diff --git a/.github/workflows/fork-ci.yml b/.github/workflows/fork-ci.yml
new file mode 100644
index 0000000..ccc5bc8
--- /dev/null
+++ b/.github/workflows/fork-ci.yml
@@ -0,0 +1,138 @@
+# Fork-level CI for HaraldeRoessler/moltrust-api.
+#
+# Intentionally lightweight — exercises the things that catch the
+# common breakage modes without needing a running API or database:
+#
+#   syntax       — `python -m compileall` on every source dir.
+#   import-smoke — actually try `from app.main import app` with all
+#                  required env vars set to placeholder values. This
+#                  is the only job that catches startup-time
+#                  RuntimeError raises (e.g. NONCE_SECRET unset).
+#   pytest-coll  — `pytest --collect-only` over the in-repo tests.
+#                  Catches ImportError / SyntaxError in test modules
+#                  without needing the API + Postgres stack online.
+#   ruff         — informational lint, never blocks merge.
+#   bandit       — informational SAST, never blocks merge.
+#
+# Triggers on every push and PR. Separate file name (`fork-ci.yml`)
+# from PR #14's proposed `ci.yml` so the two can co-exist if PR #14
+# lands upstream later.
+
+name: Fork CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: fork-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  syntax:
+    name: syntax (compileall)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: byte-compile every source dir
+        run: |
+          python -m compileall -q app
+          for d in scripts agents agent operator moltbook monitor; do
+            [ -d "$d" ] && python -m compileall -q "$d" || true
+          done
+          # Also top-level scripts that aren't in a directory.
+          python -m compileall -q seed_ecosystem.py test_protocol_compliance.py test_sandbox.py 2>/dev/null || true
+
+  import-smoke:
+    name: import smoke test (with required env vars)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+          cache-dependency-path: requirements.txt
+      - name: install requirements
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+      - name: import app.main with placeholder env
+        # The whole point of this job: catch any startup-time
+        # RuntimeError. The security hardening pass added fail-fast
+        # checks for NONCE_SECRET, MOLTRUST_API_KEYS, MOLTSTACK_DB_PW
+        # — if one of those is missing, the import explodes here
+        # rather than in production.
+        env:
+          MOLTRUST_API_KEYS: 'mt_ci_placeholder_key_does_not_authenticate'
+          NONCE_SECRET: 'ci-placeholder-nonce-secret'
+          MOLTSTACK_DB_PW: 'ci-placeholder-db-pw'
+          MOLTRUST_ADMIN_USERS: 'ci-admin:admin:$2b$12$ciplaceholderhashthatwillnevermatchanypassword.ciplaceholderhash'
+          MOLTRUST_ENV: 'ci'
+        run: |
+          python -c "from app.main import app; print('app.main imported OK, FastAPI app:', type(app).__name__)"
+
+  pytest-collect:
+    name: pytest --collect-only
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+          cache-dependency-path: requirements.txt
+      - name: install requirements + pytest
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install pytest pytest-asyncio
+      - name: collect tests
+        # Collection imports test modules without running them. Catches
+        # ImportError / SyntaxError / fixture-parse errors without
+        # needing the API stack online.
+        env:
+          MOLTRUST_API_KEYS: 'mt_ci_placeholder_key'
+          NONCE_SECRET: 'ci-placeholder'
+          MOLTSTACK_DB_PW: 'ci-placeholder'
+        run: |
+          pytest --collect-only -q tests/ test_*.py 2>&1 | tail -40
+
+  ruff:
+    name: ruff (informational)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install ruff
+      - name: ruff check
+        # Informational only — don't block merge on lint noise. Surfaces
+        # in the workflow log so we can clean up over time.
+        run: ruff check app/ agents/ scripts/ monitor/ --output-format=concise || true
+
+  bandit:
+    name: bandit SAST (informational)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install bandit
+      - name: bandit scan
+        # -ll = report MEDIUM+ severity only (filters out the noise).
+        # Findings here are a useful belt-and-suspenders signal — most
+        # are already either fixed in this PR or dismissed in CodeQL.
+        run: bandit -r app/ agents/ scripts/ monitor/ -ll || true
diff --git a/Dockerfile b/Dockerfile
index 76a52ab..434fb5e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,6 +11,12 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
 
+# Drop root — uvicorn runs as an unprivileged user, limiting blast
+# radius if the application is compromised.
+RUN useradd --create-home --shell /bin/bash --uid 1001 appuser \
+    && chown -R appuser:appuser /app
+USER appuser
+
 EXPOSE 8000
 
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/agents/herald_v3.py b/agents/herald_v3.py
index 553fdc2..c5b4c78 100644
--- a/agents/herald_v3.py
+++ b/agents/herald_v3.py
@@ -349,7 +349,7 @@ def generate_awareness_tweet(state: dict) -> str | None:
         available = TOPIC_SEEDS
         recent_seeds = []
 
-    seed = random.choice(available)
+    seed = random.choice(available)  # noqa: S311 — non-security topic seed selection
     recent_seeds.append(seed)
     state["recent_seeds"] = recent_seeds[-10:]
 
diff --git a/agents/moltbook_poster.py b/agents/moltbook_poster.py
index 35009e4..03c826e 100644
--- a/agents/moltbook_poster.py
+++ b/agents/moltbook_poster.py
@@ -108,7 +108,7 @@ def generate_post(topic, previous_titles):
         log.error("No ANTHROPIC_API_KEY available")
         return None
 
-    submolt = random.choice(SUBMOLTS)
+    submolt = random.choice(SUBMOLTS)  # noqa: S311 — non-security content selection
     prev_list = "\n".join(f"- {t}" for t in previous_titles[-15:]) if previous_titles else "None yet"
 
     user_msg = (
@@ -260,7 +260,10 @@ def save_state(state):
 
 
 def post_hash(title):
-    return hashlib.md5(title.encode()).hexdigest()[:12]
+    # SHA-256 truncated to 12 hex chars. MD5 is broken (collision attacks);
+    # while this hash is non-security-critical (dedup only), avoiding MD5
+    # silences static-analysis noise and pre-empts future foot-guns.
+    return hashlib.sha256(title.encode()).hexdigest()[:12]
 
 
 # ── Lobster Math Solver ───────────────────────────────────────────────────────
@@ -525,7 +528,7 @@ def pick_post(state):
     previous_titles = state.get("posted_titles", [])
 
     # Pick a random topic seed
-    topic = random.choice(TOPIC_SEEDS)
+    topic = random.choice(TOPIC_SEEDS)  # noqa: S311 — non-security content selection
     log.info(f"Topic seed: {topic}")
 
     # Try Claude-generated post
@@ -543,7 +546,7 @@ def pick_post(state):
         state["posted_hashes"] = []
         available = FALLBACK_POOL
 
-    return random.choice(available)
+    return random.choice(available)  # noqa: S311 — non-security content selection
 
 
 def main():
diff --git a/agents/news_scout.py b/agents/news_scout.py
index fc6e510..b7889f8 100644
--- a/agents/news_scout.py
+++ b/agents/news_scout.py
@@ -6,7 +6,13 @@
 import sys
 import time
 import hashlib
-import xml.etree.ElementTree as ET
+# defusedxml protects against XXE / Billion Laughs / DTD-bomb attacks on
+# untrusted RSS feeds. Falls back to stdlib only if defusedxml isn't
+# installed yet — the requirements.txt bump in this commit declares it.
+try:
+    import defusedxml.ElementTree as ET  # type: ignore[import]
+except ImportError:
+    import xml.etree.ElementTree as ET  # type: ignore[no-redef]
 from datetime import datetime, timezone, timedelta
 from pathlib import Path
 from urllib.parse import quote_plus
@@ -106,8 +112,8 @@ def save_heartbeat(status: str, detail: str = ""):
 
 
 def url_key(url: str) -> str:
-    """Normalize URL for dedup."""
-    return hashlib.md5(url.strip().lower().encode()).hexdigest()
+    """Normalize URL for dedup. SHA-256 (MD5 is broken)."""
+    return hashlib.sha256(url.strip().lower().encode()).hexdigest()
 
 
 def parse_date(date_str: str) -> datetime | None:
diff --git a/agents/poll_payments.py b/agents/poll_payments.py
index ca3c61a..f4f4103 100644
--- a/agents/poll_payments.py
+++ b/agents/poll_payments.py
@@ -43,8 +43,10 @@ def fetch_recent_transfers() -> list:
     url = f"{BASESCAN_URL}?{params}"
 
     try:
+        if not url.startswith(("http://", "https://")):
+            raise ValueError(f"refusing non-HTTP(S) URL")
         req = Request(url, headers={"User-Agent": "MolTrust/1.0"})
-        with urlopen(req, timeout=15) as resp:
+        with urlopen(req, timeout=15) as resp:  # noqa: S310 — scheme validated above
             data = json.loads(resp.read())
     except Exception as e:
         log.error("Basescan API error: %s", e)
diff --git a/agents/retention_cleanup.py b/agents/retention_cleanup.py
index 51ed024..95c439e 100644
--- a/agents/retention_cleanup.py
+++ b/agents/retention_cleanup.py
@@ -16,9 +16,11 @@ def send_telegram(msg):
         return
     try:
         data = json.dumps({"chat_id": TG_CHAT, "text": msg}).encode()
-        req = Request(f"https://api.telegram.org/bot{TG_TOKEN}/sendMessage",
-                      data=data, headers={"Content-Type": "application/json"})
-        urlopen(req, timeout=10)
+        url = f"https://api.telegram.org/bot{TG_TOKEN}/sendMessage"
+        if not url.startswith(("http://", "https://")):
+            return
+        req = Request(url, data=data, headers={"Content-Type": "application/json"})
+        urlopen(req, timeout=10)  # noqa: S310 — scheme validated above
     except Exception:
         pass
 
diff --git a/agents/x_thread_followup.py b/agents/x_thread_followup.py
index 93c92cd..57fe063 100755
--- a/agents/x_thread_followup.py
+++ b/agents/x_thread_followup.py
@@ -21,7 +21,7 @@
 
 #AIAgents #W3C #DID #Base #OpenSource"""
 
-resp = requests.post("https://api.twitter.com/2/tweets", json={"text": text}, auth=auth)
+resp = requests.post("https://api.twitter.com/2/tweets", json={"text": text}, auth=auth, timeout=15)
 data = resp.json()
 if resp.status_code in (200, 201):
     print(f"Tweet posted: {data['data']['id']}")
diff --git a/agents/x_wallet_binding.py b/agents/x_wallet_binding.py
index 96be606..2edddca 100644
--- a/agents/x_wallet_binding.py
+++ b/agents/x_wallet_binding.py
@@ -24,7 +24,7 @@
 
 #AIAgents #x402 #Base #A2A"""
 
-resp = requests.post("https://api.twitter.com/2/tweets", json={"text": text}, auth=auth)
+resp = requests.post("https://api.twitter.com/2/tweets", json={"text": text}, auth=auth, timeout=15)
 data = resp.json()
 if resp.status_code in (200, 201):
     print(f"Tweet posted: {data['data']['id']}")
diff --git a/app/admin_auth.py b/app/admin_auth.py
index 80b464d..0e4c7fb 100644
--- a/app/admin_auth.py
+++ b/app/admin_auth.py
@@ -1,22 +1,37 @@
 """MolTrust Admin Dashboard — Auth Module"""
+import os
 import secrets
 from datetime import datetime, timezone, timedelta
 import bcrypt
 
-ADMIN_USERS = {
-    "lars": {
-        "hash": "$2b$12$rxHaimEF4Ok1bXO4jybvQOx8cSmwhM/JRGWfTtlZ0OvvoFftTg6NC",
-        "role": "superadmin",
-    },
-    "harald": {
-        "hash": "$2b$12$c5GzSAMWozukKvNWmIiZ8OnP7I9i/7Ho0kKx5hVNGGUbJzWKXvZgC",
-        "role": "admin",
-    },
-    "bernd": {
-        "hash": "$2b$12$l3IuGfAveTEmC06YS7CNb.C3yGU5rkRvRJYnfpD6C4OtyBcqlMQBK",
-        "role": "admin",
-    },
-}
+
+def _load_admin_users() -> dict:
+    """
+    Load admin users from env vars rather than baking bcrypt hashes into
+    source. The expected format is a comma-separated triplet list:
+
+        MOLTRUST_ADMIN_USERS="lars:superadmin:$2b$12$...,harald:admin:$2b$12$...,bernd:admin:$2b$12$..."
+
+    Empty / missing env var → no admins registered (login will refuse
+    every request, fail-closed). Hashes that don't parse as bcrypt are
+    skipped with a startup warning.
+    """
+    raw = os.environ.get("MOLTRUST_ADMIN_USERS", "").strip()
+    if not raw:
+        return {}
+    users: dict[str, dict] = {}
+    for entry in raw.split(","):
+        parts = entry.strip().split(":", 2)
+        if len(parts) != 3:
+            continue
+        username, role, hashval = parts[0].strip(), parts[1].strip(), parts[2].strip()
+        if not username or not role or not hashval.startswith("$2"):
+            continue
+        users[username] = {"hash": hashval, "role": role}
+    return users
+
+
+ADMIN_USERS: dict[str, dict] = _load_admin_users()
 
 # In-memory sessions (sufficient for 3 users)
 SESSIONS: dict[str, dict] = {}
diff --git a/app/billing.py b/app/billing.py
index 286f1b0..0e86eb8 100644
--- a/app/billing.py
+++ b/app/billing.py
@@ -13,6 +13,7 @@
 """
 
 import os
+import secrets
 import logging
 import re
 from datetime import datetime, timezone
@@ -374,7 +375,7 @@ async def list_referrals(request: Request):
     """
     admin_key = request.headers.get("x-admin-key", "")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not expected or admin_key != expected:
+    if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(401, "Admin key required")
 
     from app.main import db_pool
diff --git a/app/crypto/kms_signer.py b/app/crypto/kms_signer.py
index 7bd1251..0d0790d 100644
--- a/app/crypto/kms_signer.py
+++ b/app/crypto/kms_signer.py
@@ -13,13 +13,24 @@ def get_decrypted_signing_key_hex() -> str:
     """
     Return the Ed25519 private key as a hex string (64 chars / 32 bytes).
     Decrypted via AWS KMS with 5-minute cache.
-    Falls back to plaintext env var or key file during migration.
+    Falls back to plaintext env var or key file during migration —
+    these fallbacks are DISABLED when MOLTRUST_ENV=production so that
+    an accidentally-set DID_PRIVATE_KEY_HEX env var or stray local
+    keyfile cannot bypass KMS in a production deploy.
     """
     global _cached_key, _cache_expiry
 
-    # Fallback 1: plaintext env var (migration period)
+    is_production = os.environ.get('MOLTRUST_ENV', '').lower() == 'production'
+
+    # Fallback 1: plaintext env var (migration / dev only)
     encrypted = os.environ.get('DID_PRIVATE_KEY_ENCRYPTED')
     if not encrypted:
+        if is_production:
+            raise ValueError(
+                'KMS-encrypted signing key required in production '
+                '(MOLTRUST_ENV=production); plaintext fallbacks disabled. '
+                'Set DID_PRIVATE_KEY_ENCRYPTED or unset MOLTRUST_ENV.'
+            )
         hex_key = os.environ.get('DID_PRIVATE_KEY_HEX', '')
         if hex_key:
             return hex_key
diff --git a/app/ipfs_publisher.py b/app/ipfs_publisher.py
index 9207480..141ae78 100644
--- a/app/ipfs_publisher.py
+++ b/app/ipfs_publisher.py
@@ -44,6 +44,8 @@ def publish_to_ipfs(vc_json: dict, name: str = None) -> str | None:
             }
         }).encode()
 
+        if not PINATA_API_URL.startswith(("http://", "https://")):
+            raise ValueError("PINATA_API_URL must use http(s)://")
         req = urllib.request.Request(
             PINATA_API_URL,
             data=payload,
@@ -53,7 +55,7 @@ def publish_to_ipfs(vc_json: dict, name: str = None) -> str | None:
             }
         )
 
-        with urllib.request.urlopen(req, timeout=15) as r:
+        with urllib.request.urlopen(req, timeout=15) as r:  # noqa: S310 — scheme validated above
             result = json.loads(r.read())
             cid = result.get("IpfsHash")
             if cid:
diff --git a/app/main.py b/app/main.py
index 3890ca4..1265b91 100644
--- a/app/main.py
+++ b/app/main.py
@@ -68,13 +68,28 @@ def _ratelimit_key(request) -> str:
 
 @app.get("/docs", include_in_schema=False)
 async def custom_swagger_ui():
+    # CSP limits the blast radius of any future injection into this HTML.
+    # Allowlist mirrors what the page actually loads (Swagger UI CDN
+    # + favicon host). 'unsafe-inline' is required by the existing
+    # theme-toggle script and inline styles; tightening further would
+    # need extracting those into a hashed external file.
+    _csp = (
+        "default-src 'self'; "
+        "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+        "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "
+        "img-src 'self' data: https://moltrust.ch; "
+        "font-src 'self' data:; "
+        "connect-src 'self'; "
+        "frame-ancestors 'none'; "
+        "base-uri 'self'"
+    )
     return _HTMLResp("""<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8">
 <title>MolTrust API</title>
 <link rel="icon" href="https://moltrust.ch/img/favicon.png" type="image/png">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5.17.14/swagger-ui.css" integrity="sha384-wxLW6kwyHktdDGr6Pv1zgm/VGJh99lfUbzSn6HNHBENZlCN7W602k9VkGdxuFvPn" crossorigin="anonymous">
 <style>
   :root { --bg: #fff; --topbar-bg: #0F172A; --text: #1E293B; --border: #E2E8F0; }
   [data-theme="dark"] { --bg: #0F172A; --topbar-bg: #0F172A; --text: #E2E8F0; --border: #334155; }
@@ -144,21 +159,26 @@ async def custom_swagger_ui():
   </div>
 </div>
 <div id="swagger-ui"></div>
-<script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui-bundle.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5.17.14/swagger-ui-bundle.js" integrity="sha384-wmyclcVGX/WhUkdkATwhaK1X1JtiNrr2EoYJ+diV3vj4v6OC5yCeSu+yW13SYJep" crossorigin="anonymous"></script>
 <script>
 function toggleTheme(){var c=document.documentElement.getAttribute('data-theme');var n=c==='dark'?'light':'dark';document.documentElement.setAttribute('data-theme',n);localStorage.setItem('mt-theme',n);}
 SwaggerUIBundle({url:'/openapi.json',dom_id:'#swagger-ui',presets:[SwaggerUIBundle.presets.apis,SwaggerUIBundle.SwaggerUIStandalonePreset],layout:'BaseLayout',deepLinking:true});
 </script>
 </body>
-</html>""")
+</html>""", headers={"Content-Security-Policy": _csp})
 
 
 # --- Config ---
-MOLTBOOK_APP_KEY = os.getenv("MOLTBOOK_APP_KEY", "moltdev_PENDING")
+# Fail-fast on required secrets / credentials. No "PENDING" defaults that
+# could silently bleed into production traffic.
+MOLTBOOK_APP_KEY = os.getenv("MOLTBOOK_APP_KEY", "")
 if not os.getenv("MOLTRUST_API_KEYS"):
     raise RuntimeError("MOLTRUST_API_KEYS environment variable is required — no default key allowed")
 API_KEYS = set(os.getenv("MOLTRUST_API_KEYS").split(","))
-DB_URL = os.getenv("DATABASE_URL", "postgresql://moltstack:$(cat /dev/null)@localhost/moltstack")
+# Use a benign default for DATABASE_URL — the previous default contained a
+# `$(...)` shell-injection antipattern that did nothing because the value
+# was never shelled out, but was confusing on review.
+DB_URL = os.getenv("DATABASE_URL", "postgresql://moltstack@localhost/moltstack")
 
 # --- Credits Config ---
 CREDITS_ENABLED = os.getenv("CREDITS_ENABLED", "false").lower() == "true"
@@ -175,10 +195,16 @@ async def custom_swagger_ui():
 @app.on_event("startup")
 async def startup():
     global db_pool
+    # MOLTSTACK_DB_PW is required at startup. Empty password against a
+    # misconfigured Postgres could silently succeed in development and
+    # mask credential-rotation incidents in production.
+    _db_pw = os.getenv("MOLTSTACK_DB_PW")
+    if not _db_pw:
+        raise RuntimeError("MOLTSTACK_DB_PW environment variable is required")
     try:
         db_pool = await asyncpg.create_pool(
             host=os.getenv("DB_HOST", "localhost"), database=os.getenv("DB_NAME", "moltstack"),
-            user="moltstack", password=os.getenv("MOLTSTACK_DB_PW", ""),
+            user="moltstack", password=_db_pw,
             min_size=2, max_size=10
         )
     except Exception as e:
@@ -265,13 +291,33 @@ async def global_exception_handler(request: Request, exc: Exception):
     return JSONResponse(status_code=500, content={"error": "Internal server error"})
 
 # --- Outbound Content Filter ---
+# scrub_secrets is a belt-and-suspenders defence layered on top of
+# code-level care. The patterns target high-shape secret formats —
+# adding new patterns is cheap; missing one is the only failure mode.
 SENSITIVE_PATTERNS = [
     re.compile(r"sk-ant-api[a-zA-Z0-9\-_]{20,}"),
     re.compile(r"sk-[a-zA-Z0-9]{20,}"),
     re.compile(r"xprv[a-zA-Z0-9]{50,}"),
     re.compile(r"password\s*[:=]\s*\S+", re.IGNORECASE),
-    re.compile(r"BEGIN (RSA |EC )?PRIVATE KEY"),
+    re.compile(r"BEGIN (RSA |EC |OPENSSH |DSA |ENCRYPTED |PRIVATE )?PRIVATE KEY"),
     re.compile(r"AKIA[0-9A-Z]{16}"),
+    # AWS-flavoured secret access keys (40-char base64).
+    re.compile(r"(?<![A-Za-z0-9])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9])"),
+    # GitHub fine-grained / classic / app tokens.
+    re.compile(r"gh[pousr]_[A-Za-z0-9]{36,}"),
+    # Stripe live + restricted tokens.
+    re.compile(r"(sk|rk)_live_[A-Za-z0-9]{20,}"),
+    re.compile(r"whsec_[A-Za-z0-9]{20,}"),
+    # OpenAI / Anthropic short-form bearer tokens.
+    re.compile(r"sk-proj-[A-Za-z0-9\-_]{20,}"),
+    # JWT structure (three b64url-encoded sections).
+    re.compile(r"eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+"),
+    # Note: a generic `[0-9a-fA-F]{64,}` rule was intentionally NOT added.
+    # 64-hex blobs include legitimate response payloads — Ethereum tx
+    # hashes, anchor / IPR commitment hashes, content hashes — and
+    # scrubbing them would break the API surface. Likewise base58 would
+    # eat wallet addresses. Add new patterns only when both
+    # high-precision (low false-positive rate) and high-impact.
 ]
 
 def scrub_secrets(obj):
@@ -293,8 +339,12 @@ async def update_last_active(did: str):
                 await conn.execute(
                     "UPDATE agents SET last_seen = now(), last_active_at = now() WHERE did = $1", did
                 )
-        except Exception:
-            pass
+        except Exception as e:
+            # Fire-and-forget by design (don't block the request), but log
+            # so a schema drift / DB hiccup doesn't disappear silently.
+            # Log only `type(e).__name__` — `e` can serialise asyncpg's
+            # connection string (with password) into the message.
+            logger.warning("update_last_active(%s) failed: %s", did, type(e).__name__)
 
 
 # --- IP Enrichment ---
@@ -306,7 +356,13 @@ async def _enrich_ip(ip: str) -> dict:
     info = {"org": None, "country": None}
     try:
         import urllib.request as _ur
-        req = _ur.Request(f"http://ip-api.com/json/{ip}?fields=org,country", headers={"User-Agent": "MolTrust/1.0"})
+        # HTTPS so geolocation data isn't MITM-able. ip-api.com supports
+        # HTTPS on its paid tier; on the free tier, callers should set
+        # MOLTRUST_IP_ENRICH_BASE to an HTTPS-capable provider.
+        _base = os.environ.get("MOLTRUST_IP_ENRICH_BASE", "https://ip-api.com").rstrip("/")
+        if not _base.startswith(("http://", "https://")):
+            return info  # refuse non-HTTP(S) bases
+        req = _ur.Request(f"{_base}/json/{ip}?fields=org,country", headers={"User-Agent": "MolTrust/1.0"})
         with _ur.urlopen(req, timeout=2) as r:
             import json as _j
             data = _j.loads(r.read())
@@ -324,13 +380,72 @@ async def _enrich_ip(ip: str) -> dict:
 
 
 def _get_client_ip(request) -> str:
-    real_ip = request.headers.get("X-Real-IP")
-    if real_ip:
-        return real_ip.strip()[:50]
-    forwarded = request.headers.get("X-Forwarded-For")
-    if forwarded:
-        return forwarded.split(",")[-1].strip()[:50]
-    return (request.client.host if request.client else "unknown")[:50]
+    """
+    Resolve the client IP from the request.
+
+    Honours `X-Real-IP` / `X-Forwarded-For` ONLY when the immediate
+    upstream (`request.client.host`) falls inside one of the CIDRs
+    declared in `MOLTRUST_TRUSTED_PROXIES` (comma-separated). When the
+    env var is unset, defaults to RFC1918 + loopback, which covers the
+    common case of api.moltrust.ch sitting behind a private-IP load
+    balancer. Set `MOLTRUST_TRUSTED_PROXIES="0.0.0.0/0,::/0"` to fall
+    back to the previous "trust everyone" behaviour during migration.
+
+    Without this gating, any external client could spoof X-Forwarded-For
+    to bypass rate limits or pollute the request log.
+    """
+    direct = request.client.host if request.client else None
+    if direct and _is_trusted_proxy(direct):
+        real_ip = request.headers.get("X-Real-IP")
+        if real_ip:
+            return real_ip.strip()[:50]
+        forwarded = request.headers.get("X-Forwarded-For")
+        if forwarded:
+            return forwarded.split(",")[-1].strip()[:50]
+    return (direct or "unknown")[:50]
+
+
+def _is_trusted_proxy(client_host: str) -> bool:
+    try:
+        import ipaddress
+        ip_obj = ipaddress.ip_address(client_host)
+    except (ValueError, ImportError):
+        return False
+    for net in _trusted_proxy_networks():
+        try:
+            if ip_obj in net:
+                return True
+        except (TypeError, ValueError):
+            continue
+    return False
+
+
+_TRUSTED_PROXY_CACHE: list = []
+_TRUSTED_PROXY_CACHED_FOR: str | None = None
+
+
+def _trusted_proxy_networks() -> list:
+    """Parse MOLTRUST_TRUSTED_PROXIES once, then memoise."""
+    global _TRUSTED_PROXY_CACHE, _TRUSTED_PROXY_CACHED_FOR
+    raw = os.environ.get(
+        "MOLTRUST_TRUSTED_PROXIES",
+        "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8,::1/128,fc00::/7",
+    )
+    if raw == _TRUSTED_PROXY_CACHED_FOR:
+        return _TRUSTED_PROXY_CACHE
+    import ipaddress
+    nets = []
+    for entry in raw.split(","):
+        entry = entry.strip()
+        if not entry:
+            continue
+        try:
+            nets.append(ipaddress.ip_network(entry, strict=False))
+        except ValueError:
+            continue
+    _TRUSTED_PROXY_CACHE = nets
+    _TRUSTED_PROXY_CACHED_FOR = raw
+    return nets
 
 
 def _anonymize_ip(ip: str) -> str:
@@ -354,8 +469,12 @@ async def update_last_seen(did: str):
         try:
             async with db_pool.acquire() as conn:
                 await conn.execute("UPDATE agents SET last_seen = now() WHERE did = $1", did)
-        except:
-            pass
+        except Exception as e:
+            # Fire-and-forget by design, but log so a schema drift / DB
+            # hiccup doesn't disappear silently. (Was a bare `except: pass`.)
+            # Log only `type(e).__name__` — `e` can serialise asyncpg's
+            # connection string (with password) into the message.
+            logger.warning("update_last_seen(%s) failed: %s", did, type(e).__name__)
 
 @app.middleware("http")
 async def content_filter_middleware(request: Request, call_next):
@@ -459,7 +578,10 @@ async def credit_middleware(request: Request, call_next):
                             caller_did, -cost, ref, f"API call: {ref}",
                         )
         except Exception as e:
-            logger.error("Credit deduction failed for %s: %s", caller_did, e)
+            # Log only the exception class — `e` itself can serialise
+            # asyncpg connection strings (with the password) and similar
+            # operational secrets into the log line.
+            logger.error("Credit deduction failed for %s: %s", caller_did, type(e).__name__)
 
     return response
 
@@ -500,7 +622,13 @@ def verify_api_key_or_did(
 
 
 # --- DID-Wallet Binding: Nonce helpers ---
-NONCE_SECRET = os.getenv("NONCE_SECRET", "")
+# Fail-fast: an empty NONCE_SECRET would make HMAC nonces trivially
+# forgeable. The runtime checks at the issuance + verify call sites
+# would catch this, but better to refuse to start than allow an
+# accidentally-misconfigured deploy to serve traffic.
+NONCE_SECRET = os.getenv("NONCE_SECRET")
+if not NONCE_SECRET:
+    raise RuntimeError("NONCE_SECRET environment variable is required — no default allowed")
 
 def _generate_nonce(did: str) -> str:
     import time as _t, hashlib as _hl
@@ -549,7 +677,11 @@ def _verify_wallet_signature(did: str, wallet_address: str, chain: str, nonce: s
 
 def check_registration_rate(api_key: str, max_per_hour: int = 5):
     now = time.time()
-    key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:16]
+    # Full SHA-256 digest. The previous 16-char (64-bit) truncation was
+    # within brute-force range for an attacker generating many API keys
+    # to find collisions and bypass per-key rate limits. The dict key is
+    # an in-memory lookup; the full 64-char hex string is fine.
+    key_hash = hashlib.sha256(api_key.encode()).hexdigest()
     if key_hash not in _reg_tracker:
         _reg_tracker[key_hash] = []
     _reg_tracker[key_hash] = [t for t in _reg_tracker[key_hash] if now - t < 3600]
@@ -899,6 +1031,8 @@ async def register_agent(request: Request, body: RegisterRequest, api_key: str =
 @app.post("/auth/moltbook")
 @limiter.limit("20/minute")
 async def auth_with_moltbook(request: Request, body: MoltbookAuthRequest):
+    if not MOLTBOOK_APP_KEY:
+        raise HTTPException(503, "Moltbook integration not configured (MOLTBOOK_APP_KEY env var unset)")
     async with httpx.AsyncClient(timeout=10.0) as client:
         try:
             resp = await client.post(
@@ -1421,7 +1555,7 @@ async def register_seed(request: Request, req: SeedRequest):
     """Register a trusted seed agent. Requires ADMIN_KEY header."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not expected or admin_key != expected:
+    if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(status_code=403, detail="Forbidden")
     async with db_pool.acquire() as conn:
         try:
@@ -1602,6 +1736,16 @@ async def _resolve_did_web_external(did: str) -> dict:
       did:web:foo.com:agents:x  -> https://foo.com/agents/x/did.json
 
     Port encoding via percent-encoded colon is decoded.
+
+    SSRF defence: the host portion is fully attacker-controlled (it comes
+    from the path segment of the request). Before issuing the HTTPS GET we
+    refuse hostnames that resolve to non-public addresses — otherwise an
+    attacker could read AWS/GCP metadata services
+    (`did:web:169.254.169.254`), probe internal services
+    (`did:web:127.0.0.1:5984`), or scan private networks
+    (`did:web:10.0.0.5:8080`). The `did:web` spec was designed for public
+    hostnames; restricting to publicly-routable addresses removes the
+    SSRF surface without breaking any legitimate did:web consumer.
     """
     if not did.startswith("did:web:"):
         raise HTTPException(400, "Not a did:web identifier")
@@ -1612,6 +1756,7 @@ async def _resolve_did_web_external(did: str) -> dict:
     # Decode percent-encoded chars (e.g. %3A for : in port specs)
     parts = [urllib.parse.unquote(p) for p in parts]
     domain = parts[0]
+    await _assert_public_host(domain)
     if len(parts) == 1:
         url = f"https://{domain}/.well-known/did.json"
     else:
@@ -1629,6 +1774,95 @@ async def _resolve_did_web_external(did: str) -> dict:
         raise HTTPException(502, "didDocument is not valid JSON")
 
 
+# Banned networks for did:web SSRF defence. Anything that resolves into one
+# of these is refused. Covers IPv4 + IPv6 private, loopback, link-local
+# (incl. AWS/GCP/Azure metadata at 169.254.169.254), multicast, reserved,
+# and IPv4-mapped IPv6.
+_DID_WEB_BANNED_NETWORKS: list = []
+
+
+def _did_web_banned_networks() -> list:
+    """Memoised list of banned networks for did:web resolution."""
+    global _DID_WEB_BANNED_NETWORKS
+    if _DID_WEB_BANNED_NETWORKS:
+        return _DID_WEB_BANNED_NETWORKS
+    import ipaddress as _ip
+    _DID_WEB_BANNED_NETWORKS = [
+        _ip.ip_network("0.0.0.0/8"),       # "this network"
+        _ip.ip_network("10.0.0.0/8"),      # RFC1918
+        _ip.ip_network("100.64.0.0/10"),   # CGNAT
+        _ip.ip_network("127.0.0.0/8"),     # loopback
+        _ip.ip_network("169.254.0.0/16"),  # link-local (cloud metadata)
+        _ip.ip_network("172.16.0.0/12"),   # RFC1918
+        _ip.ip_network("192.0.0.0/24"),    # IETF protocol assignments
+        _ip.ip_network("192.168.0.0/16"),  # RFC1918
+        _ip.ip_network("198.18.0.0/15"),   # benchmark testing
+        _ip.ip_network("224.0.0.0/4"),     # multicast
+        _ip.ip_network("240.0.0.0/4"),     # reserved
+        _ip.ip_network("::1/128"),         # IPv6 loopback
+        _ip.ip_network("fc00::/7"),        # IPv6 ULA
+        _ip.ip_network("fe80::/10"),       # IPv6 link-local
+        _ip.ip_network("ff00::/8"),        # IPv6 multicast
+        _ip.ip_network("::ffff:0:0/96"),   # IPv4-mapped IPv6
+    ]
+    return _DID_WEB_BANNED_NETWORKS
+
+
+_BANNED_HOST_NAMES = {
+    "localhost",
+    "ip6-localhost",
+    "ip6-loopback",
+    "metadata",
+    "metadata.google.internal",
+    "instance-data",
+    "instance-data.ec2.internal",
+}
+
+
+async def _assert_public_host(host: str) -> None:
+    """Refuse did:web hosts that resolve to private / loopback / metadata addresses."""
+    import asyncio as _aio
+    import ipaddress as _ip
+    import socket as _socket
+
+    if not host:
+        raise HTTPException(400, "did:web: empty host")
+    # Strip an explicit port: did:web encodes ports via %3A which we've
+    # already percent-decoded into a colon. IPv6 literals are wrapped in
+    # brackets when paired with a port; strip those too.
+    if host.startswith("[") and "]" in host:
+        host_only = host[1: host.index("]")]
+    else:
+        host_only = host.split(":")[0]
+    if host_only.lower() in _BANNED_HOST_NAMES:
+        raise HTTPException(400, "did:web: non-public host not allowed")
+    banned = _did_web_banned_networks()
+    # If host is an IP literal, check it directly.
+    try:
+        ip_obj = _ip.ip_address(host_only)
+        if any(ip_obj in net for net in banned):
+            raise HTTPException(400, "did:web: private / loopback / link-local IP not allowed")
+        return  # bare public IP literal — ok
+    except ValueError:
+        pass  # fall through to DNS resolution
+    # Resolve the hostname and ensure every returned address is public.
+    try:
+        infos = await _aio.to_thread(_socket.getaddrinfo, host_only, None)
+    except _socket.gaierror:
+        raise HTTPException(404, "didNotResolved: DNS lookup failed")
+    for _family, _type, _proto, _canon, sockaddr in infos:
+        addr = sockaddr[0]
+        # Strip IPv6 scope-id (e.g. fe80::1%eth0)
+        if "%" in addr:
+            addr = addr.split("%")[0]
+        try:
+            ip_obj = _ip.ip_address(addr)
+        except ValueError:
+            continue
+        if any(ip_obj in net for net in banned):
+            raise HTTPException(400, "did:web: host resolves to a non-public address")
+
+
 @app.get("/identity/resolve/{did:path}")
 @limiter.limit("30/minute")
 async def resolve_did(request: Request, did: str):
@@ -1990,7 +2224,7 @@ async def get_inactive_agents(request: Request, days: int = Query(default=30, ge
     """Returns agents inactive for more than `days` days. Admin-only. RSAC Gap 3."""
     admin_key = request.headers.get("x-admin-key", "")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not expected or admin_key != expected:
+    if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(403, "Admin key required")
 
     if not db_pool:
@@ -2490,7 +2724,7 @@ async def register_batch(request: Request):
     """Batch-register external agents with Merkle anchoring. Requires ADMIN_KEY."""
     admin_key = request.headers.get("x-admin-key", "")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not expected or admin_key != expected:
+    if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(403, "Invalid or missing admin key")
 
     try:
@@ -2724,15 +2958,19 @@ async def verify_vc(request: Request, body: VerifyVCRequest):
     return result
 # --- Multi-Platform OAuth ---
 
-GITHUB_CLIENT_ID = os.getenv("GITHUB_CLIENT_ID", "PENDING")
-GITHUB_CLIENT_SECRET = os.getenv("GITHUB_CLIENT_SECRET", "PENDING")
+# GitHub OAuth is optional — endpoints below return 503 when unset. The
+# previous "PENDING" sentinel was a foot-gun: a leak into production
+# would have produced a half-broken OAuth handshake. Empty string + a
+# truthy check at the call sites is cleaner.
+GITHUB_CLIENT_ID = os.getenv("GITHUB_CLIENT_ID", "")
+GITHUB_CLIENT_SECRET = os.getenv("GITHUB_CLIENT_SECRET", "")
 _oauth_states: dict[str, float] = {}  # state -> timestamp
 
 @app.get("/auth/github")
 @limiter.limit("10/minute")
 async def github_auth_start(request: Request):
     """Redirect to GitHub OAuth"""
-    if GITHUB_CLIENT_ID == "PENDING":
+    if not GITHUB_CLIENT_ID:
         raise HTTPException(503, "GitHub OAuth not yet configured")
     # MEDIUM-1: CSRF protection via state parameter
     import time as _time
@@ -2748,7 +2986,7 @@ async def github_auth_start(request: Request):
 @limiter.limit("10/minute")
 async def github_auth_callback(request: Request, code: str = Query(max_length=128),
                                state: str = Query(default="", max_length=64)):
-    if GITHUB_CLIENT_ID == "PENDING":
+    if not GITHUB_CLIENT_ID:
         raise HTTPException(503, "GitHub OAuth not yet configured")
     # MEDIUM-1: Validate CSRF state parameter
     import time as _time
@@ -3304,7 +3542,13 @@ async def dispatch(self, request, call_next):
 @limiter.limit("30/minute")
 async def join_redirect(request: Request, ref: str = Query(default=None, max_length=100)):
     if ref:
-        return RedirectResponse(f"https://moltrust.ch?ref={ref}", status_code=302)
+        # Percent-encode the ref so injection characters (\n, &, #, @, /)
+        # in a malicious referral string can't break out of the query
+        # value or rewrite the redirect target.
+        return RedirectResponse(
+            f"https://moltrust.ch?ref={urllib.parse.quote(ref, safe='')}",
+            status_code=302,
+        )
     return RedirectResponse("https://moltrust.ch", status_code=302)
 
 # --- ERC-8004 Bridge (Phase 1: Read-Only) ---
@@ -4424,7 +4668,7 @@ async def create_violation_record(request: Request, body: ViolationRecordRequest
     """Record a protocol violation. Requires X-Admin-Key header. Tech Spec 2.7."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not expected or admin_key != expected:
+    if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(status_code=403, detail="Forbidden")
 
     record_id = str(uuid.uuid4())
@@ -4469,7 +4713,7 @@ async def reverse_violation(request: Request, body: ViolationReversalRequest, re
     """Reverse a violation record. Requires X-Admin-Key header. Tech Spec 2.7."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not expected or admin_key != expected:
+    if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(status_code=403, detail="Forbidden")
 
     reversal_date = body.reversal_date or datetime.datetime.utcnow().isoformat()
@@ -4685,7 +4929,7 @@ async def unrevoke_agent(
 
     admin_key = request.headers.get("x-admin-key", "")
     expected_admin = os.environ.get("ADMIN_KEY", "")
-    if not expected_admin or admin_key != expected_admin:
+    if not expected_admin or not admin_key or not secrets.compare_digest(admin_key, expected_admin):
         raise HTTPException(403, "Admin key required to unrevoke agents")
 
     async with db_pool.acquire() as conn:
@@ -4943,7 +5187,7 @@ async def spiffe_unbind(request: Request, spiffe_uri: str, api_key: str = Depend
 
     admin_key = request.headers.get("x-admin-key", "")
     expected_admin = os.environ.get("ADMIN_KEY", "")
-    if not expected_admin or admin_key != expected_admin:
+    if not expected_admin or not admin_key or not secrets.compare_digest(admin_key, expected_admin):
         raise HTTPException(403, "Admin key required to remove SPIFFE bindings")
 
     if not db_pool:
@@ -5022,7 +5266,7 @@ async def configure_delegation(request: Request, api_key: str = Depends(verify_a
             # Check admin
             admin_key = request.headers.get("x-admin-key", "")
             expected = os.environ.get("ADMIN_KEY", "")
-            if not expected or admin_key != expected:
+            if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
                 raise HTTPException(403, "Not authorized to configure delegation for this DID")
 
         await conn.execute("""
@@ -5280,7 +5524,7 @@ async def revoke_music_credential(request: Request, body: MusicRevokeRequest, cr
     """Revoke a music credential. Requires X-Admin-Key."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not expected or admin_key != expected:
+    if not expected or not admin_key or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(status_code=403, detail="Forbidden")
 
     async with db_pool.acquire() as conn:
@@ -5498,7 +5742,7 @@ async def ipr_admin_anchor(request: Request):
     """Admin: Trigger Merkle batch anchoring for all pending IPRs."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not admin_key or admin_key != expected:
+    if not admin_key or not expected or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(403, "Invalid admin key")
 
     if not db_pool:
@@ -5514,7 +5758,7 @@ async def ipr_admin_retry(request: Request):
     """Admin: Reset failed IPRs back to pending."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not admin_key or admin_key != expected:
+    if not admin_key or not expected or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(403, "Invalid admin key")
 
     if not db_pool:
@@ -5530,7 +5774,7 @@ async def ipr_admin_reconcile(request: Request):
     """Admin: Verify all anchored IPRs against chain and reset missing."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not admin_key or admin_key != expected:
+    if not admin_key or not expected or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(403, "Invalid admin key")
 
     if not db_pool:
@@ -5546,7 +5790,7 @@ async def ipr_admin_reanchor(request: Request):
     """Admin: Force re-anchor a specific IPR."""
     admin_key = request.headers.get("x-admin-key")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not admin_key or admin_key != expected:
+    if not admin_key or not expected or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(403, "Invalid admin key")
 
     body = await request.json()
@@ -5577,7 +5821,7 @@ async def register_batch(request: Request):
     """
     admin_key = request.headers.get("x-admin-key", "")
     expected = os.environ.get("ADMIN_KEY", "")
-    if not admin_key or admin_key != expected:
+    if not admin_key or not expected or not secrets.compare_digest(admin_key, expected):
         raise HTTPException(403, "Invalid admin key")
 
     if not db_pool:
@@ -6581,6 +6825,15 @@ async def caller_detail(ip: str, request: Request):
     if not db_pool:
         raise HTTPException(503, "Database unavailable")
 
+    # Validate IP shape before using as a LIKE-prefix in SQL. The query
+    # is parameterised, but an unvalidated string (e.g. "% OR 1=1 --")
+    # would still produce confusing matches and pollute audit views.
+    import ipaddress as _ip_mod
+    try:
+        _ip_mod.ip_address(ip)
+    except ValueError:
+        raise HTTPException(400, "invalid IP address")
+
     import subprocess as _sp
 
     async with db_pool.acquire() as conn:
diff --git a/app/main_dev.py b/app/main_dev.py
index 63a2087..831b24e 100644
--- a/app/main_dev.py
+++ b/app/main_dev.py
@@ -1,6 +1,8 @@
 """Dev-Server for Explorer Phase A. Port 8099.
 Production main.py stays untouched."""
 
+import os
+
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from app.explorer.routes import router as explorer_router
@@ -11,9 +13,19 @@
     version="0.1.0-dev",
 )
 
+# Dev origins only — explicit allowlist instead of "*". If this dev server
+# is ever exposed beyond localhost, override via MOLTRUST_DEV_CORS_ORIGINS
+# (comma-separated). Wildcard CORS in dev has historically leaked into prod.
+_DEFAULT_DEV_ORIGINS = "http://localhost:3000,http://127.0.0.1:3000,http://localhost:8099"
+_ALLOWED_ORIGINS = [
+    o.strip()
+    for o in os.environ.get("MOLTRUST_DEV_CORS_ORIGINS", _DEFAULT_DEV_ORIGINS).split(",")
+    if o.strip()
+]
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=_ALLOWED_ORIGINS,
     allow_methods=["GET"],
     allow_headers=["*"],
 )
diff --git a/moltrust-openclaw-v2/src/client.ts b/moltrust-openclaw-v2/src/client.ts
index 03c6bad..7622890 100644
--- a/moltrust-openclaw-v2/src/client.ts
+++ b/moltrust-openclaw-v2/src/client.ts
@@ -115,10 +115,12 @@ export class MolTrustClient {
 
   constructor(cfg: MolTrustConfig, opts: ClientOptions = {}) {
     this.apiKey = cfg.apiKey ?? "";
-    this.baseUrl = (cfg.apiUrl ?? "https://api.moltrust.ch").replace(
-      /\/+$/,
-      "",
-    );
+    // Strip trailing slashes via a loop instead of `/\/+$/`. The regex
+    // form is polynomial-quadratic on pathological inputs like a long
+    // path full of trailing slashes; the loop is linear.
+    let _baseUrl = cfg.apiUrl ?? "https://api.moltrust.ch";
+    while (_baseUrl.endsWith("/")) _baseUrl = _baseUrl.slice(0, -1);
+    this.baseUrl = _baseUrl;
     this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
     const ttl = cfg.cacheTtlMs ?? 300_000;
     this.verifyCache = new LRUCache<VerifyResult>(ttl);
diff --git a/monitor/poll_payments.py b/monitor/poll_payments.py
index fbf1052..12e4186 100755
--- a/monitor/poll_payments.py
+++ b/monitor/poll_payments.py
@@ -71,12 +71,14 @@ def send_telegram(text):
         "text": text,
         "parse_mode": "HTML"
     }).encode()
+    _tg_url = "https://api.telegram.org/bot" + TELEGRAM_BOT_TOKEN + "/sendMessage"
+    if not _tg_url.startswith(("http://", "https://")):
+        return
     req = urllib.request.Request(
-        "https://api.telegram.org/bot" + TELEGRAM_BOT_TOKEN + "/sendMessage",
-        data=payload, headers={"Content-Type": "application/json"}
+        _tg_url, data=payload, headers={"Content-Type": "application/json"}
     )
     try:
-        with urllib.request.urlopen(req, timeout=10) as r:
+        with urllib.request.urlopen(req, timeout=10) as r:  # noqa: S310 — scheme validated above
             json.loads(r.read())
     except Exception as e:
         log.error("Telegram send failed: %s", e)
diff --git a/packages/mpp/index.js b/packages/mpp/index.js
index a2b848e..b990c38 100644
--- a/packages/mpp/index.js
+++ b/packages/mpp/index.js
@@ -42,8 +42,15 @@ async function getScore(wallet) {
 function extractWalletFromMPP(req) {
   const auth = req.headers['authorization'] || '';
 
-  // mppx uses "Payment" prefix
-  const match = auth.match(/^(?:Payment|MPP)\s+(.+)$/i);
+  // Hard cap on the Authorization header before regex match. Without this
+  // bound, the `\s+(.+)$` pattern below is polynomial-quadratic on
+  // pathological inputs (a long header full of whitespace). 8 KiB is
+  // generous for legitimate MPP envelopes.
+  if (auth.length > 8192) return null;
+
+  // mppx uses "Payment" prefix. Use bounded `\s{1,8}` and a non-greedy
+  // grouping to avoid the polynomial backtracking case altogether.
+  const match = auth.match(/^(?:Payment|MPP)\s{1,8}(\S.*)$/i);
   if (!match) return null;
 
   try {
diff --git a/requirements.txt b/requirements.txt
index 2ce8430..c1eee2f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,3 +12,14 @@ jcs>=0.2.1
 python-multipart>=0.0.9
 starlette>=0.37.0
 APScheduler>=3.10.0
+defusedxml>=0.7.1
+# Pre-existing runtime deps that were imported but not declared. The
+# production deploy has them installed (otherwise the API wouldn't
+# start), but `pip install -r requirements.txt` on a fresh checkout
+# would fail at module load. Pinning loosely so existing prod versions
+# stay valid.
+bcrypt>=4.0.0
+stripe>=10.0.0
+cryptography>=42.0.0
+# Required for Pydantic EmailStr fields in app/billing.py CheckoutRequest.
+email-validator>=2.0.0
diff --git a/scripts/erc8004_scanner.py b/scripts/erc8004_scanner.py
index 84b7503..a20609c 100644
--- a/scripts/erc8004_scanner.py
+++ b/scripts/erc8004_scanner.py
@@ -19,8 +19,10 @@ def query_subgraph(skip=0, first=1000):
         agentId owner agentWallet agentURI name description active createdAt
     }} }}'''
     data = json.dumps({"query": q}).encode()
+    if not SUBGRAPH.startswith(("http://", "https://")):
+        raise ValueError("SUBGRAPH must use http(s)://")
     req = Request(SUBGRAPH, data=data, headers={"Content-Type": "application/json", "User-Agent": "MolTrust/1.0"})
-    with urlopen(req, timeout=15) as r:
+    with urlopen(req, timeout=15) as r:  # noqa: S310 — scheme validated above
         return json.loads(r.read()).get("data", {}).get("agents", [])
 
 
diff --git a/scripts/telegram_hn_remind.py b/scripts/telegram_hn_remind.py
index e97ffd7..9e18491 100644
--- a/scripts/telegram_hn_remind.py
+++ b/scripts/telegram_hn_remind.py
@@ -18,6 +18,10 @@
 
 r = requests.post(
     f'https://api.telegram.org/bot{token}/sendMessage',
-    json={'chat_id': chat_id, 'text': text, 'parse_mode': 'HTML'}
+    json={'chat_id': chat_id, 'text': text, 'parse_mode': 'HTML'},
+    timeout=15,
 )
-print(f'Status: {r.status_code}, Response: {r.text}')
+# Print only the status. Telegram error bodies can echo the request URL
+# (which contains the bot token in the path) — leaking the body to
+# stdout puts the token into log aggregators / CI scrollback.
+print(f'Status: {r.status_code}')
diff --git a/seed_ecosystem.py b/seed_ecosystem.py
index 44080d5..9da6b2d 100644
--- a/seed_ecosystem.py
+++ b/seed_ecosystem.py
@@ -35,7 +35,7 @@
 ]
 
 def register_agent(name):
-    r = requests.post(f"{API}/identity/register", headers=HEADERS, json={"name": name})
+    r = requests.post(f"{API}/identity/register", headers=HEADERS, json={"name": name}, timeout=15)
     data = r.json()
     print(f"  Registered: {name} -> {data.get('did', 'ERROR')}")
     return data.get("did")
@@ -43,17 +43,17 @@ def register_agent(name):
 def rate_agent(from_did, to_did, score):
     r = requests.post(f"{API}/reputation/rate", headers=HEADERS, json={
         "from_did": from_did, "to_did": to_did, "score": score
-    })
+    }, timeout=15)
     return r.json()
 
 def issue_credential(subject_did):
     r = requests.post(f"{API}/credentials/issue", headers=HEADERS, json={
         "subject_did": subject_did
-    })
+    }, timeout=15)
     return r.json()
 
 def get_reputation(did):
-    r = requests.get(f"{API}/reputation/query/{did}", headers=HEADERS)
+    r = requests.get(f"{API}/reputation/query/{did}", headers=HEADERS, timeout=15)
     return r.json()
 
 def main():