diff --git a/src/components/RichText.tsx b/src/components/RichText.tsx
index 60c675e05..535ec5bcd 100644
--- a/src/components/RichText.tsx
+++ b/src/components/RichText.tsx
@@ -13,7 +13,7 @@ import {Text, type TextProps} from '#/components/Typography'
 const WORD_WRAP = {wordWrap: 1}
 // lifted from facet detection in `RichText` impl, _without_ `gm` flags
 const URL_REGEX =
-  /(^|\s|\()((https?:\/\/[\S]+)|(steam:\/\/[\S]+)|((?<domain>[a-z][a-z0-9]*(\.[a-z0-9]+)+)[\S]*))/i
+  /(^|\s|\()(?!javascript:)([a-z][a-z0-9+.-]*:\/\/[\S]+|(?:[a-z0-9]+\.)+[a-z0-9]+(:[0-9]+)?[\S]*|[a-z][a-z0-9+.-]*:[^\s()]+)/i
 
 export type RichTextProps = TextStyleProp &
   Pick<TextProps, 'selectable' | 'onLayout' | 'onTextLayout'> & {
diff --git a/src/lib/strings/website.ts b/src/lib/strings/website.ts
index 011271557..689a2e9ff 100644
--- a/src/lib/strings/website.ts
+++ b/src/lib/strings/website.ts
@@ -4,9 +4,9 @@ export function sanitizeWebsiteForDisplay(website: string): string {
 
 export function sanitizeWebsiteForLink(website: string): string {
   const normalized = website.toLowerCase()
-  return normalized.startsWith('https') || normalized.startsWith('steam')
+  return !normalized.startsWith('javascript')
     ? normalized
-    : `https://${website.toLowerCase()}`
+    : `unsafe-${website}`
 }
 
 export function isValidWebsiteFormat(website: string): boolean {