diff --git a/scanpipe/pipes/__init__.py b/scanpipe/pipes/__init__.py
index 7fd885c36f..ffaf2ced11 100644
--- a/scanpipe/pipes/__init__.py
+++ b/scanpipe/pipes/__init__.py
@@ -43,6 +43,22 @@
 
 logger = logging.getLogger("scanpipe.pipes")
 
+def normalize_extension(name, extension, max_length=100):
+    """
+    Return a safe file extension or None.
+    """
+    # If there is no name, we cannot infer an extension
+    if not name:
+        return None
+
+    # Recompute extension from the name (do not trust incoming value)
+    suffix = Path(name).suffix
+    if not suffix:
+        return None
+
+    return suffix[:max_length]
+
+
 
 def make_codebase_resource(project, location, save=True, **extra_fields):
     """
@@ -93,7 +109,14 @@ def make_codebase_resource(project, location, save=True, **extra_fields):
 
     if extra_fields:
         resource_data.update(**extra_fields)
+    
+    # Normalize extension to avoid oversized non-extension values
+    resource_data["extension"] = normalize_extension(
+        resource_data.get("name"),
+        resource_data.get("extension"),
+    )
 
+ 
     codebase_resource = CodebaseResource(
         project=project,
         path=relative_path,