diff --git a/api/index.js b/api/index.js
index 34ecff82..ef1aa738 100644
--- a/api/index.js
+++ b/api/index.js
@@ -67,7 +67,7 @@ export default async (req, res) => {
     );
   }
 
-  const safePattern = /^[\w\/.-]+$/;
+  const safePattern = /^[-\w\/.,]+$/;
   if (
     (username && !safePattern.test(username)) ||
     (repos && !safePattern.test(repos)) ||
diff --git a/api/pin.js b/api/pin.js
index 69c86f0b..3e6ada93 100644
--- a/api/pin.js
+++ b/api/pin.js
@@ -59,7 +59,7 @@ export default async (req, res) => {
     );
   }
 
-  const safePattern = /^[\w\/.-]+$/;
+  const safePattern = /^[-\w\/.,]+$/;
   if (
     (username && !safePattern.test(username)) ||
     (repo && !safePattern.test(repo))