diff --git a/app/Controllers/SalesController.php b/app/Controllers/SalesController.php
index 32284322..d42bea40 100644
--- a/app/Controllers/SalesController.php
+++ b/app/Controllers/SalesController.php
@@ -537,13 +537,21 @@ class SalesController extends BaseController
     $value      = trim($this->request->getGet('value') ?? '');
     $exclude_id = $this->request->getGet('exclude_id');
 
-    // ── Whitelist ─────────────────────────────────────────────
+    // ── Whitelist (table → model, pk, allowed fields) ─────────
     $allowed = [
-        'clients' => ['model' => $this->clientModel, 'pk' => 'id'],
+        'clients' => [
+            'model'  => $this->clientModel,
+            'pk'     => 'id',
+            'fields' => ['short_name', 'client_name'],
+        ],
+        'sales_actual_leads' => [
+            'model'  => $this->leadModel,
+            'pk'     => 'lead_id',
+            'fields' => ['company_name'],
+        ],
     ];
 
-    // ── Allowed fields per table ──────────────────────────────
-    if (!array_key_exists($table, $allowed) || !in_array($field, ['short_name', 'client_name'])) {
+    if (! isset($allowed[$table]) || ! in_array($field, $allowed[$table]['fields'], true)) {
         return $this->response
             ->setStatusCode(400)
             ->setContentType('application/json')
diff --git a/app/Models/SalesActualLeadModel.php b/app/Models/SalesActualLeadModel.php
index 55ee787a..d52fcd23 100644
--- a/app/Models/SalesActualLeadModel.php
+++ b/app/Models/SalesActualLeadModel.php
@@ -50,7 +50,7 @@ class SalesActualLeadModel extends Model
         'company_name' => [
             'required' => 'Company Name is Missing',
             // 'alpha_space' => 'Company Name must contain only letters and spaces',
-            'regex_match' => 'Company Name can only contain letters, numbers, spaces, hyphens and underscores.',
+            'regex_match' => 'Company Name can only contain letters, numbers.',
             'min_length' => 'Company Name must be at least 2 characters long',
             'max_length' => 'Company Name must be at most 255 characters long'
         ],