diff --git a/scripts/verify-n14-uia-selector-report.ps1 b/scripts/verify-n14-uia-selector-report.ps1
index 683bf83..4eadf20 100644
--- a/scripts/verify-n14-uia-selector-report.ps1
+++ b/scripts/verify-n14-uia-selector-report.ps1
@@ -18,6 +18,7 @@ $outDir = Join-Path $repo "runs\n14-selector-report"
 New-Item -ItemType Directory -Force -Path $outDir | Out-Null
 $jsonPath = Join-Path $outDir "n12r-selector-report.json"
 $mdPath = Join-Path $outDir "n12r-selector-report.md"
+Remove-Item -LiteralPath $jsonPath, $mdPath -Force -ErrorAction SilentlyContinue
 
 Write-Host "## go run ./cmd/uia-selector-report"
 go run ./cmd/uia-selector-report `
@@ -29,11 +30,19 @@ if ($LASTEXITCODE -ne 0) {
     throw "uia-selector-report failed with exit code $LASTEXITCODE"
 }
 
-if (-not (Test-Path -LiteralPath $jsonPath)) {
-    throw "JSON report was not created: $jsonPath"
+$jsonItem = Get-Item -LiteralPath $jsonPath -ErrorAction Stop
+if ($jsonItem.PSIsContainer) {
+    throw "JSON report path is not a file: $jsonPath"
 }
-if (-not (Test-Path -LiteralPath $mdPath)) {
-    throw "Markdown report was not created: $mdPath"
+if ($jsonItem.Length -le 0) {
+    throw "JSON report is empty: $jsonPath"
+}
+$mdItem = Get-Item -LiteralPath $mdPath -ErrorAction Stop
+if ($mdItem.PSIsContainer) {
+    throw "Markdown report path is not a file: $mdPath"
+}
+if ($mdItem.Length -le 0) {
+    throw "Markdown report is empty: $mdPath"
 }
 
 $report = Get-Content -LiteralPath $jsonPath -Raw -Encoding UTF8 | ConvertFrom-Json
@@ -53,6 +62,37 @@ if ($report.ambiguous_count -ne 0) {
     throw "ambiguous_count=$($report.ambiguous_count), want 0"
 }
 
+Write-Host "## JSON match field allowlist"
+$allowedMatchFields = @(
+    "path",
+    "control_type",
+    "automation_id",
+    "class_name",
+    "framework_id",
+    "has_name",
+    "name_length"
+)
+$allowedMatchFieldLookup = @{}
+foreach ($field in $allowedMatchFields) {
+    $allowedMatchFieldLookup[$field] = $true
+}
+foreach ($selector in @($report.selectors)) {
+    foreach ($match in @($selector.matches)) {
+        if ($null -eq $match) {
+            continue
+        }
+        foreach ($property in @($match.PSObject.Properties)) {
+            $fieldName = $property.Name
+            if ($fieldName -eq "name" -or $fieldName -eq "value") {
+                throw "JSON match leaks visible text field: $fieldName"
+            }
+            if (-not $allowedMatchFieldLookup.ContainsKey($fieldName)) {
+                throw "JSON match contains disallowed field: $fieldName"
+            }
+        }
+    }
+}
+
 Write-Host "## output safety scan"
 $jsonRaw = Get-Content -LiteralPath $jsonPath -Raw -Encoding UTF8
 $mdRaw = Get-Content -LiteralPath $mdPath -Raw -Encoding UTF8