diff --git a/packages/ui/src/components/Header/Header.module.css b/packages/ui/src/components/Header/Header.module.css
index ccceaf6f58..e6ea55e363 100644
--- a/packages/ui/src/components/Header/Header.module.css
+++ b/packages/ui/src/components/Header/Header.module.css
@@ -68,7 +68,7 @@
     display: flex;
     flex-direction: row;
     align-items: center;
-    gap: 20px;
+    gap: var(--bui-space-5);
     flex-wrap: wrap;
   }
 
diff --git a/packages/ui/src/components/Header/Header.tsx b/packages/ui/src/components/Header/Header.tsx
index f70423fdd6..90e107c51c 100644
--- a/packages/ui/src/components/Header/Header.tsx
+++ b/packages/ui/src/components/Header/Header.tsx
@@ -49,7 +49,9 @@ function renderInlineMarkdown(text: string): React.ReactNode[] {
     if (match.index > last) {
       parts.push(text.slice(last, match.index));
     }
-    const href = match[2];
+    // Trim leading whitespace/control chars before scheme check to prevent
+    // bypass via inputs like " javascript:alert(1)".
+    const href = match[2].trimStart();
     const label = match[1];
     if (UNSAFE_HREF_RE.test(href)) {
       parts.push(label);