diff --git a/BACKLOG.md b/BACKLOG.md
index 206d10e..4be3327 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -32,6 +32,7 @@ or `SPRINTS.md` are not committed backlog until they have a corresponding issue.
- [x] [#345 — [SEC] Least-privilege gaps: poller as schema owner; quadlet agent as owner without hardening; table-wide agent UPDATE](https://github.com/CryptoJones/OSApplyTrack/issues/345) (fixed in 1.55.13: the poller connects as its own `applytrack_poller` role (only the tables and columns it touches; no sessions, tokens, résumés, board passwords or DDL); the api creates and re-passwords both restricted roles on boot from `AGENT_DB_PASSWORD`/`POLLER_DB_PASSWORD`; the agent's `UPDATE` on applications is column-level, never `tenant_id`/`name`; the quadlets give the agent and poller their own env files, run api/agent/poller read-only as uid 1654 with no capabilities, and publish the api on 127.0.0.1:8080 only — see deploy/quadlet/README.md for the upgrade steps)
- [x] [#346 — [SEC] Hardening grab-bag: hashed session IDs, users.status, sign-out-everywhere, per-tenant LLM limit, slug validation, URL userinfo in logs](https://github.com/CryptoJones/OSApplyTrack/issues/346) (fixed in 1.56.0: sessions are stored as the SHA-256 of the cookie's id — existing rows are hashed in place, so nobody is signed out; a session slides 30 days from last use, capped at 90 from sign-in; `users.status` other than `active` stops sessions and sign-in links; `GET`/`DELETE /api/account/sessions` and Settings · Account list sessions and sign out everywhere else; the model routes are throttled per tenant as well as per IP, and `Llm__DailyCapPerTenant` (default 200) caps requests on the operator's key; Greenhouse/Lever slugs must match `[A-Za-z0-9_-]{1,100}` in both runtimes; LLM log lines carry only `scheme://host:port`)
- [x] [#390 — [SEC] uv.lock pins anyio 4.14.0 — pip-audit flags three CVEs (fixed in 4.14.2)](https://github.com/CryptoJones/OSApplyTrack/issues/390) (fixed in 1.65.2: uv.lock now pins anyio 4.14.2 on Python 3.10 and 4.15.1 on 3.11+, and CI also audits the locked set — `uv export --locked`, markers stripped so every Python-version fork of the lock is checked, not just the runner's — so the lock can no longer drift vulnerable behind a clean fresh resolution)
+- [x] [#459 — CI failed on main: .NET, Python and Web audit jobs](https://github.com/CryptoJones/OSApplyTrack/issues/459) (fixed on main, no release needed — the three weekly-run failures were all newly published advisories against existing dependencies, not code: MailKit → MimeKit pulled `System.Security.Cryptography.Pkcs` 10.0.0 (GHSA-846f-f764-76mx high, GHSA-2fmv-rv2c-59x7 moderate), so the api project now carries a direct reference to 10.0.14 as a transitive floor; `uv.lock` moves certifi 2026.6.17 → 2026.10.23 (PYSEC-2026-4320); `package-lock.json` moves follow-redirects 1.16.0 → 1.16.2 and qs 6.15.3 → 6.17.1 via `npm audit fix`. The patched Pkcs ships in the next tagged release)
- [x] [#392 — Agent can't start Playwright as uid 1654: /app/.playwright/node/linux-x64/node is mode 744 root (breaks every packet build since the #345 units)](https://github.com/CryptoJones/OSApplyTrack/issues/392) (fixed in 1.65.3: the api image makes the Playwright driver tree readable by all and its node binary executable by all (`chmod -R a+rX /app/.playwright`), so the agent under the #345 hardening — uid 1654, read-only root, noexec `/tmp`, no capabilities — starts the driver again. Verified by driving `Playwright.CreateAsync()` → `Chromium.ConnectAsync()` → a screenshot from the image under exactly that profile: EACCES before, clean after; the driver needs nothing writable beyond `/tmp` (a read-only `$HOME` is fine). A new `image` CI job builds the api image and starts the driver that way on every PR. Deploy: pull 1.65.3 and put the agent back on `User=1654:1654`)
## Operations and scalability
diff --git a/api/ApplyTrack.Api/ApplyTrack.Api.csproj b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
index ccb74e3..bdea08d 100644
--- a/api/ApplyTrack.Api/ApplyTrack.Api.csproj
+++ b/api/ApplyTrack.Api/ApplyTrack.Api.csproj
@@ -24,6 +24,11 @@
+
+