (fail-closed, not fail-open)
-        logger.error(f"AST parse failed, rejecting code: {e}")
-        return False, f"代码解析失败: {e}"
+        logger.exception("AST parse failed, rejecting code")
+        return False, "代码解析失败"
 
     dangerous_modules = {
         'os', 'sys', 'subprocess', 'shutil', 'signal', 'resource',