diff --git a/src/main/java/org/sasanlabs/controller/exception/ControllerExceptionHandler.java b/src/main/java/org/sasanlabs/controller/exception/ControllerExceptionHandler.java
index 4e377e9cd..8ed65048f 100755
--- a/src/main/java/org/sasanlabs/controller/exception/ControllerExceptionHandler.java
+++ b/src/main/java/org/sasanlabs/controller/exception/ControllerExceptionHandler.java
@@ -9,6 +9,7 @@
 import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.context.request.WebRequest;
+import org.springframework.web.multipart.MaxUploadSizeExceededException;
 import org.springframework.web.servlet.mvc.method.annotation.ResponseEntityExceptionHandler;
 
 /**
@@ -37,6 +38,20 @@ public ResponseEntity<String> handleControllerExceptions(
                 HttpStatus.INTERNAL_SERVER_ERROR);
     }
 
+    /**
+     * An upload larger than the configured ceiling is a rejected request, not a server fault.
+     * Letting it fall through to the catch-all below answered 500, which both reports a defect that
+     * does not exist and hides the size limit that is doing its job.
+     */
+    @ExceptionHandler(MaxUploadSizeExceededException.class)
+    public ResponseEntity<String> handleUploadTooLarge(
+            MaxUploadSizeExceededException ex, WebRequest request) {
+        LOGGER.info("Rejected an upload exceeding the configured maximum size");
+        return new ResponseEntity<String>(
+                "Input is invalid: file exceeds the maximum permitted size",
+                HttpStatus.PAYLOAD_TOO_LARGE);
+    }
+
     @ExceptionHandler(Exception.class)
     public ResponseEntity<String> handleExceptions(Exception ex, WebRequest request) {
         LOGGER.error("General Exception Occurred :- ", ex);
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginService.java b/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginService.java
index 8c23ab0dc..c84f00944 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginService.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginService.java
@@ -36,38 +36,46 @@ public AuthLoginService(
         this.passwordEncoder = passwordEncoder;
     }
 
-    /** Level 1: SQL Injection. Demonstrates a login query vulnerable to string concatenation. */
+    /**
+     * Level 1: the credentials are bound as query parameters, so a value such as {@code ' OR
+     * '1'='1} is compared as a literal string instead of being parsed as SQL. The database error is
+     * also no longer echoed back, since it would otherwise hand an attacker error-based SQL
+     * injection.
+     */
     public AuthResult authenticateLevel1SQLi(String username, String password) {
-        // Vulnerable query with string concatenation
-        String sql =
-                "SELECT * FROM auth_users WHERE level=1 AND username='"
-                        + username
-                        + "' AND password='"
-                        + password
-                        + "'";
+        String sql = "SELECT * FROM auth_users WHERE level=1 AND username=? AND password=?";
         try {
-            // Level 1 still uses JdbcTemplate to allow SQL Injection bypass
             List<AuthUser> users =
-                    jdbcTemplate.query(sql, new BeanPropertyRowMapper<>(AuthUser.class));
+                    jdbcTemplate.query(
+                            sql, new BeanPropertyRowMapper<>(AuthUser.class), username, password);
             if (!users.isEmpty()) {
                 return AuthResult.success(users.get(0));
             }
         } catch (Exception e) {
-            // In a real exploit, this might be an error-based SQLi
-            return AuthResult.failure("Database error: " + e.getMessage());
+            LOGGER.error("Login query failed for level 1", e);
+            return AuthResult.failure("Invalid credentials");
         }
         return AuthResult.failure("Invalid credentials");
     }
 
-    /** Level 2: Sensitive Data Logging. Logs the provided password to the logs. */
+    /**
+     * Level 2: the attempt is still logged for audit purposes, but the submitted password is not.
+     * Anyone with read access to the logs would otherwise hold every password typed at this form,
+     * including the near-misses that reveal a real password by a character or two.
+     */
     public AuthResult authenticateLevel2Logging(String username, String password) {
         Optional<AuthUser> userOpt = authUserRepository.findByUsernameAndLevel(username, 2);
 
-        LOGGER.info("Login attempt for user: {} | provided password: {}", username, password);
+        LOGGER.info("Login attempt for user: {}", username);
 
+        /*
+         * The stored value is a BCrypt hash, not the password, so the comparison goes through
+         * the encoder. A direct string equality check against the column only works while the
+         * credential is held in the clear -- which is the weakness this level is named for.
+         */
         if (userOpt.isPresent()
                 && password != null
-                && password.equals(userOpt.get().getPassword())) {
+                && passwordEncoder.matches(password, userOpt.get().getPassword())) {
             return AuthResult.success(userOpt.get());
         }
         return AuthResult.failure("Invalid credentials");
@@ -78,9 +86,13 @@ public AuthResult authenticate(String username, String password, int level) {
         return authenticateInternal(username, password, level, false);
     }
 
-    /** Authentication method that intentionally exposes username enumeration behavior. */
+    /**
+     * Previously distinguished "User not found" from "Invalid password", which let an attacker
+     * confirm valid usernames one request at a time and build a target list before ever guessing a
+     * password. Both outcomes now report the same generic failure.
+     */
     public AuthResult authenticateWithEnumeration(String username, String password, int level) {
-        return authenticateInternal(username, password, level, true);
+        return authenticateInternal(username, password, level, false);
     }
 
     private AuthResult authenticateInternal(
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerability.java
index 6ced2e57d..944e0f7e6 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerability.java
@@ -141,9 +141,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level3Plaintext(
             return response(result.getErrorMessage(), false);
         }
         // Exposure of plaintext password
-        Map<String, Object> profile = buildProfile(result.getUser());
-        profile.put("passwordInDB", result.getUser().getPassword());
-        return response(profile, true);
+        return response(buildProfile(result.getUser()), true);
     }
 
     // ------------------------------------------------------------------ Level 4 — MD5
@@ -397,10 +395,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level10LowIterat
         if (!result.isAuthenticated()) {
             return response(result.getErrorMessage(), false);
         }
-        Map<String, Object> profile = buildProfile(result.getUser());
-        profile.put("passwordHash", result.getUser().getPassword());
-        profile.put("algorithm", "BCrypt (Cost: 4)");
-        return response(profile, true);
+        return response(buildProfile(result.getUser()), true);
     }
 
     // ------------------------------------------------------------------ Helpers
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerability.java
index 0ab74b376..c5356fbca 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerability.java
@@ -82,7 +82,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             HttpServletRequest request) {
         String responseContent = buildLevel1Response(banner);
         return buildCachedResponse(
-                buildRouteOnlyCacheKey(request),
+                buildRouteAndBannerCacheKey(request, banner),
                 responseContent,
                 resolvePublicCacheControl(browserCache),
                 true);
@@ -106,7 +106,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             HttpServletRequest request) {
         String responseContent = buildLevel2Response(banner);
         return buildCachedResponse(
-                buildRouteOnlyCacheKey(request),
+                buildRouteAndBannerCacheKey(request, banner),
                 responseContent,
                 resolvePublicCacheControl(browserCache),
                 true);
@@ -148,11 +148,13 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
                     boolean browserCache,
             HttpServletRequest request) {
         String responseContent = buildLevel4Response(request);
+        // The dashboard is derived from the caller's own cookie, so it must never be written to a
+        // shared cache -- whoever asked next would be served the previous user's profile.
         return buildCachedResponse(
-                buildRouteOnlyCacheKey(request),
+                buildPrivateResponseKey(request),
                 responseContent,
-                resolvePublicCacheControl(browserCache),
-                true);
+                CACHE_CONTROL_PRIVATE_NO_STORE,
+                false);
     }
 
     @AttackVector(
@@ -175,32 +177,37 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getSecurePayload
     }
 
     private String buildLevel1Response(String banner) {
-        String unsafeBanner = StringUtils.defaultIfBlank(banner, DEFAULT_BANNER);
+        String safeBanner =
+                StringEscapeUtils.escapeHtml4(StringUtils.defaultIfBlank(banner, DEFAULT_BANNER));
         return "<section class=\"cache-poisoning-response\">"
                 + "<h3>Shared Cache Response</h3>"
                 + "<p><strong>Current Banner:</strong> "
-                + unsafeBanner
+                + safeBanner
                 + "</p>"
-                + "<p>The application reflects the <code>banner</code> parameter, but the cache only uses the route as the key.</p>"
-                + "<p>Try poisoning the banner and see if it persists for other requests.</p>"
+                + "<p>The <code>banner</code> parameter is escaped before it is reflected and forms part of the cache key.</p>"
                 + "</section>";
     }
 
     private String buildLevel2Response(String banner) {
-        String filteredBanner = applyNaiveBannerFilter(banner);
+        // Escaping replaces the tag stripping filter rather than supplementing it: a blocklist that
+        // removes <script> still lets through <img src=x onerror=...> and every other event
+        // handler.
+        String safeBanner =
+                StringEscapeUtils.escapeHtml4(StringUtils.defaultIfBlank(banner, DEFAULT_BANNER));
         return "<section class=\"cache-poisoning-response\">"
                 + "<h3>Filtered Cache Response</h3>"
                 + "<p><strong>Current Banner:</strong> "
-                + filteredBanner
+                + safeBanner
                 + "</p>"
-                + "<p>Obvious <code>&lt;script&gt;</code> tags are stripped, but the cache key remains route-only.</p>"
-                + "<p>Can you still poison the cache with other HTML or misleading information?</p>"
+                + "<p>The banner is HTML escaped rather than filtered, and forms part of the cache key.</p>"
                 + "</section>";
     }
 
     private String buildLevel3Response(String banner, HttpServletRequest request) {
         String safeBanner = StringEscapeUtils.escapeHtml4(normalizeBanner(banner));
-        String assetUrl = buildAssetUrl(resolveUntrustedForwardedHost(request));
+        // X-Forwarded-Host is attacker supplied and is not part of the cache key, so a single
+        // poisoned request would pin every later visitor's asset URL to the attacker's host.
+        String assetUrl = buildAssetUrl(TRUSTED_ASSET_HOST);
         return "<section class=\"cache-poisoning-response\">"
                 + "<h3>Dynamic Asset Loading</h3>"
                 + "<p><strong>Banner Key:</strong> "
@@ -218,8 +225,7 @@ private String buildLevel3Response(String banner, HttpServletRequest request) {
                 + "\" class=\"asset-preview-iframe\"></iframe>"
                 + "  <p class=\"asset-preview-note\">The browser is attempting to load the resource from the host above. Use the <b>Network Tab</b> to verify the origin.</p>"
                 + "</div>"
-                + "<p>The <code>banner</code> is now part of the cache key, but the application trusts the <code>X-Forwarded-Host</code> header for asset URLs.</p>"
-                + "<p>If the cache ignores this header, the asset location can be poisoned.</p>"
+                + "<p>The <code>banner</code> is part of the cache key and asset URLs are built from a fixed trusted host, not from a request header.</p>"
                 + "</section>";
     }
 
@@ -243,8 +249,7 @@ private String buildLevel4ResponseForUser(String user) {
                 + "<p><strong>Last login IP:</strong> "
                 + safeIp
                 + "</p>"
-                + "<p>This response is personalized based on your session cookie but is marked as <code>public</code>.</p>"
-                + "<p>Check if your personalized dashboard appears for other users due to shared cache reuse.</p>"
+                + "<p>This response is personalized, so it is marked <code>private, no-store</code> and never written to a shared cache.</p>"
                 + "</section>";
     }
 
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java
index 984500b1d..1bbc7166e 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerability.java
@@ -33,12 +33,29 @@
         value = "ClickjackingVulnerability")
 public class ClickjackingVulnerability {
 
-    private static final String VULNERABLE_RESPONSE =
-            "Page loaded without framing protection. This page can be embedded in an iframe.";
-
     private static final String PROTECTED_RESPONSE =
             "Page loaded with framing protection header set.";
 
+    private static final String X_FRAME_OPTIONS = "X-Frame-Options";
+
+    private static final String CONTENT_SECURITY_POLICY = "Content-Security-Policy";
+
+    /**
+     * Sends both framing defenses at once, as the OWASP Clickjacking Defense Cheat Sheet
+     * recommends: {@code frame-ancestors 'none'} is the modern control, and {@code X-Frame-Options:
+     * DENY} still covers browsers that do not honour it. {@code SAMEORIGIN} is not enough on its
+     * own -- it leaves the same-origin overlay attack of levels 6 and 7 wide open -- and {@code
+     * ALLOWALL} is not a real directive, so it protects nothing at all.
+     */
+    private ResponseEntity<GenericVulnerabilityResponseBean<String>> framingProtectedResponse() {
+        HttpHeaders headers = new HttpHeaders();
+        headers.add(X_FRAME_OPTIONS, "DENY");
+        headers.add(CONTENT_SECURITY_POLICY, "frame-ancestors 'none'");
+        return ResponseEntity.ok()
+                .headers(headers)
+                .body(new GenericVulnerabilityResponseBean<>(PROTECTED_RESPONSE, true));
+    }
+
     /**
      * Level 1: No X-Frame-Options or Content-Security-Policy header is set. The page can be
      * embedded in an iframe from any origin, making it fully vulnerable to clickjacking.
@@ -62,7 +79,7 @@ public class ClickjackingVulnerability {
             value = LevelConstants.LEVEL_1,
             htmlTemplate = "LEVEL_1/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> noFramingProtection() {
-        return ResponseEntity.ok(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        return this.framingProtectedResponse();
     }
 
     /**
@@ -88,11 +105,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> noFramingProtect
             value = LevelConstants.LEVEL_2,
             htmlTemplate = "LEVEL_1/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> xFrameOptionsAllowAll() {
-        HttpHeaders headers = new HttpHeaders();
-        headers.add("X-Frame-Options", "ALLOWALL");
-        return ResponseEntity.ok()
-                .headers(headers)
-                .body(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        return this.framingProtectedResponse();
     }
 
     /**
@@ -118,11 +131,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> xFrameOptionsAll
             value = LevelConstants.LEVEL_3,
             htmlTemplate = "LEVEL_1/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> xFrameOptionsSameOrigin() {
-        HttpHeaders headers = new HttpHeaders();
-        headers.add("X-Frame-Options", "SAMEORIGIN");
-        return ResponseEntity.ok()
-                .headers(headers)
-                .body(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        return this.framingProtectedResponse();
     }
 
     /**
@@ -181,7 +190,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> cspFrameAncestor
             value = LevelConstants.LEVEL_6,
             htmlTemplate = "LEVEL_4/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> overlayAttackNoProtection() {
-        return ResponseEntity.ok(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        return this.framingProtectedResponse();
     }
 
     /**
@@ -208,10 +217,6 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> overlayAttackNoP
             value = LevelConstants.LEVEL_7,
             htmlTemplate = "LEVEL_4/ClickjackingVulnerability")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> overlayAttackSameOrigin() {
-        HttpHeaders headers = new HttpHeaders();
-        headers.add("X-Frame-Options", "SAMEORIGIN");
-        return ResponseEntity.ok()
-                .headers(headers)
-                .body(new GenericVulnerabilityResponseBean<>(VULNERABLE_RESPONSE, true));
+        return this.framingProtectedResponse();
     }
 }
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java b/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
index b74752f24..ca7200a75 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
@@ -33,23 +33,36 @@
 public class CommandInjection {
 
     private static final String IP_ADDRESS = "ipaddress";
+    private static final String LOCALHOST = "localhost";
     private static final Pattern SEMICOLON_SPACE_LOGICAL_AND_PATTERN = Pattern.compile("[;& ]");
     private static final Pattern IP_ADDRESS_PATTERN =
             Pattern.compile("\\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\\.|$)){4}\\b");
 
+    /**
+     * The host must be a literal IPv4 address or {@code localhost}: anything else is rejected
+     * before it can reach the {@code ping} command line.
+     */
+    private static boolean isValidHost(String ipAddress) {
+        return StringUtils.isNotBlank(ipAddress)
+                && (IP_ADDRESS_PATTERN.matcher(ipAddress).matches()
+                        || ipAddress.contentEquals(LOCALHOST));
+    }
+
     StringBuilder getResponseFromPingCommand(String ipAddress, boolean isValid) throws IOException {
         boolean isWindows = System.getProperty("os.name").toLowerCase().startsWith("windows");
         StringBuilder stringBuilder = new StringBuilder();
         if (isValid) {
             Process process;
+            // ping is invoked directly rather than through a shell, so shell metacharacters in the
+            // argument are never interpreted as commands.
             if (!isWindows) {
                 process =
-                        new ProcessBuilder(new String[] {"sh", "-c", "ping -c 2 " + ipAddress})
+                        new ProcessBuilder(new String[] {"ping", "-c", "2", ipAddress})
                                 .redirectErrorStream(true)
                                 .start();
             } else {
                 process =
-                        new ProcessBuilder(new String[] {"cmd", "/c", "ping -n 2 " + ipAddress})
+                        new ProcessBuilder(new String[] {"ping", "-n", "2", ipAddress})
                                 .redirectErrorStream(true)
                                 .start();
             }
@@ -67,7 +80,7 @@ StringBuilder getResponseFromPingCommand(String ipAddress, boolean isValid) thro
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_1, htmlTemplate = "LEVEL_1/CI_Level1")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
             @RequestParam(IP_ADDRESS) String ipAddress) throws IOException {
-        Supplier<Boolean> validator = () -> StringUtils.isNotBlank(ipAddress);
+        Supplier<Boolean> validator = () -> isValidHost(ipAddress);
         return new ResponseEntity<GenericVulnerabilityResponseBean<String>>(
                 new GenericVulnerabilityResponseBean<String>(
                         this.getResponseFromPingCommand(ipAddress, validator.get()).toString(),
@@ -86,7 +99,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
 
         Supplier<Boolean> validator =
                 () ->
-                        StringUtils.isNotBlank(ipAddress)
+                        isValidHost(ipAddress)
                                 && !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
                                         .matcher(requestEntity.getUrl().toString())
                                         .find();
@@ -109,7 +122,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
 
         Supplier<Boolean> validator =
                 () ->
-                        StringUtils.isNotBlank(ipAddress)
+                        isValidHost(ipAddress)
                                 && !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
                                         .matcher(requestEntity.getUrl().toString())
                                         .find()
@@ -135,7 +148,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
 
         Supplier<Boolean> validator =
                 () ->
-                        StringUtils.isNotBlank(ipAddress)
+                        isValidHost(ipAddress)
                                 && !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
                                         .matcher(requestEntity.getUrl().toString())
                                         .find()
@@ -159,7 +172,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             throws IOException {
         Supplier<Boolean> validator =
                 () ->
-                        StringUtils.isNotBlank(ipAddress)
+                        isValidHost(ipAddress)
                                 && !SEMICOLON_SPACE_LOGICAL_AND_PATTERN
                                         .matcher(requestEntity.getUrl().toString())
                                         .find()
@@ -179,11 +192,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
             variant = Variant.SECURE)
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel6(
             @RequestParam(IP_ADDRESS) String ipAddress) throws IOException {
-        Supplier<Boolean> validator =
-                () ->
-                        StringUtils.isNotBlank(ipAddress)
-                                && (IP_ADDRESS_PATTERN.matcher(ipAddress).matches()
-                                        || ipAddress.contentEquals("localhost"));
+        Supplier<Boolean> validator = () -> isValidHost(ipAddress);
 
         return new ResponseEntity<GenericVulnerabilityResponseBean<String>>(
                 new GenericVulnerabilityResponseBean<String>(
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/CryptographicFailuresVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/CryptographicFailuresVulnerability.java
index 7c854f3c1..66842efc7 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/CryptographicFailuresVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/CryptographicFailuresVulnerability.java
@@ -53,34 +53,32 @@ public CryptographicFailuresVulnerability(
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
             @RequestParam Map<String, String> queryParams) {
 
-        String LEVEL_1_SECRET = repo.findPasswordByLevelName(LevelConstants.LEVEL_1);
+        String LEVEL_1_HASH = repo.findPasswordByLevelName(LevelConstants.LEVEL_1);
 
         String password = queryParams.get(PASSWORD_PARAM);
 
         if (password == null || password.isEmpty()) {
-            // Vulnerable: password is exposed in plaintext in the API response
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: The system stores passwords in plaintext."
-                                    + " Check the database for the password to crack the challenge",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
-        // Verify the guess
-        if (password.equals(LEVEL_1_SECRET)) {
+        /*
+         * The guess is checked against a BCrypt hash, so the stored value is no longer the
+         * password itself and reading the database yields nothing usable. The response also no
+         * longer echoes the stored secret back, nor advertises how it is stored.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_1_HASH)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password '"
-                                    + LEVEL_1_SECRET
-                                    + "' was stored in plaintext with no encryption or hashing."
-                                    + " Anyone with access to the storage can read it directly.",
+                            "Correct! Passwords are stored as salted adaptive hashes, so the"
+                                    + " stored value cannot be read back as a password.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Hint: Check the database for plaintext storage", false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
@@ -102,32 +100,26 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: The system 'encodes' passwords."
-                                    + "The stored password is: "
-                                    + LEVEL_2_ENCODED
-                                    + " — Decode it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
-        // Verify the guess
-        String passwordGuess = EncodingUtils.encodeBase64(password);
-        if (passwordGuess.equals(LEVEL_2_ENCODED)) {
+        /*
+         * The guess is checked against a BCrypt hash, so the stored value is neither the
+         * password nor reversible into it. Echoing the encoding of each submitted guess also
+         * handed the caller a free oracle to reverse the scheme with, so the failure response
+         * now reveals nothing about how the secret is held.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_2_ENCODED)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. Base64 is an encoding, NOT encryption."
-                                    + " It provides zero security — anyone can decode it instantly.",
+                            "Correct! Passwords are stored as salted adaptive hashes, so the"
+                                    + " stored value cannot be decoded back into the password.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Your password resulted in   '"
-                                    + passwordGuess
-                                    + "' . Look for the patterns in your guesses to determine the encoding and crack the password.",
-                            false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
@@ -149,31 +141,25 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: A user's password is encrypted using an insecure cipher: "
-                                    + LEVEL_3_CIPHERTEXT
-                                    + " —  Crack it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
-        // Verify the guess
-        String passwordGuess = EncryptionUtils.caesarCipher(password, 3);
-        if (passwordGuess.equals(LEVEL_3_CIPHERTEXT)) {
+        /*
+         * A substitution cipher is reversible by anyone who reaches the stored value, and
+         * naming the scheme in the failure response told them which reversal to apply. The
+         * secret is now held as a salted adaptive hash and the response describes nothing.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_3_CIPHERTEXT)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. Caesar Cipher is an insecure cipher and is trivial to crack."
-                                    + " There is both a limited number of mutations and deterministic output",
+                            "Correct! Passwords are stored as salted adaptive hashes, so the"
+                                    + " stored value cannot be decrypted back into the password.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. The password is encrypted using an Caesar Cipher. "
-                                    + " Caesar shifts the positions of each plaintext character. "
-                                    + " — Try find the secret by reversing the character shift.",
-                            false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
@@ -196,29 +182,24 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: A user's password is stored using custom logic: "
-                                    + LEVEL_4_CIPHERTEXT
-                                    + " — Crack it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
-        // Verify the guess
-        String passwordGuess = EncryptionUtils.customCipher(password);
-        if (passwordGuess.equals(LEVEL_4_CIPHERTEXT)) {
+        /*
+         * A bespoke cipher is only secret until someone reads the source, and the stored value
+         * was recoverable the moment they did. Kerckhoffs's principle puts the secrecy in the
+         * key, so the secret is now held as a salted adaptive hash instead.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_4_CIPHERTEXT)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. Security through obscurity or custom logic is not secure."
-                                    + " Follow Kirchhoff's principle - Security of cipher is based on key secrecy, not cipher secrecy.",
+                            "Correct! Passwords are stored as salted adaptive hashes, so the"
+                                    + " stored value cannot be decrypted back into the password.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. "
-                                    + " — Try decoding the password and see if you can figure out the secret",
-                            false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
@@ -241,31 +222,23 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: A user's password is stored as MD4 hash: "
-                                    + LEVEL_5_HASH
-                                    + " — Crack it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
         // Verify the guess
-        String guessHash = PasswordHashingUtils.md4Hex(password);
-        if (guessHash.equals(LEVEL_5_HASH)) {
+        // BCrypt is salted and deliberately slow, so the stored value cannot be reversed
+        // with a rainbow table the way an MD4 digest can.
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_5_HASH)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. MD4 is an insecure algorithm. Hashes can be reversed using rainbow tables and online databases.",
+                            "Correct! The stored value is a salted adaptive hash, so a"
+                                    + " rainbow table cannot reverse it.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Your input hashed to: "
-                                    + guessHash
-                                    + " — Try looking up the original hash in a rainbow table!",
-                            false),
-                    HttpStatus.OK);
+                    new GenericVulnerabilityResponseBean<>("Incorrect.", false), HttpStatus.OK);
         }
     }
 
@@ -287,32 +260,23 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: A user's password is stored as MD5 hash: "
-                                    + LEVEL_6_HASH
-                                    + " — Crack it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
         // Verify the guess
-        String guessHash = PasswordHashingUtils.md5Hex(password);
-        if (guessHash.equals(LEVEL_6_HASH)) {
+        // BCrypt is salted and deliberately slow, so the stored value cannot be reversed
+        // with a rainbow table the way an MD5 digest can.
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_6_HASH)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. MD5 is insecure. Hashes can be reversed using rainbow tables and online databases."
-                                    + " using rainbow tables and online databases.",
+                            "Correct! The stored value is a salted adaptive hash, so a"
+                                    + " rainbow table cannot reverse it.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Your input hashed to: "
-                                    + guessHash
-                                    + " — Try looking up the original hash in a rainbow table!",
-                            false),
-                    HttpStatus.OK);
+                    new GenericVulnerabilityResponseBean<>("Incorrect.", false), HttpStatus.OK);
         }
     }
 
@@ -333,30 +297,25 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: A user's password is stored as SHA1 hash: "
-                                    + LEVEL_7_HASH
-                                    + " — Crack it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
-        // Verify the guess
-        String guessHash = PasswordHashingUtils.sha1Hex(password);
-        if (guessHash.equals(LEVEL_7_HASH)) {
+        /*
+         * Verified against a salted adaptive hash instead of SHA-1. The failure branch also no
+         * longer returns the digest of whatever was submitted: that turned the endpoint into a
+         * hashing oracle, confirming both the algorithm and any offline guess for free.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_7_HASH)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. SHA1 is deprecated. it is vulnerable to collision attacks and hashes can be reversed using rainbow tables.",
+                            "Correct! Passwords are stored with a salted adaptive hash, so a"
+                                    + " rainbow table cannot reverse them.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Your input hashed to: "
-                                    + guessHash
-                                    + " — Try looking up the original hash in a rainbow table or use a SHA1 hash cracker!",
-                            false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
@@ -378,33 +337,25 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getSecurePayload
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: This password is hashed with LM. Hash: "
-                                    + LEVEL_8_HASH
-                                    + " — Try to crack it with a LM hashing tool",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
-        // Verify the guess
-        String guessHash = PasswordHashingUtils.lmHash(password);
-        if (guessHash.equals(LEVEL_8_HASH)) {
+        /*
+         * LM is case insensitive, caps at 14 characters and hashes each 7 character half
+         * independently, so it is verified against a salted adaptive hash instead. The failure
+         * branch no longer echoes the digest of the submitted value.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_8_HASH)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. LM is insecure for many reasons. Passwords are not case sensitive and max length is 14 characters. Anything shorter is NULL-padded to 14 bytes."
-                                    + " The password is split in half and a hash is calculated for each half. An attacker only needs to brute-force  7 characters twice, rather than 14 characters."
-                                    + " This makes a 14 character password only twice as strong as a 7 character one."
-                                    + " Try different capitalization to see if it makes a difference ",
+                            "Correct! The password is case sensitive, unbounded in length and"
+                                    + " stored as a single salted adaptive hash.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Your input hashed to: "
-                                    + guessHash
-                                    + " — Try looking up the most common passwords.",
-                            false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
@@ -426,33 +377,25 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getSecurePayload
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: A user's password is stored as an unsalted SHA-256 hash: "
-                                    + LEVEL_9_HASH
-                                    + " — Crack it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
-        String hashGuess = PasswordHashingUtils.unsaltedSha256Hex(password);
-        if (hashGuess.equals(LEVEL_9_HASH)) {
+        /*
+         * SHA-256 is fast and was used unsalted here, so identical passwords produced identical
+         * digests and precomputed tables applied. A salted adaptive hash removes both properties,
+         * and the failure branch no longer returns the digest of the submitted value.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_9_HASH)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. SHA-256 is a strong general-purpose hash, but it is not suitable for password storage."
-                                    + " Because it is fast, attackers can try millions of guesses per second."
-                                    + " Since there is no salt, identical passwords also produce identical hashes,"
-                                    + " making rainbow tables and precomputed attacks possible."
-                                    + " Modern password storage should use slow, adaptive hashing like bcrypt or Argon2.",
+                            "Correct! Each password is salted and hashed with a slow adaptive"
+                                    + " function, so precomputed tables do not apply.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Your input hashed to: "
-                                    + hashGuess
-                                    + " — Try looking up common passwords or using a fast hash cracking tool!",
-                            false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
@@ -474,37 +417,26 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getSecurePayload
         if (password == null || password.isEmpty()) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "CHALLENGE: The password is encrypted using AES-128 encryption using a weak key."
-                                    + " It is secure when implemented correctly, but with a weak/common key without many iterations, the encryption becomes ineffective."
-                                    + " In this challenge, the password is the key that was used to encrypt itself."
-                                    + " The stored password is: "
-                                    + LEVEL_10_CIPHERTEXT
-                                    + " — Crack it and enter the original password!",
-                            false),
+                            "Enter the password to unlock this vault.", false),
                     HttpStatus.OK);
         }
 
-        // Verify the guess
-        String passwordGuess =
-                EncryptionUtils.encrypt(password, EncryptionUtils.getKeyFromPassword(password));
-        if (passwordGuess.equals(LEVEL_10_CIPHERTEXT)) {
+        /*
+         * Encrypting a secret under a key derived from that same secret is not storage, it is a
+         * reversible transform anyone can replay -- and the response both announced that design
+         * and returned the ciphertext of every guess, which is an encryption oracle. Passwords
+         * need a one-way function, so the secret is now held as a salted adaptive hash.
+         */
+        if (PasswordHashingUtils.isValidBcrypt(password, LEVEL_10_CIPHERTEXT)) {
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<>(
-                            "Correct! The password was '"
-                                    + password
-                                    + "'. Even though AES-128 is a secure encryption method it needs the be implemented correctly. "
-                                    + " An insecure key provides zero security as it can make data trivial to decrypt."
-                                    + " Encryption is a two-way function meaning that anyone with the key can recover the password "
-                                    + " Passwords should always be stored using a one-way hashing function (e.g. bcrypt, Argon2) so that even if the database is compromised, the original password cannot be recovered.",
+                            "Correct! Passwords are stored as salted adaptive hashes, so the"
+                                    + " stored value cannot be decrypted back into the password.",
                             true),
                     HttpStatus.OK);
         } else {
             return new ResponseEntity<>(
-                    new GenericVulnerabilityResponseBean<>(
-                            "Incorrect. Your input resulted in: "
-                                    + passwordGuess
-                                    + " — Try looking up common passwords.",
-                            false),
+                    new GenericVulnerabilityResponseBean<>("Incorrect password.", false),
                     HttpStatus.OK);
         }
     }
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/repo/CryptographicFailuresSeeder.java b/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/repo/CryptographicFailuresSeeder.java
index d18824275..89300331f 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/repo/CryptographicFailuresSeeder.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/repo/CryptographicFailuresSeeder.java
@@ -3,8 +3,6 @@
 import java.security.SecureRandom;
 import org.apache.commons.text.RandomStringGenerator;
 import org.sasanlabs.configuration.ModuleSeeder;
-import org.sasanlabs.internal.utility.EncodingUtils;
-import org.sasanlabs.internal.utility.EncryptionUtils;
 import org.sasanlabs.internal.utility.PasswordHashingUtils;
 import org.sasanlabs.internal.utility.exception.EncryptionException;
 import org.springframework.stereotype.Component;
@@ -45,56 +43,55 @@ public CryptographicFailuresSeeder(CryptographicFailuresVaultRepository reposito
     @Override
     @Transactional
     public void seed() throws EncryptionException {
-        try {
-            // Level 1: Cleartext (Broken Cryptography)
-            repository.save(new VaultEntity(1, genPassword(10), "CLEARTEXT"));
-
-            // Level 2: Base64 Encoding (Not Encryption)
-            repository.save(
-                    new VaultEntity(2, EncodingUtils.encodeBase64(genPassword(10)), "BASE64"));
-
-            // Level 3: Caesar Cipher (Weak Symmetric)
-            repository.save(
-                    new VaultEntity(
-                            3, EncryptionUtils.caesarCipher(genAlphaNumPassword(10), 3), "CAESAR"));
-
-            // Level 4: Custom Cipher (Security through Obscurity)
-            repository.save(
-                    new VaultEntity(4, EncryptionUtils.customCipher(genPassword(12)), "CUSTOM"));
-
-            // Level 5: MD4 (Broken Hash)
-            repository.save(new VaultEntity(5, PasswordHashingUtils.md4Hex(genPassword(5)), "MD4"));
-
-            // Level 6: MD5 (Broken Hash)
-            repository.save(new VaultEntity(6, PasswordHashingUtils.md5Hex(genPassword(5)), "MD5"));
-
-            // Level 7: SHA-1 (Weak Hash)
-            repository.save(
-                    new VaultEntity(7, PasswordHashingUtils.sha1Hex(genPassword(10)), "SHA-1"));
-
-            // Level 8: LM Hash (Legacy/Weak Windows Hash)
-            repository.save(new VaultEntity(8, PasswordHashingUtils.lmHash(genPassword(14)), "LM"));
-
-            // Level 9: Unsalted SHA-256 (Fast Hash/Vulnerable to Rainbow Tables)
-            repository.save(
-                    new VaultEntity(
-                            9, PasswordHashingUtils.unsaltedSha256Hex(genPassword(12)), "SHA-256"));
-
-            // Level 10: AES-128 (Weak Key/Password is Key)
-            String level10Secret = "aa123456";
-            String level10Encrypted =
-                    EncryptionUtils.encrypt(
-                            level10Secret, EncryptionUtils.getKeyFromPassword(level10Secret));
-            repository.save(new VaultEntity(10, level10Encrypted, "AES-128"));
-
-            // Level 11: BCrypt (Secure Adaptive Hash)
-            repository.save(
-                    new VaultEntity(
-                            11, PasswordHashingUtils.bCryptHash(genPassword(15)), "BCRYPT"));
-        } catch (EncryptionException e) {
-            throw new EncryptionException(
-                    "CryptographicFailureSeeder failed To seed table - Encryption Error", e);
-        }
+        // Level 1: stored as a BCrypt hash rather than cleartext. A stored password should
+        // never be recoverable from the store at all, only verifiable against a guess.
+        repository.save(
+                new VaultEntity(1, PasswordHashingUtils.bCryptHash(genPassword(10)), "BCRYPT"));
+
+        // Level 2: BCrypt in place of Base64, which is an encoding and not encryption at
+        // all -- anyone holding the stored value recovers the password by decoding it.
+        repository.save(
+                new VaultEntity(2, PasswordHashingUtils.bCryptHash(genPassword(10)), "BCRYPT"));
+
+        // Level 3: BCrypt in place of a Caesar cipher, whose 25 possible shifts fall to
+        // exhaustive search instantly.
+        repository.save(
+                new VaultEntity(
+                        3, PasswordHashingUtils.bCryptHash(genAlphaNumPassword(10)), "BCRYPT"));
+
+        // Level 4: BCrypt in place of a bespoke cipher. A scheme is only as secret as its
+        // source, so obscurity is not a key -- Kerckhoffs's principle.
+        repository.save(
+                new VaultEntity(4, PasswordHashingUtils.bCryptHash(genPassword(12)), "BCRYPT"));
+
+        // Level 5: MD4 (Broken Hash)
+        repository.save(
+                new VaultEntity(5, PasswordHashingUtils.bCryptHash(genPassword(24)), "BCRYPT"));
+
+        // Level 6: MD5 (Broken Hash)
+        repository.save(
+                new VaultEntity(6, PasswordHashingUtils.bCryptHash(genPassword(24)), "BCRYPT"));
+
+        // Level 7: BCrypt in place of SHA-1, which is collision prone and rainbow-tableable
+        repository.save(
+                new VaultEntity(7, PasswordHashingUtils.bCryptHash(genPassword(24)), "BCRYPT"));
+
+        // Level 8: BCrypt in place of the LM hash, which is case insensitive and 14 char capped
+        repository.save(
+                new VaultEntity(8, PasswordHashingUtils.bCryptHash(genPassword(24)), "BCRYPT"));
+
+        // Level 9: BCrypt in place of unsalted SHA-256, which is fast and precomputable
+        repository.save(
+                new VaultEntity(9, PasswordHashingUtils.bCryptHash(genPassword(24)), "BCRYPT"));
+
+        // Level 10: BCrypt in place of AES-128 keyed from the secret itself. Encryption is
+        // reversible by design, so a password store needs a one-way function instead.
+        repository.save(
+                new VaultEntity(10, PasswordHashingUtils.bCryptHash(genPassword(24)), "BCRYPT"));
+
+        // Level 11: BCrypt (Secure Adaptive Hash)
+        repository.save(
+                new VaultEntity(11, PasswordHashingUtils.bCryptHash(genPassword(15)), "BCRYPT"));
     }
 
     public boolean isSeeded() {
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUpload.java b/src/main/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUpload.java
index 0858b29f0..45c085756 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUpload.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUpload.java
@@ -62,9 +62,30 @@ public class UnrestrictedFileUpload {
             Pattern.compile(CONTAINS_PNG_JPEG_REGEX);
     private static final Pattern ENDS_WITH_PNG_OR_JPEG_PATTERN =
             Pattern.compile(CONTAINS_PNG_JPEG_REGEX + "$");
+    private static final long MAX_UPLOAD_SIZE_IN_BYTES = 2L * 1024L * 1024L;
+
     private static final transient Logger LOGGER =
             LogManager.getLogger(UnrestrictedFileUpload.class);
 
+    /**
+     * A name is only safe to hand to {@code root.resolve} when it names a file and nothing else: no
+     * directory separators in either slash direction, no parent reference and no null byte (which
+     * can truncate the name for whatever consumes it downstream).
+     */
+    private static boolean isBareFileName(String fileName) {
+        if (fileName == null || fileName.isEmpty()) {
+            return false;
+        }
+        if (fileName.contains("/")
+                || fileName.contains("\\")
+                || fileName.contains("..")
+                || fileName.contains(Constants.NULL_BYTE_CHARACTER)) {
+            return false;
+        }
+        Path trailingElement = Paths.get(fileName).getFileName();
+        return trailingElement != null && trailingElement.toString().equals(fileName);
+    }
+
     public UnrestrictedFileUpload() throws IOException, URISyntaxException {
         URI uploadDirectoryURI;
         try {
@@ -112,12 +133,48 @@ public UnrestrictedFileUpload() throws IOException, URISyntaxException {
                     boolean htmlEncode,
                     boolean isContentDisposition)
                     throws IOException {
+        /*
+         * Every per-level validator is a blocklist of extensions to reject, and each loses to
+         * a variant it did not anticipate: .htm for .html, a different case, or
+         * "malicious.png.html" against a check that only looks for png/jpeg anywhere in the
+         * name. The name must instead END with an allowed image extension so nothing the
+         * server would serve as markup or script can be written.
+         *
+         * The content-disposition levels are deliberately excluded: they serve uploads as an
+         * attachment rather than inline, and legitimately accept non-image files.
+         */
+        if (!isContentDisposition
+                && (fileName == null
+                        || !ENDS_WITH_PNG_OR_JPEG_PATTERN
+                                .matcher(fileName.toLowerCase())
+                                .matches())) {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<String>("Input is invalid", false),
+                    HttpStatus.OK);
+        }
+        /*
+         * The name is written straight into root.resolve(...), so it has to be a bare file name.
+         * "../../evil.png" satisfies an extension check yet still escapes the upload directory,
+         * and the content-disposition levels skipped the extension check altogether. Comparing
+         * against the trailing path element rejects any separator or parent reference.
+         */
+        if (!isBareFileName(fileName)) {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<String>("Input is invalid", false),
+                    HttpStatus.OK);
+        }
+        // An upload with no size ceiling lets one request exhaust the disk.
+        if (file.getSize() > MAX_UPLOAD_SIZE_IN_BYTES) {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<String>(
+                            "Input is invalid: file exceeds the maximum permitted size", false),
+                    HttpStatus.OK);
+        }
         if (validator.get()) {
             Files.copy(
                     file.getInputStream(),
                     root.resolve(fileName),
                     StandardCopyOption.REPLACE_EXISTING);
-            String uploadedFileLocation;
             String input =
                     FrameworkConstants.VULNERABLE_APP
                             + FrameworkConstants.SLASH
@@ -126,11 +183,12 @@ public UnrestrictedFileUpload() throws IOException, URISyntaxException {
                                     : STATIC_FILE_LOCATION)
                             + FrameworkConstants.SLASH
                             + fileName;
-            if (htmlEncode) {
-                uploadedFileLocation = StringEscapeUtils.escapeHtml4(input);
-            } else {
-                uploadedFileLocation = input;
-            }
+            /*
+             * The location echoes the caller's own file name back, so it is escaped on every
+             * level rather than only where htmlEncode was set. A name such as
+             * "<img src=x onerror=alert(1)>.png" passes an extension check untouched.
+             */
+            String uploadedFileLocation = StringEscapeUtils.escapeHtml4(input);
             return new ResponseEntity<>(
                     new GenericVulnerabilityResponseBean<String>(uploadedFileLocation, true),
                     HttpStatus.OK);
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
index d23f59e2e..215340506 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
@@ -77,15 +77,17 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level1(
         String actualToken = cookieToken;
         try {
             if (actualToken != null) {
-                idorLoginService.decodeToken(actualToken);
-                if (id != null) {
-                    User profile = fetchUserById(id);
-                    if (profile == null) {
-                        return response(USER_NOT_FOUND, false);
-                    }
-                    return response(profile, true);
+                User decodedUser = idorLoginService.decodeToken(actualToken);
+                int tokenUserId = decodedUser.getUserId();
+                // The requested id is only a hint: a caller may read their own record and no other.
+                if (id != null && id != tokenUserId) {
+                    return response(ACCESS_DENIED_INSUFFICIENT, false);
                 }
-                return response(USER_NOT_FOUND, false);
+                User profile = fetchUserById(tokenUserId);
+                if (profile == null) {
+                    return response(USER_NOT_FOUND, false);
+                }
+                return response(profile, true);
             }
 
             return response(PROVIDE_LOGIN_OR_TOKEN, false);
@@ -116,8 +118,10 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level2(
         String actualToken = cookieToken;
         try {
             if (actualToken != null && loggedInUser != null) {
-                idorLoginService.decodeToken(actualToken);
-                User profile = fetchUserById(loggedInUser);
+                // The userId cookie is attacker controlled, so the identity comes from the signed
+                // token instead.
+                User decodedUser = idorLoginService.decodeToken(actualToken);
+                User profile = fetchUserById(decodedUser.getUserId());
                 if (profile == null) {
                     return response(USER_NOT_FOUND, false);
                 }
@@ -155,7 +159,11 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level3(
             if (actualToken != null) {
                 User decodedUser = idorLoginService.decodeToken(actualToken);
                 int tokenUserId = decodedUser.getUserId();
-                String role = cookieRole != null ? cookieRole : decodedUser.getRole();
+                // The role cookie is discarded: the authoritative role lives in the database.
+                String role = fetchRoleById(tokenUserId);
+                if (role == null) {
+                    return response(INVALID_USER, false);
+                }
 
                 if (id == null) {
                     id = tokenUserId;
@@ -204,7 +212,12 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level4(
             if (actualToken != null) {
                 User decodedUser = idorLoginService.decodeToken(actualToken);
                 int tokenUserId = decodedUser.getUserId();
-                String role = cookieRole != null ? decodeBase64(cookieRole) : decodedUser.getRole();
+                // Base64 is an encoding, not a signature, so the encoded role cookie is discarded
+                // in favour of the stored role.
+                String role = fetchRoleById(tokenUserId);
+                if (role == null) {
+                    return response(INVALID_USER, false);
+                }
 
                 if (id == null) {
                     id = tokenUserId;
@@ -245,18 +258,12 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level5(
                 User decodedUser = idorLoginService.decodeToken(actualToken);
                 int tokenUserId = decodedUser.getUserId();
 
-                List<String> roles =
-                        jdbcTemplate.query(
-                                SQL_ROLE_BY_ID,
-                                new Object[] {tokenUserId},
-                                (rs, rowNum) -> rs.getString("role"));
+                String actualRole = fetchRoleById(tokenUserId);
 
-                if (roles.isEmpty()) {
+                if (actualRole == null) {
                     return response(INVALID_USER, false, HttpStatus.NOT_FOUND);
                 }
 
-                String actualRole = roles.get(0);
-
                 if (ROLE_ADMIN.equalsIgnoreCase(actualRole) || tokenUserId == id) {
                     User profile = fetchUserById(id);
                     if (profile == null) {
@@ -293,6 +300,18 @@ private User fetchUserById(int id) {
         return users.get(0);
     }
 
+    /** Reads the role the server actually stores for a user, ignoring anything the client sent. */
+    private String fetchRoleById(int id) {
+        List<String> roles =
+                jdbcTemplate.query(
+                        SQL_ROLE_BY_ID, new Object[] {id}, (rs, rowNum) -> rs.getString("role"));
+
+        if (roles.isEmpty()) {
+            return null;
+        }
+        return roles.get(0);
+    }
+
     private List<User> fetchAllUsers() {
         return jdbcTemplate.query(
                 SQL_ALL_PROFILES,
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/jwt/IJWTValidator.java b/src/main/java/org/sasanlabs/service/vulnerability/jwt/IJWTValidator.java
index e358b50e1..db32a3630 100755
--- a/src/main/java/org/sasanlabs/service/vulnerability/jwt/IJWTValidator.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/jwt/IJWTValidator.java
@@ -94,7 +94,7 @@ boolean confusionAlgorithmVulnerableValidator(String token, Key key)
      * @throws UnsupportedEncodingException
      * @throws JSONException
      */
-    boolean jwkKeyHeaderPublicKeyTrustingVulnerableValidator(String token)
+    boolean jwkKeyHeaderPublicKeyTrustingVulnerableValidator(String token, Key trustedKey)
             throws ServiceApplicationException;
 
     /**
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java
index 377dc9fd6..399d25ac6 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerability.java
@@ -3,16 +3,20 @@
 import static org.sasanlabs.service.vulnerability.jwt.bean.JWTUtils.GENERIC_BASE64_ENCODED_PAYLOAD;
 
 import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
 import java.security.KeyPair;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.Arrays;
+import java.util.Base64;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.regex.Pattern;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.json.JSONObject;
 import org.sasanlabs.internal.utility.LevelConstants;
 import org.sasanlabs.internal.utility.annotations.AttackVector;
 import org.sasanlabs.internal.utility.annotations.VulnerableAppRequestMapping;
@@ -60,6 +64,107 @@ public class JWTVulnerability {
     static final String JWT = "JWT";
     static final String JWT_COOKIE_KEY = JWT + "=";
 
+    /**
+     * {@code HttpOnly} keeps the token out of reach of script, so an XSS foothold cannot read it;
+     * {@code Secure} keeps it off plaintext HTTP; and {@code SameSite=Strict} stops it riding along
+     * with cross-site requests. A session cookie needs all three, not just the first.
+     */
+    static final String SECURE_COOKIE_ATTRIBUTES = "; HttpOnly; Secure; SameSite=Strict";
+
+    private static final String COOKIE_SEPARATOR_REGEX = ";";
+
+    /**
+     * A {@code Cookie} header carries every cookie the client holds, separated by {@code ; }.
+     * Splitting the whole header on {@code =} and testing only the first field meant the token was
+     * found only when {@code JWT} happened to be sent first -- any other cookie ahead of it hid the
+     * token completely, and the request fell through to being handed a fresh one. Each name/value
+     * pair is now parsed on its own, so the token is located wherever in the header it appears.
+     */
+    private Optional<String> getJWTFromCookieHeader(RequestEntity<Void> requestEntity) {
+        List<String> cookieHeaders = requestEntity.getHeaders().get(HttpHeaders.COOKIE);
+        if (cookieHeaders == null) {
+            return Optional.empty();
+        }
+        for (String cookieHeader : cookieHeaders) {
+            for (String cookie : cookieHeader.split(COOKIE_SEPARATOR_REGEX)) {
+                String trimmedCookie = cookie.trim();
+                int nameValueSeparator = trimmedCookie.indexOf('=');
+                if (nameValueSeparator > 0
+                        && JWT.equals(trimmedCookie.substring(0, nameValueSeparator))) {
+                    return Optional.of(trimmedCookie.substring(nameValueSeparator + 1));
+                }
+            }
+        }
+        return Optional.empty();
+    }
+
+    /**
+     * A cookie value may only contain the octets RFC 6265 calls {@code cookie-octet}. Anything
+     * outside that set -- above all {@code CR} and {@code LF} -- lets a caller who controls the
+     * token end the {@code Set-Cookie} line and dictate the response headers that follow it.
+     */
+    private static final Pattern COOKIE_OCTETS =
+            Pattern.compile("[\\x21\\x23-\\x2B\\x2D-\\x3A\\x3C-\\x5B\\x5D-\\x7E]*");
+
+    /**
+     * The token is written back under its own name. Echoing the client's whole {@code Cookie}
+     * header into {@code Set-Cookie} reflected unrelated cookies -- and their values -- into a
+     * response header, and produced an attribute list attached to the wrong cookie as soon as more
+     * than one was sent, so the security attributes protected nothing.
+     *
+     * <p>The value is also echoed straight back from the request, so it is checked against the
+     * grammar before it is written. A token carrying a header separator is dropped rather than
+     * reflected: no {@code Set-Cookie} at all is safer than one the caller composed.
+     */
+    private MultiValueMap<String, String> getSetCookieHeader(
+            String token, String cookieAttributes) {
+        Map<String, List<String>> headers = new HashMap<>();
+        if (token != null && COOKIE_OCTETS.matcher(token).matches()) {
+            headers.put(
+                    HttpHeaders.SET_COOKIE,
+                    Arrays.asList(JWT_COOKIE_KEY + token + cookieAttributes));
+        }
+        return CollectionUtils.toMultiValueMap(headers);
+    }
+
+    /**
+     * A token that cannot be parsed at all is simply not a valid token. {@code
+     * genericJWTTokenValidator} raises on malformed input rather than returning false, and an
+     * unhandled raise becomes a 500 -- which tells a caller more about the internals than a plain
+     * rejection does, and hides the authorization decision the endpoint exists to make.
+     */
+    private boolean isValidRsaToken(String token, java.security.Key key) {
+        try {
+            return jwtValidator.genericJWTTokenValidator(token, key, "RS256");
+        } catch (ServiceApplicationException | RuntimeException e) {
+            LOGGER.info("Rejected an unparseable JWT: {}", e.getClass().getSimpleName());
+            return false;
+        }
+    }
+
+    /**
+     * A JWT is three dot separated base64url segments and nothing else. Every level accepted any
+     * string at all and simply let verification fail on it, which handles the input safely but
+     * never refuses it. Input that is not of the expected type is rejected outright here, before
+     * any parsing or key lookup is attempted.
+     */
+    private static final int MAX_TOKEN_LENGTH = 4096;
+
+    private static final Pattern JWT_FORMAT =
+            Pattern.compile("[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]*");
+
+    private boolean isWellFormedToken(String token) {
+        return token != null
+                && !token.isEmpty()
+                && token.length() <= MAX_TOKEN_LENGTH
+                && JWT_FORMAT.matcher(token).matches();
+    }
+
+    private ResponseEntity<GenericVulnerabilityResponseBean<String>> malformedTokenResponse() {
+        return new ResponseEntity<GenericVulnerabilityResponseBean<String>>(
+                new GenericVulnerabilityResponseBean<String>(null, false), HttpStatus.BAD_REQUEST);
+    }
+
     public JWTVulnerability(
             IJWTTokenGenerator libBasedJWTGenerator,
             IJWTValidator jwtValidator,
@@ -69,6 +174,32 @@ public JWTVulnerability(
         this.jwtAlgorithmKMS = jwtAlgorithmKMS;
     }
 
+    /**
+     * The algorithm a token is verified with must be chosen by the server, never read from the
+     * token. A caller who can nominate the algorithm can downgrade it -- or drop it entirely with
+     * {@code alg: none} -- so any token whose header does not name the expected algorithm is
+     * rejected before its signature is even considered.
+     */
+    private boolean isExpectedAlgorithm(String token, String expectedAlgorithm) {
+        try {
+            String[] jwtParts = token.split(JWTUtils.JWT_TOKEN_PERIOD_CHARACTER_REGEX, -1);
+            if (jwtParts.length != 3) {
+                return false;
+            }
+            JSONObject header =
+                    new JSONObject(
+                            JWTUtils.getString(
+                                    Base64.getUrlDecoder()
+                                            .decode(jwtParts[0].getBytes(StandardCharsets.UTF_8))));
+            return header.has(JWTUtils.JWT_ALGORITHM_KEY_HEADER)
+                    && expectedAlgorithm.equals(
+                            header.getString(JWTUtils.JWT_ALGORITHM_KEY_HEADER));
+        } catch (RuntimeException | UnsupportedEncodingException e) {
+            LOGGER.warn("Could not read the algorithm from the submitted JWT header");
+            return false;
+        }
+    }
+
     private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseBean(
             boolean isValid,
             String jwtToken,
@@ -99,28 +230,48 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
             value = LevelConstants.LEVEL_1,
             htmlTemplate = "LEVEL_1/JWT_Level1")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>>
-            getVulnerablePayloadLevelUnsecure(@RequestParam Map<String, String> queryParams)
+            getVulnerablePayloadLevelUnsecure(
+                    RequestEntity<Void> requestEntity,
+                    @RequestParam Map<String, String> queryParams)
                     throws UnsupportedEncodingException, ServiceApplicationException {
         Optional<SymmetricAlgorithmKey> symmetricAlgorithmKey =
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        String token = queryParams.get(JWT);
-        if (token != null) {
+        /*
+         * The token used to be read from, and echoed back into, the query string. A URL is the
+         * least private place to put a credential: it lands in browser history, Referer headers,
+         * proxy and server access logs, and anything that shares a link. It now travels in a
+         * cookie instead, and is never written into the response body.
+         */
+        if (queryParams.containsKey(JWT)) {
+            /*
+             * A token in the query string is refused outright rather than quietly ignored.
+             * Ignoring it would leave a forged token looking accepted -- the request would still
+             * succeed -- so the rejection has to be explicit for the caller to learn anything.
+             */
+            return this.getJWTResponseBean(false, null, false, null);
+        }
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
+        if (submittedToken.isPresent()) {
             boolean isValid =
                     jwtValidator.customHMACValidator(
-                            token,
-                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-            return this.getJWTResponseBean(isValid, token, !isValid, null);
-        } else {
-            token =
-                    libBasedJWTGenerator.getHMACSignedJWTToken(
-                            JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
+                            submittedToken.get(),
                             JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                             JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-            return this.getJWTResponseBean(true, token, true, null);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    false,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
+        String token =
+                libBasedJWTGenerator.getHMACSignedJWTToken(
+                        JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
+                        JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+        return this.getJWTResponseBean(
+                true, token, false, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -138,28 +289,22 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.customHMACValidator(
-                                    cookieKeyValue[1],
-                                    JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    false,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
@@ -167,12 +312,13 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        /*
+         * The token is handed over in the cookie alone. Marking a cookie HttpOnly and then
+         * printing the same token into the response body gives it straight back to script,
+         * which is the exposure the attribute exists to prevent.
+         */
+        return this.getJWTResponseBean(
+                true, token, false, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -190,40 +336,30 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.customHMACValidator(
-                                    cookieKeyValue[1],
-                                    JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    false,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
         String token =
                 libBasedJWTGenerator.getHMACSignedJWTToken(
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, false, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -242,30 +378,24 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                     throws UnsupportedEncodingException, ServiceApplicationException {
         Optional<SymmetricAlgorithmKey> symmetricAlgorithmKey =
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
-                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.LOW);
+                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.customHMACValidator(
-                                    cookieKeyValue[1],
-                                    JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
@@ -273,12 +403,8 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -299,28 +425,22 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.customHMACNullByteVulnerableValidator(
-                                    cookieKeyValue[1],
-                                    JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
@@ -328,12 +448,8 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -355,28 +471,22 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.customHMACNoneAlgorithmVulnerableValidator(
-                                    cookieKeyValue[1],
-                                    JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
@@ -384,12 +494,8 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     // This is a special vulnerability only for scanners as scanners generally don't touch
@@ -412,10 +518,10 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
         List<String> tokens = requestEntity.getHeaders().get(HttpHeaders.AUTHORIZATION);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
+        if (!isFetch && tokens != null) {
             for (String token : tokens) {
                 boolean isValid =
-                        jwtValidator.customHMACNoneAlgorithmVulnerableValidator(
+                        jwtValidator.customHMACValidator(
                                 token,
                                 JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                                 JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
@@ -459,40 +565,28 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                 jwtAlgorithmKMS.getAsymmetricAlgorithmKey("RS256");
         LOGGER.info(
                 asymmetricAlgorithmKeyPair.isPresent() + " " + asymmetricAlgorithmKeyPair.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.confusionAlgorithmVulnerableValidator(
-                                    cookieKeyValue[1],
-                                    asymmetricAlgorithmKeyPair.get().getPublic());
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    this.isValidRsaToken(
+                            submittedToken.get(), asymmetricAlgorithmKeyPair.get().getPublic());
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
                 libBasedJWTGenerator.getJWTToken_RS256(
                         JWTUtils.RS256_TOKEN_TO_BE_SIGNED,
                         asymmetricAlgorithmKeyPair.get().getPrivate());
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -514,37 +608,27 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                 jwtAlgorithmKMS.getAsymmetricAlgorithmKey("RS256");
         LOGGER.info(
                 asymmetricAlgorithmKeyPair.isPresent() + " " + asymmetricAlgorithmKeyPair.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.jwkKeyHeaderPublicKeyTrustingVulnerableValidator(
-                                    cookieKeyValue[1]);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    this.isValidRsaToken(
+                            submittedToken.get(), asymmetricAlgorithmKeyPair.get().getPublic());
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
                 libBasedJWTGenerator.getJWTTokenWithJWKHeader_RS256(
                         GENERIC_BASE64_ENCODED_PAYLOAD, asymmetricAlgorithmKeyPair.get());
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -565,28 +649,22 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.customHMACEmptyTokenVulnerableValidator(
-                                    cookieKeyValue[1],
-                                    symmetricAlgorithmKey.get().getKey(),
-                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
@@ -594,12 +672,8 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     // Commented for now because this is not fully developed
@@ -622,32 +696,26 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
                     RequestEntity<Void> requestEntity,
                     @RequestParam Map<String, String> queryParams)
                     throws UnsupportedEncodingException, ServiceApplicationException {
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    RSAPublicKey rsaPublicKey =
-                            JWTUtils.getRSAPublicKeyFromProvidedPEMFilePath(
-                                    this.getClass()
-                                            .getClassLoader()
-                                            .getResourceAsStream(
-                                                    JWTUtils.KEYS_LOCATION + "public_crt.pem"));
-                    boolean isValid =
-                            this.jwtValidator.genericJWTTokenValidator(
-                                    cookieKeyValue[1], rsaPublicKey, "RS256");
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            RSAPublicKey rsaPublicKey =
+                    JWTUtils.getRSAPublicKeyFromProvidedPEMFilePath(
+                            this.getClass()
+                                    .getClassLoader()
+                                    .getResourceAsStream(
+                                            JWTUtils.KEYS_LOCATION + "public_crt.pem"));
+            boolean isValid =
+                    this.jwtValidator.genericJWTTokenValidator(
+                            submittedToken.get(), rsaPublicKey, "RS256");
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
         RSAPrivateKey rsaPrivateKey =
                 JWTUtils.getRSAPrivateKeyFromProvidedPEMFilePath(
@@ -657,12 +725,8 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> getJWTResponseB
         String token =
                 libBasedJWTGenerator.getJWTToken_RS256(
                         JWTUtils.RS256_TOKEN_TO_BE_SIGNED, rsaPrivateKey);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     @AttackVector(
@@ -678,36 +742,26 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjecti
                 jwtAlgorithmKMS.getAsymmetricAlgorithmKey("RS256");
         LOGGER.info(
                 asymmetricAlgorithmKeyPair.isPresent() + " " + asymmetricAlgorithmKeyPair.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.jwkKeyHeaderPublicKeyTrustingVulnerableValidator(
-                                    cookieKeyValue[1]);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    this.isValidRsaToken(
+                            submittedToken.get(), asymmetricAlgorithmKeyPair.get().getPublic());
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
         String token =
                 libBasedJWTGenerator.getJWTTokenWithJWKHeader_RS256(
                         GENERIC_BASE64_ENCODED_PAYLOAD, asymmetricAlgorithmKeyPair.get());
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     // Very weak HMAC key vulnerability - using extremely short key
@@ -725,30 +779,24 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjecti
         // Using very weak key (only 4 bytes) - extremely vulnerable
         Optional<SymmetricAlgorithmKey> symmetricAlgorithmKey =
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
-                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.LOW);
+                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    boolean isValid =
-                            jwtValidator.customHMACValidator(
-                                    cookieKeyValue[1],
-                                    JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
@@ -756,12 +804,8 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjecti
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     // Missing signature verification - accepts unsigned tokens
@@ -776,29 +820,30 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjecti
                     RequestEntity<Void> requestEntity,
                     @RequestParam Map<String, String> queryParams)
                     throws UnsupportedEncodingException, ServiceApplicationException {
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    // Vulnerable: Not verifying signature, just checking if token format is valid
-                    String[] parts = cookieKeyValue[1].split("\\.");
-                    if (parts.length == 3) {
-                        // Token has 3 parts (header.payload.signature) but signature is not
-                        // verified
-                        Map<String, List<String>> headers = new HashMap<>();
-                        headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                                this.getJWTResponseBean(
-                                        true,
-                                        token,
-                                        false,
-                                        CollectionUtils.toMultiValueMap(headers));
-                        return responseEntity;
-                    }
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            /*
+             * A token's shape proves nothing. Counting three dot separated parts
+             * accepted any self-issued token, so the signature is now actually
+             * verified against the server's key before the caller is trusted.
+             */
+            Optional<SymmetricAlgorithmKey> validationKey =
+                    jwtAlgorithmKMS.getSymmetricAlgorithmKey(
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
+            boolean isValid =
+                    jwtValidator.customHMACValidator(
+                            submittedToken.get(),
+                            JWTUtils.getBytes(validationKey.get().getKey()),
+                            JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    !isValid,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         Optional<SymmetricAlgorithmKey> symmetricAlgorithmKey =
@@ -809,12 +854,8 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjecti
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, true, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 
     // Algorithm downgrade vulnerability - accepts weaker algorithms
@@ -833,36 +874,29 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjecti
                 jwtAlgorithmKMS.getSymmetricAlgorithmKey(
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, KeyStrength.HIGH);
         LOGGER.info(symmetricAlgorithmKey.isPresent() + " " + symmetricAlgorithmKey.get());
-        List<String> tokens = requestEntity.getHeaders().get("cookie");
+        Optional<String> submittedToken = this.getJWTFromCookieHeader(requestEntity);
         boolean isFetch = Boolean.valueOf(queryParams.get("fetch"));
-        if (!isFetch) {
-            for (String token : tokens) {
-                String[] cookieKeyValue = token.split(JWTUtils.BASE64_PADDING_CHARACTER_REGEX);
-                if (cookieKeyValue[0].equals(JWT)) {
-                    // Vulnerable: Accepts multiple weak algorithms (HS256, HS384, HS512) without
-                    // enforcing strong algorithm
-                    boolean isValid = false;
-                    try {
-                        isValid =
-                                jwtValidator.customHMACValidator(
-                                        cookieKeyValue[1],
-                                        JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
-                                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-                    } catch (Exception e) {
-                        // Try with other weak algorithms - vulnerable behavior
-                        LOGGER.warn("Failed to validate with HS256, trying other algorithms");
-                    }
-                    Map<String, List<String>> headers = new HashMap<>();
-                    headers.put("Set-Cookie", Arrays.asList(token + "; httponly"));
-                    ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                            this.getJWTResponseBean(
-                                    isValid,
-                                    token,
-                                    !isValid,
-                                    CollectionUtils.toMultiValueMap(headers));
-                    return responseEntity;
-                }
+        if (!isFetch && submittedToken.isPresent()) {
+            if (!isWellFormedToken(submittedToken.get())) {
+                return malformedTokenResponse();
             }
+            /*
+             * The expected algorithm is pinned to HS256 and checked against the token's own
+             * header first. Falling back through a list of weaker algorithms let a caller pick
+             * the one they could forge.
+             */
+            boolean isValid =
+                    this.isExpectedAlgorithm(
+                                    submittedToken.get(), JWTUtils.JWT_HMAC_SHA_256_ALGORITHM)
+                            && jwtValidator.customHMACValidator(
+                                    submittedToken.get(),
+                                    JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
+                                    JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+            return this.getJWTResponseBean(
+                    isValid,
+                    submittedToken.get(),
+                    false,
+                    this.getSetCookieHeader(submittedToken.get(), SECURE_COOKIE_ATTRIBUTES));
         }
 
         String token =
@@ -870,11 +904,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getHeaderInjecti
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         JWTUtils.getBytes(symmetricAlgorithmKey.get().getKey()),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        Map<String, List<String>> headers = new HashMap<>();
-        headers.put("Set-Cookie", Arrays.asList(JWT_COOKIE_KEY + token + "; httponly"));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> responseEntity =
-                this.getJWTResponseBean(
-                        true, token, true, CollectionUtils.toMultiValueMap(headers));
-        return responseEntity;
+        return this.getJWTResponseBean(
+                true, token, false, this.getSetCookieHeader(token, SECURE_COOKIE_ATTRIBUTES));
     }
 }
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidator.java b/src/main/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidator.java
index d019006a2..2bc2e3328 100755
--- a/src/main/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidator.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidator.java
@@ -2,20 +2,15 @@
 
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.JWSVerifier;
-import com.nimbusds.jose.crypto.ECDSAVerifier;
-import com.nimbusds.jose.crypto.Ed25519Verifier;
 import com.nimbusds.jose.crypto.RSASSAVerifier;
-import com.nimbusds.jose.jwk.ECKey;
-import com.nimbusds.jose.jwk.OctetKeyPair;
-import com.nimbusds.jose.jwk.RSAKey;
 import com.nimbusds.jwt.SignedJWT;
 import java.io.UnsupportedEncodingException;
-import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.security.Key;
 import java.security.interfaces.RSAPublicKey;
 import java.text.ParseException;
 import java.util.Base64;
+import javax.crypto.SecretKey;
 import org.json.JSONObject;
 import org.sasanlabs.service.exception.ExceptionStatusCodeEnum;
 import org.sasanlabs.service.exception.ServiceApplicationException;
@@ -63,30 +58,16 @@ public boolean customHMACValidator(String token, byte[] key, String algorithm)
     @Override
     public boolean customHMACNullByteVulnerableValidator(String token, byte[] key, String algorithm)
             throws ServiceApplicationException {
-        try {
-            String[] jwtParts = token.split(JWTUtils.JWT_TOKEN_PERIOD_CHARACTER_REGEX, -1);
-            if (jwtParts.length < 3) {
-                return false;
-            }
-            int nullByteIndex =
-                    jwtParts[2].indexOf(
-                            URLEncoder.encode(
-                                    String.valueOf((char) 0), StandardCharsets.UTF_8.name()));
-            if (nullByteIndex > 0) {
-                jwtParts[2] = jwtParts[2].substring(0, nullByteIndex);
-            }
-            return this.customHMACValidator(
-                    jwtParts[0]
-                            + JWTUtils.JWT_TOKEN_PERIOD_CHARACTER
-                            + jwtParts[1]
-                            + JWTUtils.JWT_TOKEN_PERIOD_CHARACTER
-                            + jwtParts[2],
-                    key,
-                    algorithm);
-        } catch (UnsupportedEncodingException ex) {
-            throw new ServiceApplicationException(
-                    "Following exception occurred: ", ex, ExceptionStatusCodeEnum.SYSTEM_ERROR);
+        String[] jwtParts = token.split(JWTUtils.JWT_TOKEN_PERIOD_CHARACTER_REGEX, -1);
+        if (jwtParts.length < 3) {
+            return false;
         }
+        /*
+         * The signature is verified exactly as presented. Truncating it at a null byte
+         * let an attacker append arbitrary data after a valid signature, so
+         * "<valid-signature>%00<anything>" was accepted as authentic.
+         */
+        return this.customHMACValidator(token, key, algorithm);
     }
 
     @Override
@@ -101,8 +82,13 @@ public boolean customHMACNoneAlgorithmVulnerableValidator(
                                             .decode(jwtParts[0].getBytes(StandardCharsets.UTF_8))));
             if (header.has(JWTUtils.JWT_ALGORITHM_KEY_HEADER)) {
                 String alg = header.getString(JWTUtils.JWT_ALGORITHM_KEY_HEADER);
+                /*
+                 * An "alg: none" token carries no signature at all. Accepting it meant any
+                 * caller could forge arbitrary claims, so it is rejected outright rather
+                 * than treated as valid.
+                 */
                 if (JWTUtils.NONE_ALGORITHM.contentEquals(alg.toLowerCase())) {
-                    return true;
+                    return false;
                 }
             }
             return this.customHMACValidator(token, key, algorithm);
@@ -148,6 +134,17 @@ public boolean confusionAlgorithmVulnerableValidator(String token, Key key)
                                             .decode(jwtParts[0].getBytes(StandardCharsets.UTF_8))));
             if (header.has(JWTUtils.JWT_ALGORITHM_KEY_HEADER)) {
                 String alg = header.getString(JWTUtils.JWT_ALGORITHM_KEY_HEADER);
+                /*
+                 * The algorithm must be decided by the key the server holds, never by the
+                 * token. Taking "alg" from the header allowed algorithm confusion: an RSA
+                 * public key is public, so an attacker could switch alg to HS256 and sign
+                 * with that key as if it were an HMAC secret.
+                 */
+                boolean headerClaimsHmac = alg.startsWith(JWTUtils.JWT_HMAC_ALGORITHM_IDENTIFIER);
+                boolean keyIsHmac = key instanceof SecretKey;
+                if (headerClaimsHmac != keyIsHmac) {
+                    return false;
+                }
                 return this.genericJWTTokenValidator(token, key, alg);
             }
         } catch (UnsupportedEncodingException ex) {
@@ -158,59 +155,38 @@ public boolean confusionAlgorithmVulnerableValidator(String token, Key key)
     }
 
     @Override
-    public boolean jwkKeyHeaderPublicKeyTrustingVulnerableValidator(String token)
+    public boolean jwkKeyHeaderPublicKeyTrustingVulnerableValidator(String token, Key trustedKey)
             throws ServiceApplicationException {
         try {
-            String[] jwtParts = token.split(JWTUtils.JWT_TOKEN_PERIOD_CHARACTER_REGEX, -1);
-            JSONObject header =
-                    new JSONObject(
-                            JWTUtils.getString(
-                                    Base64.getUrlDecoder()
-                                            .decode(jwtParts[0].getBytes(StandardCharsets.UTF_8))));
-            if (header.has(JWTUtils.JWT_ALGORITHM_KEY_HEADER)) {
-                String alg = header.getString(JWTUtils.JWT_ALGORITHM_KEY_HEADER);
-                if (!alg.startsWith(JWTUtils.JWT_HMAC_ALGORITHM_IDENTIFIER)) {
-                    JWSVerifier verifier = null;
-                    if (header.has(JWTUtils.JSON_WEB_KEY_HEADER)) {
-                        if (alg.startsWith(JWTUtils.JWT_RSA_ALGORITHM_IDENTIFIER)
-                                || alg.startsWith(JWTUtils.JWT_RSA_PSS_ALGORITHM_IDENTIFIER)) {
-                            RSAKey rsaKey =
-                                    RSAKey.parse(
-                                            header.getJSONObject(JWTUtils.JSON_WEB_KEY_HEADER)
-                                                    .toString());
-                            verifier = new RSASSAVerifier(rsaKey.toRSAPublicKey());
-                        } else if (alg.startsWith(JWTUtils.JWT_EC_ALGORITHM_IDENTIFIER)) {
-                            ECKey ecKey =
-                                    ECKey.parse(
-                                            header.getJSONObject(JWTUtils.JSON_WEB_KEY_HEADER)
-                                                    .toString());
-                            verifier = new ECDSAVerifier(ecKey.toECPublicKey());
-                        } else if (alg.startsWith(JWTUtils.JWT_OCTET_ALGORITHM_IDENTIFIER)) {
-                            verifier =
-                                    new Ed25519Verifier(
-                                            OctetKeyPair.parse(
-                                                    header.getString(
-                                                            JWTUtils.JSON_WEB_KEY_HEADER)));
-                        }
-                        SignedJWT signedJWT = SignedJWT.parse(token);
-                        return signedJWT.verify(verifier);
-                    }
-                }
+            /*
+             * The "jwk" header is ignored entirely. A key carried inside the token proves
+             * nothing: an attacker can generate their own key pair, sign the token with the
+             * private key and embed the matching public key, and the signature then verifies
+             * perfectly. Only the key the server already holds is trusted.
+             */
+            if (!(trustedKey instanceof RSAPublicKey)) {
+                return false;
             }
-        } catch (UnsupportedEncodingException | ParseException | JOSEException ex) {
-            throw new ServiceApplicationException(
-                    "Following exception occurred: ", ex, ExceptionStatusCodeEnum.SYSTEM_ERROR);
+            SignedJWT signedJWT = SignedJWT.parse(token);
+            return signedJWT.verify(new RSASSAVerifier((RSAPublicKey) trustedKey));
+        } catch (ParseException | JOSEException ex) {
+            // A token that cannot be parsed or verified is simply not valid; surfacing it as
+            // a system error would turn a rejected credential into a 500.
+            return false;
         }
-        return false;
     }
 
     @Override
     public boolean customHMACEmptyTokenVulnerableValidator(
             String token, String key, String algorithm) throws ServiceApplicationException {
         try {
-            String[] jwtParts = token.split(JWTUtils.JWT_TOKEN_PERIOD_CHARACTER_REGEX);
-            if (jwtParts.length == 0) {
-                return true;
+            String[] jwtParts = token.split(JWTUtils.JWT_TOKEN_PERIOD_CHARACTER_REGEX, -1);
+            /*
+             * A token must have all three parts and a non-empty signature. Returning true
+             * for a token with no parts accepted an empty credential as valid.
+             */
+            if (jwtParts.length != 3 || jwtParts[2].isEmpty()) {
+                return false;
             } else {
                 JSONObject header =
                         new JSONObject(
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/JWTAlgorithmKMS.java b/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/JWTAlgorithmKMS.java
index 660fd7b16..b93e76ca6 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/JWTAlgorithmKMS.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/JWTAlgorithmKMS.java
@@ -3,15 +3,11 @@
 import com.fasterxml.jackson.core.type.TypeReference;
 import java.io.IOException;
 import java.io.InputStream;
-import java.security.Key;
 import java.security.KeyPair;
-import java.security.KeyStore;
-import java.security.KeyStoreException;
+import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
-import java.security.PrivateKey;
-import java.security.UnrecoverableKeyException;
-import java.security.cert.Certificate;
-import java.security.cert.CertificateException;
+import java.security.SecureRandom;
+import java.util.Base64;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Optional;
@@ -54,9 +50,30 @@ public JWTAlgorithmKMS() {
         } catch (IOException e) {
             LOGGER.error("Following error occurred while parsing SymmetricAlgoKeys", e);
         }
+        replaceShippedKeysWithRandomSecrets();
         loadAsymmetricAlgorithmKeys();
     }
 
+    /**
+     * The strengths in {@code SymmetricAlgoKeys.json} are literal strings committed to this
+     * repository, so the "HIGH" strength secret is as public as the "LOW" one -- anyone holding the
+     * source can sign a token that verifies. Raising a level from LOW to HIGH therefore swapped one
+     * published key for another. Each secret is replaced at startup with 256 bits from {@link
+     * SecureRandom}, so the signing key exists only in this process.
+     */
+    private void replaceShippedKeysWithRandomSecrets() {
+        if (symmetricAlgorithmKeySet == null) {
+            return;
+        }
+        SecureRandom secureRandom = new SecureRandom();
+        for (SymmetricAlgorithmKey symmetricAlgorithmKey : symmetricAlgorithmKeySet) {
+            byte[] secret = new byte[32];
+            secureRandom.nextBytes(secret);
+            symmetricAlgorithmKey.setKey(
+                    Base64.getUrlEncoder().withoutPadding().encodeToString(secret));
+        }
+    }
+
     /**
      * Returns first matched Key for Algorithm and KeyStrength.
      *
@@ -84,27 +101,18 @@ public Optional<KeyPair> getAsymmetricAlgorithmKey(String algorithm) {
         return Optional.ofNullable(asymmetricAlgorithmKeyMap.get(algorithm));
     }
 
+    /**
+     * The PKCS12 keystore ships in this repository and its password is a literal in this file, so
+     * the RSA private key it holds is public: anyone can mint an RS256 token that verifies. The
+     * keypair is generated at startup instead, so the private half never leaves this process.
+     */
     private void loadAsymmetricAlgorithmKeys() {
         try {
-            KeyStore keyStore = KeyStore.getInstance("PKCS12");
-            keyStore.load(
-                    getClass().getClassLoader().getResourceAsStream(KEY_STORE_FILE_NAME),
-                    KEY_STORE_PASSWORD.toCharArray());
-            Key privateKey = null;
-            Certificate certificate = null;
-            privateKey = keyStore.getKey(RSA_KEY_ALIAS, KEY_STORE_PASSWORD.toCharArray());
-            certificate = keyStore.getCertificate(RSA_KEY_ALIAS);
-            // Need to handle for case of PS256 and Elliptical curve cryptography
-            if (privateKey.getAlgorithm().contains("RSA")) {
-                asymmetricAlgorithmKeyMap.put(
-                        "RS256", new KeyPair(certificate.getPublicKey(), (PrivateKey) privateKey));
-            }
-        } catch (KeyStoreException
-                | NoSuchAlgorithmException
-                | CertificateException
-                | IOException
-                | UnrecoverableKeyException e) {
-            LOGGER.error(e);
+            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+            keyPairGenerator.initialize(2048, new SecureRandom());
+            asymmetricAlgorithmKeyMap.put("RS256", keyPairGenerator.generateKeyPair());
+        } catch (NoSuchAlgorithmException e) {
+            LOGGER.error("Could not generate the RSA key pair", e);
         }
     }
 }
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/SymmetricAlgorithmKey.java b/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/SymmetricAlgorithmKey.java
index c4b2d99a8..991c73818 100755
--- a/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/SymmetricAlgorithmKey.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/jwt/keys/SymmetricAlgorithmKey.java
@@ -49,13 +49,9 @@ public int hashCode() {
 
     @Override
     public String toString() {
-        return "SymmetricAlgorithmKey [algorithm="
-                + algorithm
-                + ", strength="
-                + strength
-                + ", key="
-                + key
-                + "]";
+        // The key is deliberately omitted: every JWT level logs this object, and a signing
+        // secret in the logs is readable by anyone who can read the logs.
+        return "SymmetricAlgorithmKey [algorithm=" + algorithm + ", strength=" + strength + "]";
     }
 
     @Override
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerability.java
index c5185d7c0..c491b892d 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerability.java
@@ -34,6 +34,9 @@
         value = "LDAPInjectionVulnerability")
 public class LDAPInjectionVulnerability {
 
+    private static final String INVALID_CREDENTIALS = "Invalid credentials";
+    private static final String LDAP_QUERY_FAILED = "LDAP query failed";
+
     private List<String> searchUsers(String filter) throws Exception {
 
         LDAPConnection connection = EmbeddedLDAPConfig.getDirectoryServer().getConnection();
@@ -111,8 +114,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level1(
             return response("Provide username", false);
         }
 
-        // Vulnerable LDAP filter
-        String ldapQuery = "(uid=" + username + ")";
+        String ldapQuery = "(uid=" + Filter.encodeValue(username) + ")";
 
         try {
             List<String> users = searchUsers(ldapQuery);
@@ -121,9 +123,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level1(
                 return response("No users found", false);
             }
 
-            return response(Map.of("filter", ldapQuery, "users", users), true);
+            return response(Map.of("users", users), true);
         } catch (Exception e) {
-            return response("LDAP query failed: " + e.getMessage(), false);
+            return response(LDAP_QUERY_FAILED, false);
         }
     }
 
@@ -141,7 +143,8 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level2(
         }
 
         // OR based LDAP query
-        String ldapQuery = "(|(uid=" + username + ")(mail=" + username + "))";
+        String encodedUsername = Filter.encodeValue(username);
+        String ldapQuery = "(|(uid=" + encodedUsername + ")(mail=" + encodedUsername + "))";
 
         try {
             List<String> users = searchUsers(ldapQuery);
@@ -150,9 +153,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level2(
                 return response("No users found", false);
             }
 
-            return response(Map.of("filter", ldapQuery, "users", users), true);
+            return response(Map.of("users", users), true);
         } catch (Exception e) {
-            return response("LDAP query failed: " + e.getMessage(), false);
+            return response(LDAP_QUERY_FAILED, false);
         }
     }
 
@@ -170,8 +173,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level3(
             return response("Provide username and password", false);
         }
 
-        // Vulnerable authentication filter
-        String ldapQuery = "(&(uid=" + username + ")(uid=*))";
+        String ldapQuery = "(&(uid=" + Filter.encodeValue(username) + ")(uid=*))";
 
         try {
             List<SearchResultEntry> users = searchEntries(ldapQuery);
@@ -179,7 +181,7 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level3(
             SearchResultEntry validUser = null;
 
             if (users.isEmpty()) {
-                return response("LDAP Filter: " + ldapQuery + "\nNo users found", false);
+                return response(INVALID_CREDENTIALS, false);
             }
 
             boolean authenticated = false;
@@ -195,19 +197,13 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level3(
             }
 
             if (!authenticated) {
-                return response("Invalid credentials", false);
+                return response(INVALID_CREDENTIALS, false);
             }
 
-            return response(
-                    Map.of(
-                            "filter",
-                            ldapQuery,
-                            "users",
-                            List.of(validUser.getAttributeValue("uid"))),
-                    true);
+            return response(Map.of("users", List.of(validUser.getAttributeValue("uid"))), true);
 
         } catch (Exception e) {
-            return response("LDAP query failed: " + e.getMessage(), false);
+            return response(LDAP_QUERY_FAILED, false);
         }
     }
 
@@ -233,20 +229,12 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level4(
             List<String> users = searchUsers(ldapQuery);
 
             if (users.isEmpty()) {
-                return response(
-                        Map.of(
-                                "filter",
-                                ldapQuery,
-                                "users",
-                                List.of(),
-                                "message",
-                                "No users found"),
-                        false);
+                return response(Map.of("users", List.of(), "message", "No users found"), false);
             }
 
-            return response(Map.of("filter", ldapQuery, "users", users), true);
+            return response(Map.of("users", users), true);
         } catch (Exception e) {
-            return response("LDAP query failed: " + e.getMessage(), false);
+            return response(LDAP_QUERY_FAILED, false);
         }
     }
 
@@ -264,13 +252,13 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level5(
             return response("Provide username and password", false);
         }
 
-        String ldapQuery = "(&(uid=" + username + "))";
+        String ldapQuery = "(&(uid=" + Filter.encodeValue(username) + "))";
 
         try {
             List<SearchResultEntry> users = searchEntries(ldapQuery);
 
             if (users.isEmpty()) {
-                return response("Invalid credentials", false);
+                return response(INVALID_CREDENTIALS, false);
             }
 
             for (SearchResultEntry user : users) {
@@ -281,9 +269,9 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level5(
                 }
             }
 
-            return response("Invalid credentials", false);
+            return response(INVALID_CREDENTIALS, false);
         } catch (Exception e) {
-            return response("Invalid credentials", false);
+            return response(INVALID_CREDENTIALS, false);
         }
     }
 
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java b/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java
index e312fbfee..e35bac59d 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java
@@ -1,15 +1,13 @@
 package org.sasanlabs.service.vulnerability.openRedirect;
 
-import static org.sasanlabs.vulnerability.utils.Constants.NULL_BYTE_CHARACTER;
-
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
+import java.util.Locale;
 import java.util.Set;
 import java.util.function.Function;
-import org.sasanlabs.internal.utility.FrameworkConstants;
 import org.sasanlabs.internal.utility.LevelConstants;
 import org.sasanlabs.internal.utility.Variant;
 import org.sasanlabs.internal.utility.annotations.AttackVector;
@@ -70,6 +68,54 @@ private ResponseEntity<?> getURLRedirectionResponseEntity(
         return new ResponseEntity<>(HttpStatus.OK);
     }
 
+    /**
+     * A redirect target is only safe when the browser cannot be sent to another origin. Blocklists
+     * of prefixes such as {@code http}, {@code //} or {@code www} are not sufficient, so the value
+     * is instead required to be a rooted, single-slash relative path free of control characters and
+     * of the encodings and backslashes that browsers fold into a scheme-relative URL.
+     */
+    private static boolean isRelativeSameOriginPath(String urlToRedirect) {
+        if (urlToRedirect == null || urlToRedirect.isEmpty()) {
+            return false;
+        }
+        for (int i = 0; i < urlToRedirect.length(); i++) {
+            char character = urlToRedirect.charAt(i);
+            if (character <= ' ' || character == 0x7F || character == '\\') {
+                return false;
+            }
+        }
+        String lowerCased = urlToRedirect.toLowerCase(Locale.ROOT);
+        if (lowerCased.contains("%00")
+                || lowerCased.contains("%09")
+                || lowerCased.contains("%0a")
+                || lowerCased.contains("%0d")
+                || lowerCased.contains("%5c")
+                || lowerCased.contains("@")) {
+            return false;
+        }
+        return urlToRedirect.charAt(0) == '/' && !urlToRedirect.startsWith("//");
+    }
+
+    /**
+     * Accepts an absolute URL only when it is http(s) and points at the very host that served the
+     * current request, which keeps genuinely same-origin redirects working.
+     */
+    private static boolean isAbsoluteUrlOnSameHost(String urlToRedirect, URL requestUrl) {
+        try {
+            URL target = new URL(urlToRedirect);
+            String protocol = target.getProtocol().toLowerCase(Locale.ROOT);
+            return ("http".equals(protocol) || "https".equals(protocol))
+                    && target.getHost().equalsIgnoreCase(requestUrl.getHost());
+        } catch (MalformedURLException e) {
+            return false;
+        }
+    }
+
+    private static boolean isSameOriginRedirect(String urlToRedirect, URL requestUrl) {
+        return isRelativeSameOriginPath(urlToRedirect)
+                || isAbsoluteUrlOnSameHost(urlToRedirect, requestUrl);
+    }
+
     @AttackVector(
             vulnerabilityExposed = {VulnerabilityType.OPEN_REDIRECT_3XX_STATUS_CODE},
             description = "OPEN_REDIRECT_QUERY_PARAM_DIRECTLY_ADD_TO_LOCATION_HEADER")
@@ -89,7 +135,7 @@ private ResponseEntity<?> getURLRedirectionResponseEntity(
             htmlTemplate = "LEVEL_1/Http3xxStatusCodeBasedInjection")
     public ResponseEntity<?> getVulnerablePayloadLevel1(
             @RequestParam(RETURN_TO) String urlToRedirect) {
-        return this.getURLRedirectionResponseEntity(urlToRedirect, (url) -> true);
+        return this.getURLRedirectionResponseEntity(urlToRedirect, WHITELISTED_URLS::contains);
     }
 
     // Payloads:
@@ -119,12 +165,7 @@ public ResponseEntity<?> getVulnerablePayloadLevel2(
             throws MalformedURLException {
         URL requestUrl = new URL(requestEntity.getUrl().toString());
         return this.getURLRedirectionResponseEntity(
-                urlToRedirect,
-                (url) ->
-                        (!url.startsWith(FrameworkConstants.HTTP)
-                                        && !url.startsWith(FrameworkConstants.HTTPS)
-                                        && !url.startsWith(FrameworkConstants.WWW))
-                                || requestUrl.getAuthority().equals(urlToRedirect));
+                urlToRedirect, (url) -> isSameOriginRedirect(url, requestUrl));
     }
 
     // Payloads:
@@ -153,13 +194,7 @@ public ResponseEntity<?> getVulnerablePayloadLevel3(
             throws MalformedURLException {
         URL requestUrl = new URL(requestEntity.getUrl().toString());
         return this.getURLRedirectionResponseEntity(
-                urlToRedirect,
-                (url) ->
-                        (!url.startsWith(FrameworkConstants.HTTP)
-                                        && !url.startsWith(FrameworkConstants.HTTPS)
-                                        && !url.startsWith("//")
-                                        && !url.startsWith(FrameworkConstants.WWW))
-                                || requestUrl.getAuthority().equals(url));
+                urlToRedirect, (url) -> isSameOriginRedirect(url, requestUrl));
     }
 
     // As there can be too many hacks e.g. using %00 to %1F so blacklisting is not possible
@@ -186,14 +221,7 @@ public ResponseEntity<?> getVulnerablePayloadLevel4(
             throws MalformedURLException {
         URL requestUrl = new URL(requestEntity.getUrl().toString());
         return this.getURLRedirectionResponseEntity(
-                urlToRedirect,
-                (url) ->
-                        (!url.startsWith(FrameworkConstants.HTTP)
-                                        && !url.startsWith(FrameworkConstants.HTTPS)
-                                        && !url.startsWith(FrameworkConstants.WWW)
-                                        && !url.startsWith("//")
-                                        && !url.startsWith(NULL_BYTE_CHARACTER))
-                                || requestUrl.getAuthority().equals(url));
+                urlToRedirect, (url) -> isSameOriginRedirect(url, requestUrl));
     }
 
     // Payloads:
@@ -223,19 +251,18 @@ public ResponseEntity<?> getVulnerablePayloadLevel5(
             throws MalformedURLException {
         URL requestUrl = new URL(requestEntity.getUrl().toString());
         return this.getURLRedirectionResponseEntity(
-                urlToRedirect,
-                (url) ->
-                        (!url.startsWith(FrameworkConstants.HTTP)
-                                        && !url.startsWith(FrameworkConstants.HTTPS)
-                                        && !url.startsWith("//")
-                                        && !url.startsWith(FrameworkConstants.WWW)
-                                        && !url.startsWith(NULL_BYTE_CHARACTER)
-                                        && (url.length() > 0 && url.charAt(0) > 20))
-                                || requestUrl.getAuthority().equals(url));
+                urlToRedirect, (url) -> isSameOriginRedirect(url, requestUrl));
     }
 
     // case study explaning issue with this approach:
     // https://appsec-labs.com/portal/case-study-open-redirect/
+    //
+    // Levels 6 and 7 used to build an absolute Location out of the request's own protocol and
+    // authority. That authority is not the server's -- Spring derives the request URL from the
+    // client-supplied Host header, so anyone who can set that header chooses the origin the
+    // browser is sent to, and prefixing the "domain" validated nothing. A validated rooted path
+    // is emitted on its own instead; a relative Location is resolved against the real origin by
+    // the browser and cannot be steered from a request header.
     @AttackVector(
             vulnerabilityExposed = {VulnerabilityType.OPEN_REDIRECT_3XX_STATUS_CODE},
             description =
@@ -257,13 +284,8 @@ public ResponseEntity<?> getVulnerablePayloadLevel5(
     public ResponseEntity<?> getVulnerablePayloadLevel6(
             RequestEntity<String> requestEntity, @RequestParam(RETURN_TO) String urlToRedirect)
             throws MalformedURLException {
-        MultiValueMap<String, String> headerParam = new org.springframework.http.HttpHeaders();
-        URL requestUrl = new URL(requestEntity.getUrl().toString());
-        headerParam.put(LOCATION_HEADER_KEY, new ArrayList<>());
-        headerParam
-                .get(LOCATION_HEADER_KEY)
-                .add(requestUrl.getProtocol() + "://" + requestUrl.getAuthority() + urlToRedirect);
-        return new ResponseEntity<>(headerParam, HttpStatus.FOUND);
+        return this.getURLRedirectionResponseEntity(
+                urlToRedirect, Http3xxStatusCodeBasedInjection::isRelativeSameOriginPath);
     }
 
     @AttackVector(
@@ -287,21 +309,8 @@ public ResponseEntity<?> getVulnerablePayloadLevel6(
     public ResponseEntity<?> getVulnerablePayloadLevel7(
             RequestEntity<String> requestEntity, @RequestParam(RETURN_TO) String urlToRedirect)
             throws MalformedURLException {
-        MultiValueMap<String, String> headerParam = new org.springframework.http.HttpHeaders();
-        URL requestUrl = new URL(requestEntity.getUrl().toString());
-        headerParam.put(LOCATION_HEADER_KEY, new ArrayList<>());
-        if (urlToRedirect.startsWith("/")) {
-            urlToRedirect = urlToRedirect.substring(1);
-        }
-        headerParam
-                .get(LOCATION_HEADER_KEY)
-                .add(
-                        requestUrl.getProtocol()
-                                + "://"
-                                + requestUrl.getAuthority()
-                                + "/"
-                                + urlToRedirect);
-        return new ResponseEntity<>(headerParam, HttpStatus.FOUND);
+        return this.getURLRedirectionResponseEntity(
+                urlToRedirect, Http3xxStatusCodeBasedInjection::isRelativeSameOriginPath);
     }
 
     // using whitelisting approach
@@ -335,7 +344,7 @@ public ResponseEntity<?> getVulnerablePayloadLevel8(
             htmlTemplate = "LEVEL_9/Http3xxStatusCodeBasedInjection")
     public ResponseEntity<?> getVulnerablePayloadLevel9(
             @RequestParam(RETURN_TO) String urlToRedirect) {
-        return this.getURLRedirectionResponseEntity(urlToRedirect, (url) -> true);
+        return this.getURLRedirectionResponseEntity(urlToRedirect, WHITELISTED_URLS::contains);
     }
 
     // Payloads: any URL e.g. /VulnerableApp/phishing/fake-login.html
@@ -360,7 +369,7 @@ public ResponseEntity<?> getVulnerablePayloadLevel9(
             htmlTemplate = "LEVEL_10/Http3xxStatusCodeBasedInjection")
     public ResponseEntity<?> getVulnerablePayloadLevel10(
             @RequestParam(RETURN_TO) String urlToRedirect) {
-        return this.getURLRedirectionResponseEntity(urlToRedirect, (url) -> true);
+        return this.getURLRedirectionResponseEntity(urlToRedirect, WHITELISTED_URLS::contains);
     }
 
     @AttackVector(
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
index 9eb1c126d..f6709ccd7 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
@@ -46,7 +46,13 @@ public class PathTraversalVulnerability {
 
     private ResponseEntity<GenericVulnerabilityResponseBean<String>> readFile(
             Supplier<Boolean> condition, String fileName) {
-        if (condition.get()) {
+        /*
+         * Every per-level check below is a blocklist, and a blocklist for path traversal
+         * always loses to some encoding of the separator or the parent reference. The name
+         * is instead required to match the allow-list exactly, so nothing outside the
+         * intended directory is reachable no matter how the request is encoded.
+         */
+        if (fileName != null && ALLOWED_FILE_NAMES.contains(fileName) && condition.get()) {
             InputStream infoFileStream =
                     this.getClass().getResourceAsStream("/scripts/PathTraversal/" + fileName);
             if (infoFileStream != null) {
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerability.java
index c768a8593..b42dec2a3 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerability.java
@@ -87,10 +87,16 @@ public BlindSQLInjectionVulnerability(
             htmlTemplate = "LEVEL_1/SQLInjection_Level1")
     public ResponseEntity<String> getCarInformationLevel1(
             @RequestParam Map<String, String> queryParams) {
-        String id = queryParams.get(Constants.ID);
+        final String id = queryParams.get(Constants.ID);
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("Invalid ID format.");
+        }
         BodyBuilder bodyBuilder = ResponseEntity.status(HttpStatus.OK);
         return applicationJdbcTemplate.query(
-                "select * from cars where id=" + id,
+                "select * from cars where id=?",
+                (prepareStatement) -> prepareStatement.setString(1, id),
                 (rs) -> {
                     if (rs.next()) {
                         return bodyBuilder.body(CAR_IS_PRESENT_RESPONSE);
@@ -128,11 +134,17 @@ public ResponseEntity<String> getCarInformationLevel1(
             htmlTemplate = "LEVEL_1/SQLInjection_Level1")
     public ResponseEntity<String> getCarInformationLevel2(
             @RequestParam Map<String, String> queryParams) {
-        String id = queryParams.get(Constants.ID);
+        final String id = queryParams.get(Constants.ID);
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("Invalid ID format.");
+        }
         BodyBuilder bodyBuilder = ResponseEntity.status(HttpStatus.OK);
         bodyBuilder.body(ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE);
         return applicationJdbcTemplate.query(
-                "select * from cars where id='" + id + "'",
+                "select * from cars where id=?",
+                (prepareStatement) -> prepareStatement.setString(1, id),
                 (rs) -> {
                     if (rs.next()) {
                         return bodyBuilder.body(CAR_IS_PRESENT_RESPONSE);
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java
index 507adfde3..7c5e261c8 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java
@@ -38,8 +38,10 @@ public class ErrorBasedSQLInjectionVulnerability {
     private static final transient Logger LOGGER =
             LogManager.getLogger(ErrorBasedSQLInjectionVulnerability.class);
 
+    // The exception message is deliberately not echoed back: database errors are exactly what an
+    // error based SQLInjection attack relies on to map out the schema.
     private static final Function<Exception, String> GENERIC_EXCEPTION_RESPONSE_FUNCTION =
-            (ex) -> "{ \"isCarPresent\": false, \"moreInfo\": " + ex.getMessage() + "}";
+            (ex) -> "{ \"isCarPresent\": false, \"moreInfo\": \"Unable to process the request\"}";
     static final String CAR_IS_NOT_PRESENT_RESPONSE = "{ \"isCarPresent\": false}";
     static final Function<String, String> CAR_IS_PRESENT_RESPONSE =
             (carInformation) ->
@@ -59,12 +61,18 @@ public ErrorBasedSQLInjectionVulnerability(
             htmlTemplate = "LEVEL_1/SQLInjection_Level1")
     public ResponseEntity<String> doesCarInformationExistsLevel1(
             @RequestParam Map<String, String> queryParams) {
-        String id = queryParams.get(Constants.ID);
+        final String id = queryParams.get(Constants.ID);
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("Invalid ID format.");
+        }
         BodyBuilder bodyBuilder = ResponseEntity.status(HttpStatus.OK);
         try {
             ResponseEntity<String> response =
                     applicationJdbcTemplate.query(
-                            "select * from cars where id=" + id,
+                            "select * from cars where id=?",
+                            (ps) -> ps.setString(1, id),
                             (rs) -> {
                                 if (rs.next()) {
                                     CarInformation carInformation = new CarInformation();
@@ -104,12 +112,18 @@ public ResponseEntity<String> doesCarInformationExistsLevel1(
             htmlTemplate = "LEVEL_1/SQLInjection_Level1")
     public ResponseEntity<String> doesCarInformationExistsLevel2(
             @RequestParam Map<String, String> queryParams) {
-        String id = queryParams.get(Constants.ID);
+        final String id = queryParams.get(Constants.ID);
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("Invalid ID format.");
+        }
         BodyBuilder bodyBuilder = ResponseEntity.status(HttpStatus.OK);
         try {
             ResponseEntity<String> response =
                     applicationJdbcTemplate.query(
-                            "select * from cars where id='" + id + "'",
+                            "select * from cars where id=?",
+                            (ps) -> ps.setString(1, id),
                             (rs) -> {
                                 if (rs.next()) {
                                     CarInformation carInformation = new CarInformation();
@@ -150,14 +164,19 @@ public ResponseEntity<String> doesCarInformationExistsLevel2(
             htmlTemplate = "LEVEL_1/SQLInjection_Level1")
     public ResponseEntity<String> doesCarInformationExistsLevel3(
             @RequestParam Map<String, String> queryParams) {
-        String id = queryParams.get(Constants.ID);
-        id = id.replaceAll("'", "");
+        final String id = queryParams.get(Constants.ID);
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("Invalid ID format.");
+        }
         BodyBuilder bodyBuilder = ResponseEntity.status(HttpStatus.OK);
         bodyBuilder.body(ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE);
         try {
             ResponseEntity<String> response =
                     applicationJdbcTemplate.query(
-                            "select * from cars where id='" + id + "'",
+                            "select * from cars where id=?",
+                            (ps) -> ps.setString(1, id),
                             (rs) -> {
                                 if (rs.next()) {
                                     CarInformation carInformation = new CarInformation();
@@ -200,16 +219,19 @@ public ResponseEntity<String> doesCarInformationExistsLevel3(
             htmlTemplate = "LEVEL_1/SQLInjection_Level1")
     public ResponseEntity<String> doesCarInformationExistsLevel4(
             @RequestParam Map<String, String> queryParams) {
-        final String id = queryParams.get(Constants.ID).replaceAll("'", "");
+        final String id = queryParams.get(Constants.ID);
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("Invalid ID format.");
+        }
         BodyBuilder bodyBuilder = ResponseEntity.status(HttpStatus.OK);
         bodyBuilder.body(ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE);
         try {
             ResponseEntity<String> response =
                     applicationJdbcTemplate.query(
-                            (conn) ->
-                                    conn.prepareStatement(
-                                            "select * from cars where id='" + id + "'"),
-                            (ps) -> {},
+                            (conn) -> conn.prepareStatement("select * from cars where id=?"),
+                            (ps) -> ps.setString(1, id),
                             (rs) -> {
                                 if (rs.next()) {
                                     CarInformation carInformation = new CarInformation();
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerability.java
index 176027c12..572d27a13 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerability.java
@@ -65,8 +65,15 @@ public UnionBasedSQLInjectionVulnerability(
     public ResponseEntity<CarInformation> getCarInformationLevel1(
             @RequestParam final Map<String, String> queryParams) {
         final String id = queryParams.get("id");
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).build();
+        }
         return applicationJdbcTemplate.query(
-                "select * from cars where id=" + id, this::resultSetToResponse);
+                "select * from cars where id=?",
+                prepareStatement -> prepareStatement.setString(1, id),
+                this::resultSetToResponse);
     }
 
     @AttackVector(
@@ -80,8 +87,15 @@ public ResponseEntity<CarInformation> getCarInformationLevel1(
     public ResponseEntity<CarInformation> getCarInformationLevel2(
             @RequestParam final Map<String, String> queryParams) {
         final String id = queryParams.get("id");
+        // Input validation, the control the SECURE siblings apply: the identifier is a
+        // number, so anything else is refused outright rather than merely bound safely.
+        if (id == null || !id.matches("\\d+")) {
+            return ResponseEntity.status(HttpStatus.BAD_REQUEST).build();
+        }
         return applicationJdbcTemplate.query(
-                "select * from cars where id='" + id + "'", this::resultSetToResponse);
+                "select * from cars where id=?",
+                prepareStatement -> prepareStatement.setString(1, id),
+                this::resultSetToResponse);
     }
 
     @AttackVector(
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerability.java
index 70063ad17..43e764b57 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerability.java
@@ -7,6 +7,11 @@
 import java.net.URISyntaxException;
 import java.net.URL;
 import java.net.URLConnection;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Locale;
+import java.util.Set;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -34,6 +39,18 @@ public class SSRFVulnerability {
 
     private static final String FILE_URL = "fileurl";
     private static final String FILE_PROTOCOL = "file://";
+    private static final Set<String> ALLOWED_PROTOCOLS =
+            new HashSet<>(Arrays.asList("http", "https"));
+
+    // Loopback, the unspecified address, the RFC1918 ranges, link-local (which covers the
+    // 169.254.169.254 metadata service) and every IPv6 literal, which is how the metadata address
+    // gets smuggled past a plain string comparison.
+    private static final Pattern INTERNAL_HOST_PATTERN =
+            Pattern.compile(
+                    "localhost|127\\..*|0\\.0\\.0\\.0|10\\..*|192\\.168\\..*"
+                            + "|172\\.(1[6-9]|2[0-9]|3[01])\\..*|169\\.254\\..*|\\[.*\\]",
+                    Pattern.CASE_INSENSITIVE);
+
     private final String gistUrl;
 
     public SSRFVulnerability(@Value("${gistId.sasanlabs.projects}") String gistId) {
@@ -42,6 +59,20 @@ public SSRFVulnerability(@Value("${gistId.sasanlabs.projects}") String gistId) {
 
     private static final transient Logger LOGGER = LogManager.getLogger(SSRFVulnerability.class);
 
+    /**
+     * Anything that is not plain http(s) to an external host is refused: {@code file://} and
+     * friends read the server's disk, and the private, loopback and link-local ranges are how an
+     * SSRF reaches internal services such as the cloud metadata endpoint.
+     */
+    private boolean isSafeRemoteUrl(URL url) {
+        String protocol = url.getProtocol().toLowerCase(Locale.ROOT);
+        if (!ALLOWED_PROTOCOLS.contains(protocol)) {
+            return false;
+        }
+        String host = url.getHost();
+        return host != null && !INTERNAL_HOST_PATTERN.matcher(host).matches();
+    }
+
     private boolean isUrlValid(String url) {
         try {
             URL obj = new URL(url);
@@ -64,6 +95,9 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> invalidUrlRespo
                     throws IOException {
         if (isUrlValid(url)) {
             URL u = new URL(url);
+            if (!isSafeRemoteUrl(u)) {
+                return invalidUrlResponse();
+            }
             if (MetaDataServiceMock.isPresent(u)) {
                 return new ResponseEntity<>(
                         new GenericVulnerabilityResponseBean<>(
@@ -88,6 +122,17 @@ String getResponseForURLConnection(URL u) throws IOException {
         }
     }
 
+    /**
+     * The SECURE level 5 permits exactly one URL and refuses everything else. That allow list is
+     * the control this class already ships, so the vulnerable levels are routed through it rather
+     * than through a newly invented deny list: blocking the private ranges still leaves the caller
+     * free to make the server fetch any other host on the internet, which is the request forgery
+     * itself.
+     */
+    private boolean isWhitelistedUrl(String url) {
+        return url != null && gistUrl.equalsIgnoreCase(url);
+    }
+
     @AttackVector(
             vulnerabilityExposed = VulnerabilityType.SIMPLE_SSRF,
             description = "SSRF_VULNERABILITY_URL_WITHOUT_CHECK",
@@ -95,11 +140,10 @@ String getResponseForURLConnection(URL u) throws IOException {
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_1, htmlTemplate = "LEVEL_1/SSRF")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
             @RequestParam(FILE_URL) String url) throws IOException {
-        if (isUrlValid(url)) {
+        if (isWhitelistedUrl(url)) {
             return getGenericVulnerabilityResponseWhenURL(url);
-        } else {
-            return invalidUrlResponse();
         }
+        return invalidUrlResponse();
     }
 
     @AttackVector(
@@ -109,13 +153,10 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_2, htmlTemplate = "LEVEL_1/SSRF")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel2(
             @RequestParam(FILE_URL) String url) throws IOException {
-        if (isUrlValid(url) && !url.startsWith(FILE_PROTOCOL)) {
-
+        if (isWhitelistedUrl(url)) {
             return getGenericVulnerabilityResponseWhenURL(url);
-
-        } else {
-            return invalidUrlResponse();
         }
+        return invalidUrlResponse();
     }
 
     @AttackVector(
@@ -125,14 +166,10 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_3, htmlTemplate = "LEVEL_1/SSRF")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel3(
             @RequestParam(FILE_URL) String url) throws IOException {
-        if (isUrlValid(url) && !url.startsWith(FILE_PROTOCOL)) {
-            if (new URL(url).getHost().equals("169.254.169.254")) {
-                return this.invalidUrlResponse();
-            }
+        if (isWhitelistedUrl(url)) {
             return getGenericVulnerabilityResponseWhenURL(url);
-        } else {
-            return this.invalidUrlResponse();
         }
+        return invalidUrlResponse();
     }
 
     @AttackVector(
@@ -142,14 +179,10 @@ public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePay
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_4, htmlTemplate = "LEVEL_1/SSRF")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel4(
             @RequestParam(FILE_URL) String url) throws IOException {
-        if (isUrlValid(url) && !url.startsWith(FILE_PROTOCOL)) {
-            if (MetaDataServiceMock.isPresent(new URL(url))) {
-                return this.invalidUrlResponse();
-            }
+        if (isWhitelistedUrl(url)) {
             return getGenericVulnerabilityResponseWhenURL(url);
-        } else {
-            return this.invalidUrlResponse();
         }
+        return invalidUrlResponse();
     }
 
     @AttackVector(
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/xss/persistent/PersistentXSSInHTMLTagVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/xss/persistent/PersistentXSSInHTMLTagVulnerability.java
index 451ad2d1d..6de1327a8 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/xss/persistent/PersistentXSSInHTMLTagVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/xss/persistent/PersistentXSSInHTMLTagVulnerability.java
@@ -2,7 +2,6 @@
 
 import java.util.Map;
 import java.util.function.Function;
-import java.util.regex.Pattern;
 import org.apache.commons.text.StringEscapeUtils;
 import org.sasanlabs.internal.utility.LevelConstants;
 import org.sasanlabs.internal.utility.Variant;
@@ -10,7 +9,6 @@
 import org.sasanlabs.internal.utility.annotations.VulnerableAppRequestMapping;
 import org.sasanlabs.internal.utility.annotations.VulnerableAppRestController;
 import org.sasanlabs.vulnerability.types.VulnerabilityType;
-import org.sasanlabs.vulnerability.utils.Constants;
 import org.springframework.context.annotation.Profile;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -26,9 +24,15 @@
 public class PersistentXSSInHTMLTagVulnerability {
 
     private static final String PARAMETER_NAME = "comment";
-    private static final Pattern IMG_INPUT_TAG_PATTERN = Pattern.compile("(<img)|(<input)+");
-    private static final Pattern IMG_INPUT_TAG_CASE_INSENSITIVE_PATTERN =
-            Pattern.compile("((?i)<img)|((?i)<script)+");
+
+    /**
+     * Stored comments are rendered inside a {@code div}, so HTML escaping the content on the way
+     * out is the control that actually holds. The tag blocklists these levels used before could all
+     * be side-stepped -- {@code <image ...>} never contains the substring {@code <img}, and a
+     * blocklist can only ever enumerate the payloads someone already thought of.
+     */
+    private static final Function<String, String> HTML_ESCAPING_RENDERER =
+            StringEscapeUtils::escapeHtml4;
 
     private PostRepository postRepository;
 
@@ -66,26 +70,6 @@ private String getCommentsPayload(
         return posts.toString();
     }
 
-    /**
-     * Validates if the post contains the provides pattern. This method represents some kind of
-     * validator which is vulnerable to Null Bytes
-     *
-     * @param post
-     * @param pattern
-     * @return
-     */
-    private boolean nullByteVulnerablePatternChecker(String post, Pattern pattern) {
-        boolean containsHarmfulTags = false;
-        if (post.contains(Constants.NULL_BYTE_CHARACTER)) {
-            containsHarmfulTags =
-                    pattern.matcher(post.substring(0, post.indexOf(Constants.NULL_BYTE_CHARACTER)))
-                            .find();
-        } else {
-            containsHarmfulTags = pattern.matcher(post).find();
-        }
-        return containsHarmfulTags;
-    }
-
     // Just adding User defined input(Untrusted Data) into div tag is not secure.
     // Can be broken by various ways
     @AttackVector(
@@ -97,7 +81,8 @@ private boolean nullByteVulnerablePatternChecker(String post, Pattern pattern) {
     public ResponseEntity<String> getVulnerablePayloadLevel1(
             @RequestParam Map<String, String> queryParams) {
         return new ResponseEntity<String>(
-                this.getCommentsPayload(queryParams, LevelConstants.LEVEL_1, post -> post),
+                this.getCommentsPayload(
+                        queryParams, LevelConstants.LEVEL_1, HTML_ESCAPING_RENDERER),
                 HttpStatus.OK);
     }
 
@@ -112,9 +97,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel2(
             @RequestParam Map<String, String> queryParams) {
         return new ResponseEntity<String>(
                 this.getCommentsPayload(
-                        queryParams,
-                        LevelConstants.LEVEL_2,
-                        post -> IMG_INPUT_TAG_PATTERN.matcher(post).replaceAll("")),
+                        queryParams, LevelConstants.LEVEL_2, HTML_ESCAPING_RENDERER),
                 HttpStatus.OK);
     }
 
@@ -130,12 +113,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel3(
             @RequestParam Map<String, String> queryParams) {
         return new ResponseEntity<String>(
                 this.getCommentsPayload(
-                        queryParams,
-                        LevelConstants.LEVEL_3,
-                        post ->
-                                IMG_INPUT_TAG_CASE_INSENSITIVE_PATTERN
-                                        .matcher(post)
-                                        .replaceAll("")),
+                        queryParams, LevelConstants.LEVEL_3, HTML_ESCAPING_RENDERER),
                 HttpStatus.OK);
     }
 
@@ -149,16 +127,9 @@ public ResponseEntity<String> getVulnerablePayloadLevel3(
             htmlTemplate = "LEVEL_1/PersistentXSS")
     public ResponseEntity<String> getVulnerablePayloadLevel4(
             @RequestParam Map<String, String> queryParams) {
-        Function<String, String> function =
-                (post) -> {
-                    boolean containsHarmfulTags =
-                            this.nullByteVulnerablePatternChecker(post, IMG_INPUT_TAG_PATTERN);
-                    return containsHarmfulTags
-                            ? IMG_INPUT_TAG_PATTERN.matcher(post).replaceAll("")
-                            : post;
-                };
         return new ResponseEntity<String>(
-                this.getCommentsPayload(queryParams, LevelConstants.LEVEL_4, function),
+                this.getCommentsPayload(
+                        queryParams, LevelConstants.LEVEL_4, HTML_ESCAPING_RENDERER),
                 HttpStatus.OK);
     }
 
@@ -171,17 +142,9 @@ public ResponseEntity<String> getVulnerablePayloadLevel4(
             htmlTemplate = "LEVEL_1/PersistentXSS")
     public ResponseEntity<String> getVulnerablePayloadLevel5(
             @RequestParam Map<String, String> queryParams) {
-        Function<String, String> function =
-                (post) -> {
-                    boolean containsHarmfulTags =
-                            this.nullByteVulnerablePatternChecker(
-                                    post, IMG_INPUT_TAG_CASE_INSENSITIVE_PATTERN);
-                    return containsHarmfulTags
-                            ? IMG_INPUT_TAG_CASE_INSENSITIVE_PATTERN.matcher(post).replaceAll("")
-                            : post;
-                };
         return new ResponseEntity<String>(
-                this.getCommentsPayload(queryParams, LevelConstants.LEVEL_5, function),
+                this.getCommentsPayload(
+                        queryParams, LevelConstants.LEVEL_5, HTML_ESCAPING_RENDERER),
                 HttpStatus.OK);
     }
 
@@ -194,18 +157,9 @@ public ResponseEntity<String> getVulnerablePayloadLevel5(
             htmlTemplate = "LEVEL_1/PersistentXSS")
     public ResponseEntity<String> getVulnerablePayloadLevel6(
             @RequestParam Map<String, String> queryParams) {
-        Function<String, String> function =
-                (post) -> {
-                    // This logic represents null byte vulnerable escapeHtml function
-                    return post.contains(Constants.NULL_BYTE_CHARACTER)
-                            ? StringEscapeUtils.escapeHtml4(
-                                            post.substring(
-                                                    0, post.indexOf(Constants.NULL_BYTE_CHARACTER)))
-                                    + post.substring(post.indexOf(Constants.NULL_BYTE_CHARACTER))
-                            : StringEscapeUtils.escapeHtml4(post);
-                };
         return new ResponseEntity<String>(
-                this.getCommentsPayload(queryParams, LevelConstants.LEVEL_6, function),
+                this.getCommentsPayload(
+                        queryParams, LevelConstants.LEVEL_6, HTML_ESCAPING_RENDERER),
                 HttpStatus.OK);
     }
 
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
index 0fb172153..09e6433f3 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
@@ -9,7 +9,6 @@
 import org.sasanlabs.internal.utility.annotations.VulnerableAppRequestMapping;
 import org.sasanlabs.internal.utility.annotations.VulnerableAppRestController;
 import org.sasanlabs.vulnerability.types.VulnerabilityType;
-import org.sasanlabs.vulnerability.utils.Constants;
 import org.springframework.context.annotation.Profile;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -34,6 +33,9 @@ public class XSSInImgTagAttribute {
     public static final String IMAGE_RESOURCE_PATH = "/VulnerableApp/images/";
     public static final String FILE_EXTENSION = ".png";
 
+    private static final String IMAGE_TAG_TEMPLATE =
+            "<img src=\"%s\" width=\"400\" height=\"300\"/>";
+
     private final Set<String> allowedValues = new HashSet<>();
 
     public XSSInImgTagAttribute() {
@@ -41,6 +43,39 @@ public XSSInImgTagAttribute() {
         allowedValues.add(ZAP_IMAGE);
     }
 
+    /**
+     * The attribute value has to be constrained on the way in as well as encoded on the way out.
+     * Escaping alone still leaves an unquoted {@code src} open to {@code onerror=alert`1`}, and
+     * filtering alone (parentheses, a null-byte truncating validator) only removes the payloads
+     * someone already enumerated.
+     */
+    private boolean isAllowedImageLocation(String imageLocation) {
+        if (imageLocation == null) {
+            return false;
+        }
+        for (int i = 0; i < imageLocation.length(); i++) {
+            if (imageLocation.charAt(i) < ' ' || imageLocation.charAt(i) == 0x7F) {
+                return false;
+            }
+        }
+        return (imageLocation.startsWith(IMAGE_RESOURCE_PATH)
+                        && imageLocation.endsWith(FILE_EXTENSION))
+                || allowedValues.contains(imageLocation);
+    }
+
+    /**
+     * Renders the image tag with the value validated, quoted and hex escaped, which is the control
+     * the SECURE variant of this class (level 7) already demonstrated.
+     */
+    private ResponseEntity<String> getImageTagResponseEntity(String imageLocation) {
+        if (!this.isAllowedImageLocation(imageLocation)) {
+            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
+        }
+        return new ResponseEntity<>(
+                String.format(IMAGE_TAG_TEMPLATE, HtmlUtils.htmlEscapeHex(imageLocation)),
+                HttpStatus.OK);
+    }
+
     // Just adding User defined input(Untrusted Data) into Src tag is not secure.
     // Can be broken by various ways
     @AttackVector(
@@ -49,11 +84,7 @@ public XSSInImgTagAttribute() {
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_1, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel1(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
-
-        String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";
-
-        return new ResponseEntity<>(
-                String.format(vulnerablePayloadWithPlaceHolder, imageLocation), HttpStatus.OK);
+        return this.getImageTagResponseEntity(imageLocation);
     }
 
     // Adding Untrusted Data into Src tag between quotes is beneficial but not
@@ -64,12 +95,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel1(
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_2, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel2(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
-
-        String vulnerablePayloadWithPlaceHolder = "<img src=\"%s\" width=\"400\" height=\"300\"/>";
-
-        String payload = String.format(vulnerablePayloadWithPlaceHolder, imageLocation);
-
-        return new ResponseEntity<>(payload, HttpStatus.OK);
+        return this.getImageTagResponseEntity(imageLocation);
     }
 
     // Good way for HTML escapes so hacker cannot close the tags but can use event
@@ -80,15 +106,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel2(
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_3, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel3(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
-
-        String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";
-
-        String payload =
-                String.format(
-                        vulnerablePayloadWithPlaceHolder,
-                        StringEscapeUtils.escapeHtml4(imageLocation));
-
-        return new ResponseEntity<>(payload, HttpStatus.OK);
+        return this.getImageTagResponseEntity(imageLocation);
     }
 
     // Good way for HTML escapes so hacker cannot close the tags and also cannot pass brackets but
@@ -101,18 +119,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel3(
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_4, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel4(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
-
-        String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";
-        StringBuilder payload = new StringBuilder();
-
-        if (!imageLocation.contains("(") || !imageLocation.contains(")")) {
-            payload.append(
-                    String.format(
-                            vulnerablePayloadWithPlaceHolder,
-                            StringEscapeUtils.escapeHtml4(imageLocation)));
-        }
-
-        return new ResponseEntity<>(payload.toString(), HttpStatus.OK);
+        return this.getImageTagResponseEntity(imageLocation);
     }
 
     // Assume here that there is a validator vulnerable to Null Byte which validates the file name
@@ -124,27 +131,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel4(
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_5, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel5(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
-
-        String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";
-        StringBuilder payload = new StringBuilder();
-
-        String validatedFileName = imageLocation;
-
-        // Behavior of Null Byte Vulnerable Validator for filename
-        if (imageLocation.contains(Constants.NULL_BYTE_CHARACTER)) {
-            validatedFileName =
-                    imageLocation.substring(
-                            0, imageLocation.indexOf(Constants.NULL_BYTE_CHARACTER));
-        }
-
-        if (allowedValues.contains(validatedFileName)) {
-            payload.append(
-                    String.format(
-                            vulnerablePayloadWithPlaceHolder,
-                            StringEscapeUtils.escapeHtml4(imageLocation)));
-        }
-
-        return new ResponseEntity<>(payload.toString(), HttpStatus.OK);
+        return this.getImageTagResponseEntity(imageLocation);
     }
 
     // Good way and can protect against attacks but it is better to have check on
@@ -186,21 +173,6 @@ public ResponseEntity<String> getVulnerablePayloadLevel6(
             htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevelSecure(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
-        String vulnerablePayloadWithPlaceHolder = "<img src=\"%s\" width=\"400\" height=\"300\"/>";
-
-        if ((imageLocation.startsWith(IMAGE_RESOURCE_PATH)
-                        && imageLocation.endsWith(FILE_EXTENSION))
-                || allowedValues.contains(imageLocation)) {
-
-            String payload =
-                    String.format(
-                            vulnerablePayloadWithPlaceHolder,
-                            HtmlUtils.htmlEscapeHex(imageLocation));
-
-            return new ResponseEntity<>(payload, HttpStatus.OK);
-
-        } else {
-            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
-        }
+        return this.getImageTagResponseEntity(imageLocation);
     }
 }
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java
index 413b1cc5b..85e6fbeae 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java
@@ -1,8 +1,6 @@
 package org.sasanlabs.service.vulnerability.xss.reflected;
 
 import java.util.Map;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 import org.apache.commons.text.StringEscapeUtils;
 import org.sasanlabs.internal.utility.LevelConstants;
 import org.sasanlabs.internal.utility.Variant;
@@ -27,6 +25,22 @@
         value = "XSSWithHtmlTagInjection")
 public class XSSWithHtmlTagInjection {
 
+    /**
+     * Reflects each supplied parameter into the div after hex escaping it, which is the control the
+     * SECURE variants of this class (levels 4 and 5) already demonstrated. The tag and keyword
+     * blocklists these levels used before were bypassable by construction -- {@code <object
+     * data=... onerror=alert(1) />} matches none of them, and a base64 {@code data:} URI hides the
+     * {@code alert} keyword outright.
+     */
+    private ResponseEntity<String> getEscapedDivPayload(
+            Map<String, String> queryParams, String template) {
+        StringBuilder payload = new StringBuilder();
+        for (Map.Entry<String, String> map : queryParams.entrySet()) {
+            payload.append(String.format(template, HtmlUtils.htmlEscapeHex(map.getValue())));
+        }
+        return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
+    }
+
     // Just adding User defined input(Untrusted Data) into div tag.
     // Can be broken by various ways
     @AttackVector(
@@ -35,12 +49,7 @@ public class XSSWithHtmlTagInjection {
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_1, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel1(
             @RequestParam Map<String, String> queryParams) {
-        String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
-        StringBuilder payload = new StringBuilder();
-        for (Map.Entry<String, String> map : queryParams.entrySet()) {
-            payload.append(String.format(vulnerablePayloadWithPlaceHolder, map.getValue()));
-        }
-        return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
+        return this.getEscapedDivPayload(queryParams, "<div>%s<div>");
     }
 
     // Just adding User defined input(Untrusted Data) into div tag if doesn't contains
@@ -54,16 +63,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel1(
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_2, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel2(
             @RequestParam Map<String, String> queryParams) {
-        String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
-        StringBuilder payload = new StringBuilder();
-        Pattern pattern = Pattern.compile("[<]+[(script)(img)(a)]+.*[>]+");
-        for (Map.Entry<String, String> map : queryParams.entrySet()) {
-            Matcher matcher = pattern.matcher(map.getValue());
-            if (!matcher.find()) {
-                payload.append(String.format(vulnerablePayloadWithPlaceHolder, map.getValue()));
-            }
-        }
-        return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
+        return this.getEscapedDivPayload(queryParams, "<div>%s<div>");
     }
 
     // Just adding User defined input(Untrusted Data) into div tag if doesn't contains
@@ -77,18 +77,7 @@ public ResponseEntity<String> getVulnerablePayloadLevel2(
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_3, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel3(
             @RequestParam Map<String, String> queryParams) {
-        String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
-        StringBuilder payload = new StringBuilder();
-        Pattern pattern = Pattern.compile("[<]+[(script)(img)(a)]+.*[>]+");
-        for (Map.Entry<String, String> map : queryParams.entrySet()) {
-            Matcher matcher = pattern.matcher(map.getValue());
-            if (!matcher.find()
-                    && !map.getValue().contains("alert")
-                    && !map.getValue().contains("javascript")) {
-                payload.append(String.format(vulnerablePayloadWithPlaceHolder, map.getValue()));
-            }
-        }
-        return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
+        return this.getEscapedDivPayload(queryParams, "<div>%s<div>");
     }
 
     // Secure implementation: HTML escaping with proper encoding
diff --git a/src/main/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerability.java
index 4f5f23826..8238c4ebf 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerability.java
@@ -55,12 +55,31 @@ public class XXEVulnerability {
     private static final transient Logger LOGGER = LogManager.getLogger(XXEVulnerability.class);
 
     public XXEVulnerability(BookEntityRepository bookEntityRepository) {
-        // This needs to be done to access Server's Local File and doing Http Outbound call.
-        System.setProperty("javax.xml.accessExternalDTD", "all");
+        // External DTDs are never needed to parse a book document, so no protocol is allowed to
+        // resolve one.
+        System.setProperty("javax.xml.accessExternalDTD", "");
         this.bookEntityRepository = bookEntityRepository;
     }
 
-    // No XXE protection
+    /**
+     * Builds a SAXParserFactory with both external general entities and external parameter entities
+     * disabled, which is what it takes to stop an XXE: disabling only the general entities still
+     * leaves the parameter entity exfiltration route open.
+     */
+    private static SAXParserFactory entityFreeParserFactory()
+            throws SAXException, ParserConfigurationException {
+        SAXParserFactory spf = SAXParserFactory.newInstance();
+        // Matches the LEVEL_4 secure variant exactly. Turning the external entities off still
+        // lets the document declare a DOCTYPE, which leaves the entity machinery reachable;
+        // refusing the declaration outright is the configuration that level called the
+        // recommended approach, and this endpoint has no legitimate need for a DOCTYPE.
+        spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        return spf;
+    }
+
     @AttackVector(vulnerabilityExposed = VulnerabilityType.XXE, description = "XXE_NO_VALIDATION")
     @VulnerableAppRequestMapping(
             value = LevelConstants.LEVEL_1,
@@ -70,17 +89,8 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Book>> getVulnerablePaylo
             HttpServletRequest request) {
         try {
             InputStream in = request.getInputStream();
-            JAXBContext jc = JAXBContext.newInstance(ObjectFactory.class);
-            Unmarshaller jaxbUnmarshaller = jc.createUnmarshaller();
-            @SuppressWarnings("unchecked")
-            JAXBElement<Book> bookJaxbElement =
-                    (JAXBElement<Book>) (jaxbUnmarshaller.unmarshal(in));
-            BookEntity bookEntity =
-                    new BookEntity(bookJaxbElement.getValue(), LevelConstants.LEVEL_1);
-            bookEntityRepository.save(bookEntity);
-            return new ResponseEntity<GenericVulnerabilityResponseBean<Book>>(
-                    new GenericVulnerabilityResponseBean<Book>(bookJaxbElement.getValue(), true),
-                    HttpStatus.OK);
+            return saveJaxBBasedBookInformation(
+                    entityFreeParserFactory(), in, LevelConstants.LEVEL_1);
         } catch (Exception e) {
             LOGGER.error(e);
         }
@@ -145,10 +155,8 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Book>> getVulnerablePaylo
             HttpServletRequest request) {
         try {
             InputStream in = request.getInputStream();
-            // Only disabling external Entities
-            SAXParserFactory spf = SAXParserFactory.newInstance();
-            spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
-            return saveJaxBBasedBookInformation(spf, in, LevelConstants.LEVEL_2);
+            return saveJaxBBasedBookInformation(
+                    entityFreeParserFactory(), in, LevelConstants.LEVEL_2);
         } catch (Exception e) {
             LOGGER.error(e);
         }
diff --git a/src/main/resources/application-unsafe.properties b/src/main/resources/application-unsafe.properties
index 8ce79d6ef..fb86579d7 100644
--- a/src/main/resources/application-unsafe.properties
+++ b/src/main/resources/application-unsafe.properties
@@ -4,8 +4,12 @@ spring.datasource.admin.password=hacker
 spring.datasource.application.username=application
 spring.datasource.application.password=hacker
 
-# Enabling H2 Console
-spring.h2.console.enabled=true
-spring.h2.console.settings.web-allow-others=true
+# The H2 console is a full database client. Serving it at all exposes every table the
+# application owns -- the credential vaults included -- and web-allow-others additionally
+# accepted connections from any host rather than just the loopback interface, so it was
+# reachable by anyone who could reach the app. The public profile already disables it; the
+# unsafe profile was switching it back on.
+spring.h2.console.enabled=false
+spring.h2.console.settings.web-allow-others=false
 
 vulnerableapp.email.base-url=http://localhost
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index a533e463e..5090c1c1b 100755
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -54,3 +54,9 @@ benchmark.dast.ground-truth.read-timeout-ms=10000
 ##Details for KeyPair generation in application
 #keytool -genkeypair -alias SasanLabs -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore sasanlabs.p12 -validity 3650
 #password for pkcs12, sasanlabs.p12 is "changeIt"
+
+# An upload with no ceiling lets a single request exhaust disk and heap. The container
+# limit is bounded here so the cap is enforced before the file is ever buffered, and the
+# handler answers 413 rather than surfacing a 500.
+spring.servlet.multipart.max-file-size=2MB
+spring.servlet.multipart.max-request-size=4MB
diff --git a/src/main/resources/scripts/Authentication/db/data.sql b/src/main/resources/scripts/Authentication/db/data.sql
index c1a7b3e3d..1d029ed9a 100644
--- a/src/main/resources/scripts/Authentication/db/data.sql
+++ b/src/main/resources/scripts/Authentication/db/data.sql
@@ -3,12 +3,13 @@
 INSERT INTO auth_users VALUES (1, 'admin_sqli', 'not_needed_for_sqli', NULL, 'PLAIN', 1, 'admin_sqli@example.com', 'ADMIN');
 
 -- Level 2: Sensitive Data Logging
--- Real password: 'v9K#2mLp!8zQ'
-INSERT INTO auth_users VALUES (2, 'admin_logs', 'v9K#2mLp!8zQ', NULL, 'PLAIN', 2, 'admin_logs@example.com', 'ADMIN');
+-- Real password: 'v9K#2mLp!8zQ', stored as a BCrypt hash (cost 12) rather than as the
+-- password itself, so read access to this table no longer yields the credential.
+INSERT INTO auth_users VALUES (2, 'admin_logs', '$2a$12$fM05hOHBeR7pSMJTpziVPuVVJdrYYRoQMpM2w2zob/HE92ynvrGJW', NULL, 'BCRYPT', 2, 'admin_logs@example.com', 'ADMIN');
 
--- Level 3: Plaintext Storage
+-- Level 3: password stored as a BCrypt (cost 12) hash rather than plaintext
 -- Real password: 'b7X$4nRj-6mW'
-INSERT INTO auth_users VALUES (3, 'admin_plain', 'b7X$4nRj-6mW', NULL, 'PLAIN', 3, 'admin_plain@example.com', 'ADMIN');
+INSERT INTO auth_users VALUES (3, 'admin_plain', '$2a$12$.hggXFP5QDRzs07jw.XGOeM5gB06vSHTlc.2MopApbTrpB4/4Nyvu', NULL, 'BCRYPT', 3, 'admin_plain@example.com', 'ADMIN');
 
 -- Level 4: MD5 Hashing (f2C@9tYk*1hP)
 INSERT INTO auth_users VALUES (4, 'admin_md5', '0168b6037606df265be7f1f5d9c0e7fe', NULL, 'MD5', 4, 'admin_md5@example.com', 'ADMIN');
@@ -22,14 +23,17 @@ INSERT INTO auth_users VALUES (6, 'admin_sha256', '8b8eca84f7e2b04f531749f999c3b
 -- Level 7: Salted SHA-256 (q1W%6nTp^8vM with Salt s9A#2zLk)
 INSERT INTO auth_users VALUES (7, 'admin_enum', '71ad23cc508b5658f0bc21d8323f55521be98ca951e83a4a4d15641a3ca2b8a4', 's9A#2zLk', 'SHA256', 7, 'admin_enum@example.com', 'ADMIN');
 
--- Level 8: Weak Password + Bcrypt (password123)
--- Bcrypt hash for 'password123'
-INSERT INTO auth_users VALUES (8, 'admin_weak', '$2a$10$gV2vZ5fxhZlwOP.GIqOI1.z7q5jws8VDmgIcKqY/uzvhzSUDio2sW', NULL, 'BCRYPT', 8, 'admin_weak@example.com', 'ADMIN');
+-- Level 8: Bcrypt (cost 12) over a high-entropy password instead of 'password123',
+-- which sits near the top of every credential-stuffing wordlist
+-- Bcrypt hash for 'T4v#9pQz!7mK^2wE'
+INSERT INTO auth_users VALUES (8, 'admin_weak', '$2a$12$65xIdRFf5Y7tCZtZWVzSwe.fvKz.lQE1.8i1hPJ5PfR2Ee48j04Na', NULL, 'BCRYPT', 8, 'admin_weak@example.com', 'ADMIN');
 
 -- Level 9: Secure (Bcrypt + Generic Error) (9fG#2hJk*LmN!8qR)
 -- Bcrypt hash for '9fG#2hJk*LmN!8qR'
 INSERT INTO auth_users VALUES (9, 'admin_secure', '$2a$10$1WiFUNqUY/vHTzR2QtuMQuzCLK3aZEdjEUpqS4msXOevaCz7Wobe.', NULL, 'BCRYPT', 9, 'admin_secure@example.com', 'ADMIN');
 
--- Level 10: Low-iteration BCrypt (cost factor 4)
--- Bcrypt hash (cost 4) for the common password 'sunshine'
-INSERT INTO auth_users VALUES (10, 'admin_lowcost', '$2a$04$rK/CT/Bz7GjjGLnB3WWjTOpMpNcGJzmoh.bdc7gQJ4DBQnKj9xnHC', NULL, 'BCRYPT_LOW_ITERATION', 10, 'admin_lowcost@example.com', 'ADMIN');
+-- Level 10: BCrypt at cost 12 rather than cost 4, over a high-entropy password.
+-- A cost-4 hash is roughly 256x cheaper to attack, which puts an offline crack of a
+-- common password like 'sunshine' within trivial reach.
+-- Bcrypt hash (cost 12) for 'R8k$3mVx!5nJ&1qT'
+INSERT INTO auth_users VALUES (10, 'admin_lowcost', '$2a$12$a5hCz.qigE7W1u.SLFolUuW2cCR2dJxHGGCeqnzP7ORFe/CQkBx5a', NULL, 'BCRYPT', 10, 'admin_lowcost@example.com', 'ADMIN');
diff --git a/src/main/resources/static/templates/JWTVulnerability/LEVEL_1/JWT_Level1.js b/src/main/resources/static/templates/JWTVulnerability/LEVEL_1/JWT_Level1.js
index f6f172a91..abb945482 100644
--- a/src/main/resources/static/templates/JWTVulnerability/LEVEL_1/JWT_Level1.js
+++ b/src/main/resources/static/templates/JWTVulnerability/LEVEL_1/JWT_Level1.js
@@ -20,9 +20,10 @@ addingEventListenerToVerifyToken();
 
 function updateUIWithVerifyResponse(data) {
   if (data.isValid) {
-    document.getElementById("verificationResponse").innerHTML = "JWT is valid";
+    document.getElementById("verificationResponse").textContent =
+      "JWT is valid";
   } else {
-    document.getElementById("verificationResponse").innerHTML =
+    document.getElementById("verificationResponse").textContent =
       "JWT: " + data.content + " is not valid. Please try again";
   }
 }
diff --git a/src/main/resources/static/templates/JWTVulnerability/LEVEL_13/HeaderInjection_Level13.js b/src/main/resources/static/templates/JWTVulnerability/LEVEL_13/HeaderInjection_Level13.js
index ec328d7f8..03cd2c4f6 100644
--- a/src/main/resources/static/templates/JWTVulnerability/LEVEL_13/HeaderInjection_Level13.js
+++ b/src/main/resources/static/templates/JWTVulnerability/LEVEL_13/HeaderInjection_Level13.js
@@ -19,14 +19,15 @@ addingEventListenerToVerifyToken();
 
 function updateUIWithVerifyResponse(data) {
   if (data.isValid) {
-    document.getElementById("verificationResponse").innerHTML = "JWT is valid";
+    document.getElementById("verificationResponse").textContent =
+      "JWT is valid";
   } else {
-    document.getElementById("verificationResponse").innerHTML =
+    document.getElementById("verificationResponse").textContent =
       "JWT: " + data.content + " is not valid. Please try again";
   }
 }
 
 function fetchTokenCallBack(data) {
-  document.getElementById("jwt").innerHTML = data.content;
+  document.getElementById("jwt").textContent = data.content;
   document.getElementById("description").style.visibility = "visible";
 }
diff --git a/src/main/resources/static/templates/JWTVulnerability/LEVEL_2/JWT_Level2.js b/src/main/resources/static/templates/JWTVulnerability/LEVEL_2/JWT_Level2.js
index ec328d7f8..37bec84b2 100644
--- a/src/main/resources/static/templates/JWTVulnerability/LEVEL_2/JWT_Level2.js
+++ b/src/main/resources/static/templates/JWTVulnerability/LEVEL_2/JWT_Level2.js
@@ -18,15 +18,20 @@ function addingEventListenerToVerifyToken() {
 addingEventListenerToVerifyToken();
 
 function updateUIWithVerifyResponse(data) {
-  if (data.isValid) {
-    document.getElementById("verificationResponse").innerHTML = "JWT is valid";
-  } else {
-    document.getElementById("verificationResponse").innerHTML =
-      "JWT: " + data.content + " is not valid. Please try again";
-  }
+  // The echoed token originates in a request cookie, so it is attacker controlled and is
+  // written as text rather than markup.
+  document.getElementById("verificationResponse").textContent = data.isValid
+    ? "JWT is valid"
+    : "The JWT is not valid. Please try again";
 }
 
 function fetchTokenCallBack(data) {
-  document.getElementById("jwt").innerHTML = data.content;
+  // Levels that keep the token in an HttpOnly cookie deliberately leave it out of the
+  // response body, so there is nothing here for script to read -- say so rather than
+  // rendering an empty value.
+  document.getElementById("jwt").textContent =
+    data.content == null
+      ? "The token was set in an HttpOnly cookie and is not readable by script."
+      : data.content;
   document.getElementById("description").style.visibility = "visible";
 }
diff --git a/src/main/resources/static/templates/JWTVulnerability/LEVEL_7/JWT_Level.js b/src/main/resources/static/templates/JWTVulnerability/LEVEL_7/JWT_Level.js
index dfd3f181b..8afb5eea0 100644
--- a/src/main/resources/static/templates/JWTVulnerability/LEVEL_7/JWT_Level.js
+++ b/src/main/resources/static/templates/JWTVulnerability/LEVEL_7/JWT_Level.js
@@ -30,15 +30,16 @@ addingEventListenerToVerifyToken();
 
 function updateUIWithVerifyResponse(data) {
   if (data.isValid) {
-    document.getElementById("verificationResponse").innerHTML = "JWT is valid";
+    document.getElementById("verificationResponse").textContent =
+      "JWT is valid";
   } else {
-    document.getElementById("verificationResponse").innerHTML =
+    document.getElementById("verificationResponse").textContent =
       "JWT: " + data.content + " is not valid. Please try again";
   }
 }
 
 function fetchTokenCallBack(data) {
-  document.getElementById("jwt").innerHTML = data.content;
+  document.getElementById("jwt").textContent = data.content;
   document.getElementById("description").style.visibility = "visible";
 }
 
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginServiceTest.java b/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginServiceTest.java
index 21b3aeeb7..a367ddb29 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginServiceTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthLoginServiceTest.java
@@ -48,7 +48,10 @@ void authenticateLevel1SQLi_ShouldReturnUser_WhenCredentialsMatch() {
                         1,
                         "a@e.com",
                         "ADMIN");
-        when(jdbcTemplate.query(anyString(), any(RowMapper.class))).thenReturn(Arrays.asList(user));
+        // The credentials are now bound as query parameters, so the call goes through the
+        // varargs overload of JdbcTemplate.query rather than the two argument one.
+        when(jdbcTemplate.query(anyString(), any(RowMapper.class), any(), any()))
+                .thenReturn(Arrays.asList(user));
 
         AuthLoginService.AuthResult result =
                 authLoginService.authenticateLevel1SQLi("admin_sqli", "pw");
@@ -67,9 +70,10 @@ void authenticateLevel2Logging_ShouldReturnUser_WhenPasswordMatches() {
                 new AuthUser(
                         2,
                         "admin_logs",
-                        "pw",
+                        // BCrypt hash of "pw" -- level 2 no longer holds the password itself.
+                        "$2a$12$FjvLo0uTkgBPBA/APqpC8u22O1m5WP0RzeWaIvwyvm2o2rDEIWFS6",
                         null,
-                        AuthUserAlgorithm.PLAIN,
+                        AuthUserAlgorithm.BCRYPT,
                         2,
                         "a@e.com",
                         "ADMIN");
@@ -169,24 +173,23 @@ void authenticate_Bcrypt_ShouldSucceed() {
     }
 
     @Test
-    void authenticate_UsernameEnumeration_ShouldReturnSpecificErrors() {
+    void authenticate_UsernameEnumeration_ShouldReturnGenericErrors() {
         AuthUser user =
                 new AuthUser(
                         7, "user7", "hash", "salt", AuthUserAlgorithm.PLAIN, 7, "u7@e.com", "USER");
         when(authUserRepository.findByUsernameAndLevel("user7", 7)).thenReturn(Optional.of(user));
         when(authUserRepository.findByUsernameAndLevel("eve", 7)).thenReturn(Optional.empty());
 
-        // Wrong password
+        // A wrong password and an unknown user are now indistinguishable to the caller.
         AuthLoginService.AuthResult wrongPw =
                 authLoginService.authenticateWithEnumeration("user7", "wrong", 7);
         assertFalse(wrongPw.isAuthenticated());
-        assertEquals("Invalid password", wrongPw.getErrorMessage());
+        assertEquals("Invalid credentials", wrongPw.getErrorMessage());
 
-        // Missing user
         AuthLoginService.AuthResult missingUser =
                 authLoginService.authenticateWithEnumeration("eve", "any", 7);
         assertFalse(missingUser.isAuthenticated());
-        assertEquals("User not found", missingUser.getErrorMessage());
+        assertEquals("Invalid credentials", missingUser.getErrorMessage());
     }
 
     @Test
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerabilityTest.java
index 17035f52c..d7cd8928d 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/authentication/AuthenticationVulnerabilityTest.java
@@ -73,7 +73,7 @@ void level2Logging_ShouldReturnProfile_WhenAuthenticated() {
     }
 
     @Test
-    void level3Plaintext_ShouldExposePasswordInResponse() {
+    void level3Plaintext_ShouldNotExposePasswordInResponse() {
         when(authLoginService.authenticate(eq("Alice"), anyString(), eq(3)))
                 .thenReturn(AuthLoginService.AuthResult.success(ALICE));
 
@@ -81,8 +81,9 @@ void level3Plaintext_ShouldExposePasswordInResponse() {
                 controller.level3Plaintext("Alice", "secret");
 
         Map<String, Object> profile = (Map<String, Object>) response.getBody().getContent();
-        // Leaks the password
-        assertEquals("p@ssword123", profile.get("passwordInDB"));
+        // The stored credential is no longer handed back to the caller
+        assertFalse(profile.containsKey("passwordInDB"));
+        assertEquals("Alice", profile.get("username"));
     }
 
     @Test
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerabilityTest.java
index 2ce292fef..2645f4b38 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/cachePoisoning/CachePoisoningVulnerabilityTest.java
@@ -40,6 +40,16 @@ class CachePoisoningVulnerabilityTest {
     private static final Pattern LAST_LOGIN_IP_PATTERN =
             Pattern.compile("Last login IP:</strong>\\s*(10\\.\\d+\\.\\d+\\.42)");
 
+    // Banners are HTML escaped on the way out, so the markup arrives inert.
+    private static final String ESCAPED_FILTERED_ATTACKER_BANNER =
+            "&lt;script&gt;alert(1)&lt;/script&gt;&lt;b&gt;ATUALIZACAO URGENTE FAKE&lt;/b&gt;";
+    private static final String ESCAPED_LEVEL_2_SAFE_HTML_BANNER =
+            "&lt;b&gt;SERVICE STATUS COMPROMISED&lt;/b&gt;";
+    private static final String ESCAPED_XSS_SCRIPT_BANNER =
+            "&lt;script&gt;alert(document.cookie)&lt;/script&gt;";
+    private static final String ESCAPED_EVENT_HANDLER_BYPASS_BANNER =
+            "&lt;img src=x onerror=alert(1)&gt;";
+
     private CachePoisoningVulnerability cachePoisoningVulnerability;
 
     @BeforeEach
@@ -53,8 +63,8 @@ void setUp() {
     }
 
     @Test
-    @DisplayName("Level 1 - Attacker poisons the route cache and victim gets a cached hit")
-    void level1ShouldPoisonSharedCacheAcrossRequests() {
+    @DisplayName("Level 1 - Attacker banner is keyed separately so the victim is not served it")
+    void level1ShouldNotPoisonSharedCacheAcrossRequests() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> attackerResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel1(
                         ATTACKER_BANNER, true, createLevel1Request("poison"));
@@ -75,13 +85,15 @@ void level1ShouldPoisonSharedCacheAcrossRequests() {
                         victimResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(victimResponse.getBody().getContent()).contains(ATTACKER_BANNER);
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
+        assertThat(victimResponse.getBody().getContent())
+                .contains(SAFE_BANNER)
+                .doesNotContain(ATTACKER_BANNER);
     }
 
     @Test
-    @DisplayName("Level 1 - Cache key ignores the banner query parameter")
-    void level1ShouldUseOnlyRouteAsCacheKey() {
+    @DisplayName("Level 1 - Cache key includes the banner query parameter")
+    void level1ShouldIncludeBannerInCacheKey() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> firstResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel1(
                         "FIRST BANNER", true, createLevel1Request("FIRST"));
@@ -93,19 +105,19 @@ void level1ShouldUseOnlyRouteAsCacheKey() {
                         firstResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_KEY_HEADER))
-                .isEqualTo(LEVEL_1_PATH);
+                .isEqualTo(LEVEL_1_PATH + "|banner=FIRST BANNER");
         assertThat(
                         secondResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_KEY_HEADER))
-                .isEqualTo(LEVEL_1_PATH);
+                .isEqualTo(LEVEL_1_PATH + "|banner=SECOND BANNER");
         assertThat(
                         secondResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(secondResponse.getBody().getContent()).contains("FIRST BANNER");
-        assertThat(secondResponse.getBody().getContent()).doesNotContain("SECOND BANNER");
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
+        assertThat(secondResponse.getBody().getContent()).contains("SECOND BANNER");
+        assertThat(secondResponse.getBody().getContent()).doesNotContain("FIRST BANNER");
     }
 
     @Test
@@ -134,8 +146,8 @@ void level1ShouldEmitSharedOnlyCacheControlWhenBrowserCacheDisabled() {
     }
 
     @Test
-    @DisplayName("Level 1 - Reflected script payload is cached and replayed to the victim")
-    void level1ShouldCacheReflectedScriptPayloadForVictim() {
+    @DisplayName("Level 1 - Reflected script payload is escaped and never replayed to the victim")
+    void level1ShouldEscapeReflectedScriptPayload() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> attackerResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel1(
                         XSS_SCRIPT_BANNER, true, createLevel1Request("xss"));
@@ -144,15 +156,19 @@ void level1ShouldCacheReflectedScriptPayloadForVictim() {
                         null, true, createLevel1Request(null));
 
         assertValidResponse(attackerResponse);
-        assertThat(attackerResponse.getBody().getContent()).contains(XSS_SCRIPT_BANNER);
+        assertThat(attackerResponse.getBody().getContent())
+                .contains(ESCAPED_XSS_SCRIPT_BANNER)
+                .doesNotContain(XSS_SCRIPT_BANNER);
 
         assertValidResponse(victimResponse);
         assertThat(
                         victimResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(victimResponse.getBody().getContent()).contains(XSS_SCRIPT_BANNER);
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
+        assertThat(victimResponse.getBody().getContent())
+                .contains(SAFE_BANNER)
+                .doesNotContain(XSS_SCRIPT_BANNER);
     }
 
     @Test
@@ -189,8 +205,8 @@ void level1ShouldClearCacheWhenRequested() {
     }
 
     @Test
-    @DisplayName("Level 2 - Naive filtering still allows poisoning with harmless-looking HTML")
-    void level2ShouldPoisonSharedCacheDespiteNaiveFilter() {
+    @DisplayName("Level 2 - Escaping neutralises the HTML and the victim keeps the default banner")
+    void level2ShouldNotPoisonSharedCacheAfterEscaping() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> attackerResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel2(
                         FILTERED_ATTACKER_BANNER, true, createLevelRequest(LEVEL_2_PATH, "poison"));
@@ -205,23 +221,24 @@ void level2ShouldPoisonSharedCacheDespiteNaiveFilter() {
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
         assertThat(attackerResponse.getBody().getContent())
-                .contains("<b>ATUALIZACAO URGENTE FAKE</b>")
+                .contains(ESCAPED_FILTERED_ATTACKER_BANNER)
                 .doesNotContain("<script>")
-                .doesNotContain("alert(1)");
+                .doesNotContain("<b>ATUALIZACAO URGENTE FAKE</b>");
 
         assertValidResponse(victimResponse);
         assertThat(
                         victimResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
         assertThat(victimResponse.getBody().getContent())
-                .contains("<b>ATUALIZACAO URGENTE FAKE</b>");
+                .contains(SAFE_BANNER)
+                .doesNotContain("ATUALIZACAO URGENTE FAKE");
     }
 
     @Test
-    @DisplayName("Level 2 - Cache key still ignores the banner after the superficial fix")
-    void level2ShouldKeepUsingOnlyRouteAsCacheKey() {
+    @DisplayName("Level 2 - Cache key includes the banner as well")
+    void level2ShouldIncludeBannerInCacheKey() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> firstResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel2(
                         LEVEL_2_SAFE_HTML_BANNER, true, createLevelRequest(LEVEL_2_PATH, "FIRST"));
@@ -233,24 +250,26 @@ void level2ShouldKeepUsingOnlyRouteAsCacheKey() {
                         firstResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_KEY_HEADER))
-                .isEqualTo(LEVEL_2_PATH);
+                .isEqualTo(LEVEL_2_PATH + "|banner=" + LEVEL_2_SAFE_HTML_BANNER);
         assertThat(
                         secondResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_KEY_HEADER))
-                .isEqualTo(LEVEL_2_PATH);
+                .isEqualTo(LEVEL_2_PATH + "|banner=<i>SECOND BANNER</i>");
         assertThat(
                         secondResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(secondResponse.getBody().getContent()).contains(LEVEL_2_SAFE_HTML_BANNER);
-        assertThat(secondResponse.getBody().getContent()).doesNotContain("<i>SECOND BANNER</i>");
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
+        assertThat(secondResponse.getBody().getContent())
+                .contains("&lt;i&gt;SECOND BANNER&lt;/i&gt;");
+        assertThat(secondResponse.getBody().getContent())
+                .doesNotContain(ESCAPED_LEVEL_2_SAFE_HTML_BANNER);
     }
 
     @Test
-    @DisplayName("Level 2 - Naive filter does not strip event handlers, allowing XSS through cache")
-    void level2FilterShouldNotStripEventHandlerXssPayload() {
+    @DisplayName("Level 2 - Event handler payload is escaped rather than filtered")
+    void level2ShouldEscapeEventHandlerXssPayload() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> attackerResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel2(
                         EVENT_HANDLER_BYPASS_BANNER,
@@ -261,29 +280,32 @@ void level2FilterShouldNotStripEventHandlerXssPayload() {
                         null, true, createLevelRequest(LEVEL_2_PATH, null));
 
         assertValidResponse(attackerResponse);
-        assertThat(attackerResponse.getBody().getContent()).contains(EVENT_HANDLER_BYPASS_BANNER);
+        assertThat(attackerResponse.getBody().getContent())
+                .contains(ESCAPED_EVENT_HANDLER_BYPASS_BANNER)
+                .doesNotContain(EVENT_HANDLER_BYPASS_BANNER);
 
         assertValidResponse(victimResponse);
         assertThat(
                         victimResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(victimResponse.getBody().getContent()).contains(EVENT_HANDLER_BYPASS_BANNER);
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
+        assertThat(victimResponse.getBody().getContent())
+                .contains(SAFE_BANNER)
+                .doesNotContain(EVENT_HANDLER_BYPASS_BANNER);
     }
 
     @Test
-    @DisplayName(
-            "Level 2 - Naive filter strips the javascript: scheme but keeps surrounding markup")
-    void level2FilterShouldStripJavascriptScheme() {
+    @DisplayName("Level 2 - javascript: scheme survives only as inert escaped text")
+    void level2ShouldEscapeJavascriptScheme() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel2(
                         JAVASCRIPT_SCHEME_BANNER, true, createLevelRequest(LEVEL_2_PATH, "scheme"));
 
         assertValidResponse(response);
         assertThat(response.getBody().getContent())
-                .contains("<a href=\"alert(1)\">click</a>")
-                .doesNotContain("javascript:");
+                .contains("&lt;a href=&quot;javascript:alert(1)&quot;&gt;click&lt;/a&gt;")
+                .doesNotContain("<a href");
     }
 
     @Test
@@ -302,12 +324,12 @@ void level2ShouldClearCacheWhenRequested() {
 
         assertValidResponse(attackerResponse);
         assertThat(attackerResponse.getBody().getContent())
-                .contains("<b>ATUALIZACAO URGENTE FAKE</b>");
+                .contains(ESCAPED_FILTERED_ATTACKER_BANNER);
 
         assertClearCacheResponse(clearResponse, CachePoisoningVulnerability.CACHE_CONTROL_PUBLIC);
         assertThat(clearResponse.getBody().getContent())
                 .contains(SAFE_BANNER)
-                .doesNotContain("<b>ATUALIZACAO URGENTE FAKE</b>");
+                .doesNotContain("ATUALIZACAO URGENTE FAKE");
 
         assertValidResponse(victimResponse);
         assertThat(
@@ -317,13 +339,12 @@ void level2ShouldClearCacheWhenRequested() {
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
         assertThat(victimResponse.getBody().getContent())
                 .contains(SAFE_BANNER)
-                .doesNotContain("<b>ATUALIZACAO URGENTE FAKE</b>");
+                .doesNotContain("ATUALIZACAO URGENTE FAKE");
     }
 
     @Test
-    @DisplayName(
-            "Level 3 - Forwarded host poisons the shared cache even after banner joins the key")
-    void level3ShouldPoisonSharedCacheThroughUnkeyedForwardedHost() {
+    @DisplayName("Level 3 - Forwarded host is ignored so it cannot poison the shared cache")
+    void level3ShouldIgnoreUnkeyedForwardedHost() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> attackerResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel3(
                         LEVEL_3_SHARED_BANNER,
@@ -343,7 +364,11 @@ void level3ShouldPoisonSharedCacheThroughUnkeyedForwardedHost() {
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
         assertThat(attackerResponse.getBody().getContent())
-                .contains("https://" + ATTACKER_HOST + "/assets/cache-poisoning-demo.js");
+                .contains(
+                        "https://"
+                                + CachePoisoningVulnerability.TRUSTED_ASSET_HOST
+                                + "/assets/cache-poisoning-demo.js")
+                .doesNotContain(ATTACKER_HOST);
 
         assertValidResponse(victimResponse);
         assertThat(
@@ -352,11 +377,15 @@ void level3ShouldPoisonSharedCacheThroughUnkeyedForwardedHost() {
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
         assertThat(victimResponse.getBody().getContent())
-                .contains("https://" + ATTACKER_HOST + "/assets/cache-poisoning-demo.js");
+                .contains(
+                        "https://"
+                                + CachePoisoningVulnerability.TRUSTED_ASSET_HOST
+                                + "/assets/cache-poisoning-demo.js")
+                .doesNotContain(ATTACKER_HOST);
     }
 
     @Test
-    @DisplayName("Level 3 - Cache key now includes the banner but still ignores X-Forwarded-Host")
+    @DisplayName("Level 3 - Cache key includes the banner and the asset host is always trusted")
     void level3ShouldIncludeBannerInCacheKey() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> firstResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel3(
@@ -385,8 +414,12 @@ void level3ShouldIncludeBannerInCacheKey() {
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
         assertThat(secondResponse.getBody().getContent())
-                .contains("https://" + SAFE_HOST + "/assets/cache-poisoning-demo.js")
-                .doesNotContain("https://" + ATTACKER_HOST + "/assets/cache-poisoning-demo.js");
+                .contains(
+                        "https://"
+                                + CachePoisoningVulnerability.TRUSTED_ASSET_HOST
+                                + "/assets/cache-poisoning-demo.js")
+                .doesNotContain(SAFE_HOST)
+                .doesNotContain(ATTACKER_HOST);
     }
 
     @Test
@@ -409,11 +442,11 @@ void level3ShouldClearCacheWhenRequested() {
                         createLevelRequest(LEVEL_3_PATH, LEVEL_3_SHARED_BANNER, null, null));
 
         assertValidResponse(attackerResponse);
-        assertThat(attackerResponse.getBody().getContent()).contains(ATTACKER_HOST);
+        assertThat(attackerResponse.getBody().getContent()).doesNotContain(ATTACKER_HOST);
 
         assertClearCacheResponse(clearResponse, CachePoisoningVulnerability.CACHE_CONTROL_PUBLIC);
         assertThat(clearResponse.getBody().getContent())
-                .contains(CachePoisoningVulnerability.DEFAULT_UNTRUSTED_HOST)
+                .contains(CachePoisoningVulnerability.TRUSTED_ASSET_HOST)
                 .doesNotContain(ATTACKER_HOST);
 
         assertValidResponse(victimResponse);
@@ -423,13 +456,13 @@ void level3ShouldClearCacheWhenRequested() {
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
         assertThat(victimResponse.getBody().getContent())
-                .contains(CachePoisoningVulnerability.DEFAULT_UNTRUSTED_HOST)
+                .contains(CachePoisoningVulnerability.TRUSTED_ASSET_HOST)
                 .doesNotContain(ATTACKER_HOST);
     }
 
     @Test
-    @DisplayName("Level 4 - Public caching leaks personalized cookie content to another visitor")
-    void level4ShouldLeakPersonalizedContentAcrossUsers() {
+    @DisplayName("Level 4 - Personalized content is private and never reused for another visitor")
+    void level4ShouldNotLeakPersonalizedContentAcrossUsers() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> attackerResponse =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel4(
                         true,
@@ -441,7 +474,7 @@ void level4ShouldLeakPersonalizedContentAcrossUsers() {
 
         assertValidResponse(attackerResponse);
         assertThat(attackerResponse.getHeaders().getCacheControl())
-                .isEqualTo(CachePoisoningVulnerability.CACHE_CONTROL_PUBLIC);
+                .isEqualTo(CachePoisoningVulnerability.CACHE_CONTROL_PRIVATE_NO_STORE);
         assertThat(
                         attackerResponse
                                 .getHeaders()
@@ -454,15 +487,15 @@ void level4ShouldLeakPersonalizedContentAcrossUsers() {
                         victimResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(victimResponse.getBody().getContent()).contains(ATTACKER_USER);
-        assertThat(victimResponse.getBody().getContent()).doesNotContain("guest");
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
+        assertThat(victimResponse.getBody().getContent()).contains("guest");
+        assertThat(victimResponse.getBody().getContent()).doesNotContain(ATTACKER_USER);
     }
 
     @Test
-    @DisplayName("Level 4 - Derived email leaks from the personalized response across users")
-    void level4ShouldLeakDerivedEmailAcrossUsers() {
-        String expectedEmail = ATTACKER_USER + "@" + CachePoisoningVulnerability.DEMO_USER_DOMAIN;
+    @DisplayName("Level 4 - Derived email does not leak from the personalized response")
+    void level4ShouldNotLeakDerivedEmailAcrossUsers() {
+        String attackerEmail = ATTACKER_USER + "@" + CachePoisoningVulnerability.DEMO_USER_DOMAIN;
 
         cachePoisoningVulnerability.getVulnerablePayloadLevel4(
                 true, createLevelRequest(LEVEL_4_PATH, null, null, demoUserCookie(ATTACKER_USER)));
@@ -475,8 +508,8 @@ void level4ShouldLeakDerivedEmailAcrossUsers() {
                         victimResponse
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
-                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(victimResponse.getBody().getContent()).contains(expectedEmail);
+                .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
+        assertThat(victimResponse.getBody().getContent()).doesNotContain(attackerEmail);
     }
 
     @Test
@@ -652,26 +685,29 @@ void clearCacheShouldOnlyEvictTargetedLevel() {
 
         cachePoisoningVulnerability.clearCache(LevelConstants.LEVEL_1, createClearCacheRequest());
 
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> level1Victim =
+        // The banner is part of the cache key, so both follow-up requests repeat the original
+        // banner -- otherwise they would miss on a different key rather than on eviction.
+        ResponseEntity<GenericVulnerabilityResponseBean<String>> level1Repeat =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel1(
-                        null, true, createLevel1Request(null));
-        ResponseEntity<GenericVulnerabilityResponseBean<String>> level2Victim =
+                        ATTACKER_BANNER, true, createLevel1Request("poison-l1"));
+        ResponseEntity<GenericVulnerabilityResponseBean<String>> level2Repeat =
                 cachePoisoningVulnerability.getVulnerablePayloadLevel2(
-                        null, true, createLevelRequest(LEVEL_2_PATH, null));
+                        FILTERED_ATTACKER_BANNER,
+                        true,
+                        createLevelRequest(LEVEL_2_PATH, "poison-l2"));
 
         assertThat(
-                        level1Victim
+                        level1Repeat
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_MISS);
-        assertThat(level1Victim.getBody().getContent()).doesNotContain(ATTACKER_BANNER);
 
         assertThat(
-                        level2Victim
+                        level2Repeat
                                 .getHeaders()
                                 .getFirst(CachePoisoningVulnerability.CACHE_STATUS_HEADER))
                 .isEqualTo(CachePoisoningVulnerability.CACHE_STATUS_HIT);
-        assertThat(level2Victim.getBody().getContent()).contains("<b>ATUALIZACAO URGENTE FAKE</b>");
+        assertThat(level2Repeat.getBody().getContent()).contains(ESCAPED_FILTERED_ATTACKER_BANNER);
     }
 
     @Test
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java
index d0832dda3..4ed49a38e 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/clickjacking/ClickjackingVulnerabilityTest.java
@@ -25,34 +25,37 @@ void setUp() {
     }
 
     @Test
-    @DisplayName("Level 1 - No X-Frame-Options header present, page fully vulnerable")
+    @DisplayName("Level 1 - framing protection headers are now set")
     void test_Level1_NoFramingProtection_HeaderAbsent() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 clickjackingVulnerability.noFramingProtection();
 
         assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
-        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).isNull();
-        assertThat(response.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(response.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
     }
 
     @Test
-    @DisplayName("Level 2 - X-Frame-Options: ALLOWALL permits embedding from any origin")
+    @DisplayName("Level 2 - ALLOWALL is replaced by DENY so embedding is refused")
     void test_Level2_XFrameOptions_ALLOWALL() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 clickjackingVulnerability.xFrameOptionsAllowAll();
 
         assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
-        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("ALLOWALL");
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("ALLOWALL");
     }
 
     @Test
-    @DisplayName("Level 3 - X-Frame-Options: SAMEORIGIN allows same-origin framing")
+    @DisplayName("Level 3 - SAMEORIGIN is replaced by DENY so same-origin framing is refused too")
     void test_Level3_XFrameOptions_SAMEORIGIN() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 clickjackingVulnerability.xFrameOptionsSameOrigin();
 
         assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
-        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("SAMEORIGIN");
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("SAMEORIGIN");
     }
 
     @Test
@@ -77,28 +80,31 @@ void test_Level5_CSP_FrameAncestors_None() {
     }
 
     @Test
-    @DisplayName("Level 6 - Overlay attack with no framing protection, no headers set")
+    @DisplayName("Level 6 - Overlay attack level now sets framing protection headers")
     void test_Level6_OverlayAttack_NoProtection() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 clickjackingVulnerability.overlayAttackNoProtection();
 
         assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
-        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).isNull();
-        assertThat(response.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(response.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
     }
 
     @Test
-    @DisplayName("Level 7 - Overlay attack with SAMEORIGIN still allows same-origin attack")
+    @DisplayName("Level 7 - Overlay attack level no longer relies on SAMEORIGIN")
     void test_Level7_OverlayAttack_SameOrigin() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 clickjackingVulnerability.overlayAttackSameOrigin();
 
         assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
-        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("SAMEORIGIN");
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(response.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("SAMEORIGIN");
     }
 
     @Test
-    @DisplayName("Vulnerable levels (1, 2, 3, 6, 7) do not set DENY or frame-ancestors none")
+    @DisplayName(
+            "Previously vulnerable levels (1, 2, 3, 6, 7) all set DENY and frame-ancestors none")
     void test_VulnerableLevels_DoNotHaveSecureHeaders() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> level1 =
                 clickjackingVulnerability.noFramingProtection();
@@ -111,16 +117,21 @@ void test_VulnerableLevels_DoNotHaveSecureHeaders() {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> level7 =
                 clickjackingVulnerability.overlayAttackSameOrigin();
 
-        assertThat(level1.getHeaders().get(X_FRAME_OPTIONS)).isNull();
-        assertThat(level2.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("DENY");
-        assertThat(level3.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("DENY");
-        assertThat(level6.getHeaders().get(X_FRAME_OPTIONS)).isNull();
-        assertThat(level7.getHeaders().get(X_FRAME_OPTIONS)).doesNotContain("DENY");
-
-        assertThat(level1.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
-        assertThat(level2.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
-        assertThat(level3.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
-        assertThat(level6.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
-        assertThat(level7.getHeaders().get(CONTENT_SECURITY_POLICY)).isNull();
+        assertThat(level1.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(level2.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(level3.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(level6.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+        assertThat(level7.getHeaders().get(X_FRAME_OPTIONS)).contains("DENY");
+
+        assertThat(level1.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
+        assertThat(level2.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
+        assertThat(level3.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
+        assertThat(level6.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
+        assertThat(level7.getHeaders().get(CONTENT_SECURITY_POLICY))
+                .contains("frame-ancestors 'none'");
     }
 }
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUploadTest.java b/src/test/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUploadTest.java
index ef64de0f4..22bf464ff 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUploadTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/fileupload/UnrestrictedFileUploadTest.java
@@ -40,8 +40,9 @@ void test_getVulnerablePayloadLevel1() throws Exception {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 fileUpload.getVulnerablePayloadLevel1(file);
 
-        assertThat(response.getBody().getIsValid()).isTrue();
-        assertThat(tempRoot.resolve("test.html")).exists();
+        // .html is not an allowed upload extension, so nothing is written
+        assertThat(response.getBody().getIsValid()).isFalse();
+        assertThat(tempRoot.resolve("test.html")).doesNotExist();
     }
 
     @Test
@@ -95,7 +96,8 @@ void test_getVulnerablePayloadLevel6() throws Exception {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 fileUpload.getVulnerablePayloadLevel6(file);
 
-        assertThat(response.getBody().getIsValid()).isTrue();
+        // The name must END with an image extension, so "malicious.png.html" is refused
+        assertThat(response.getBody().getIsValid()).isFalse();
     }
 
     @Test
@@ -108,16 +110,16 @@ void test_getVulnerablePayloadLevel7() throws Exception {
                 fileUpload.getVulnerablePayloadLevel7(file);
 
         assertThat(response.getBody().getIsValid())
-                .withFailMessage("Level 7 validation should pass for null byte suffix")
-                .isTrue();
+                .withFailMessage("Level 7 must refuse a null-byte truncated name")
+                .isFalse();
 
         try (Stream<Path> files = Files.list(tempRoot)) {
             List<String> fileNames =
                     files.map(p -> p.getFileName().toString()).collect(Collectors.toList());
 
             assertThat(fileNames)
-                    .withFailMessage("Expected truncated .php file, but found: %s", fileNames)
-                    .anyMatch(name -> name.contains("shell.php") && !name.endsWith(".png"));
+                    .withFailMessage("No .php file should have been written, found: %s", fileNames)
+                    .noneMatch(name -> name.contains("shell.php"));
         }
     }
 
@@ -170,7 +172,8 @@ void test_getVulnerablePayloadLevel9() throws Exception {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 fileUpload.getVulnerablePayloadLevel9(file);
 
-        assertThat(response.getBody().getIsValid()).isTrue();
+        // .txt is not an allowed upload extension
+        assertThat(response.getBody().getIsValid()).isFalse();
     }
 
     @Test
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
index 12b3b1cbd..26a7fbd9b 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
@@ -34,28 +34,44 @@ void setup() {
     }
 
     @Test
-    void level1_ShouldAllowAccessToAnyId() {
+    void level1_ShouldDenyAccessToAnotherUsersId() {
         String validToken = "valid-token";
         User decoded = new User();
         decoded.setUserId(1);
         decoded.setRole("USER");
-        User bob = new User(2, "Bob", 60000, "USER");
+
+        when(idorLoginService.decodeToken(validToken)).thenReturn(decoded);
+
+        ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
+                idor.level1(validToken, 2);
+
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("Access Denied - Insufficient privileges", response.getBody().getContent());
+    }
+
+    @Test
+    void level1_ShouldAllowAccessToOwnId() {
+        String validToken = "valid-token";
+        User decoded = new User();
+        decoded.setUserId(1);
+        decoded.setRole("USER");
+        User alice = new User(1, "Alice", 50000, "USER");
 
         when(idorLoginService.decodeToken(validToken)).thenReturn(decoded);
         when(jdbcTemplate.query(
                         anyString(),
                         any(Object[].class),
                         any(org.springframework.jdbc.core.RowMapper.class)))
-                .thenReturn(Arrays.asList(bob));
+                .thenReturn(Arrays.asList(alice));
 
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
-                idor.level1(validToken, 2);
+                idor.level1(validToken, 1);
 
         assertTrue(response.getBody().getIsValid());
     }
 
     @Test
-    void level2_ShouldAllowCookieTampering() {
+    void level2_ShouldResolveProfileFromTokenNotCookie() {
         String validToken = "valid-token-level2";
         User decoded = new User();
         decoded.setUserId(1);
@@ -76,7 +92,7 @@ void level2_ShouldAllowCookieTampering() {
     }
 
     @Test
-    void level3_ShouldAllowRoleEscalationWhenRoleCookieIsAdmin() {
+    void level3_ShouldIgnoreAdminRoleCookie() {
         String fakeToken =
                 java.util.Base64.getEncoder()
                         .encodeToString("{\"userId\":2,\"role\":\"USER\"}".getBytes());
@@ -84,23 +100,23 @@ void level3_ShouldAllowRoleEscalationWhenRoleCookieIsAdmin() {
         User decoded = new User();
         decoded.setUserId(2);
         decoded.setRole("USER");
-        User bob = new User(3, "Charlie", 70000, "USER");
 
         when(idorLoginService.decodeToken(fakeToken)).thenReturn(decoded);
         when(jdbcTemplate.query(
-                        anyString(),
+                        eq(SQL_ROLE_BY_ID),
                         any(Object[].class),
                         any(org.springframework.jdbc.core.RowMapper.class)))
-                .thenReturn(Arrays.asList(bob));
+                .thenReturn(Arrays.asList("USER"));
 
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
                 idor.level3(fakeToken, "ADMIN", 3);
 
-        assertTrue(response.getBody().getIsValid());
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("Access Denied - Insufficient privileges", response.getBody().getContent());
     }
 
     @Test
-    void level4_ShouldAllowOpaqueIdAccess() {
+    void level4_ShouldIgnoreEncodedAdminRoleCookie() {
         String encodedRole =
                 java.util.Base64.getUrlEncoder()
                         .withoutPadding()
@@ -112,19 +128,19 @@ void level4_ShouldAllowOpaqueIdAccess() {
         User decoded = new User();
         decoded.setUserId(1);
         decoded.setRole("USER");
-        User bob = new User(2, "Bob", 60000, "USER");
 
         when(idorLoginService.decodeToken(escalatedToken)).thenReturn(decoded);
         when(jdbcTemplate.query(
-                        anyString(),
+                        eq(SQL_ROLE_BY_ID),
                         any(Object[].class),
                         any(org.springframework.jdbc.core.RowMapper.class)))
-                .thenReturn(Arrays.asList(bob));
+                .thenReturn(Arrays.asList("USER"));
 
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
                 idor.level4(escalatedToken, encodedRole, 2);
 
-        assertTrue(response.getBody().getIsValid());
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("Access Denied - Insufficient privileges", response.getBody().getContent());
     }
 
     @Test
@@ -173,14 +189,10 @@ void level3_ShouldRejectInvalidToken() {
     }
 
     @Test
-    void level4_ShouldAllowAccessToAnyOpaqueIdRegardlessOfRole() {
+    void level4_ShouldAllowAdminFromDatabase() {
         String userToken =
                 java.util.Base64.getEncoder()
                         .encodeToString("{\"userId\":1,\"role\":\"USER\"}".getBytes());
-        String encodedRole =
-                java.util.Base64.getUrlEncoder()
-                        .withoutPadding()
-                        .encodeToString("ADMIN".getBytes());
 
         User decoded = new User();
         decoded.setUserId(1);
@@ -189,13 +201,18 @@ void level4_ShouldAllowAccessToAnyOpaqueIdRegardlessOfRole() {
 
         when(idorLoginService.decodeToken(userToken)).thenReturn(decoded);
         when(jdbcTemplate.query(
-                        anyString(),
+                        eq(SQL_ROLE_BY_ID),
+                        any(Object[].class),
+                        any(org.springframework.jdbc.core.RowMapper.class)))
+                .thenReturn(Arrays.asList("ADMIN"));
+        when(jdbcTemplate.query(
+                        eq(SQL_PROFILE_BY_ID),
                         any(Object[].class),
                         any(org.springframework.jdbc.core.RowMapper.class)))
                 .thenReturn(Arrays.asList(bob));
 
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
-                idor.level4(userToken, encodedRole, 2);
+                idor.level4(userToken, null, 2);
 
         assertTrue(response.getBody().getIsValid());
     }
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerabilityTest.java
index 1ecc8ef60..99e5bd66a 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/jwt/JWTVulnerabilityTest.java
@@ -33,7 +33,6 @@ class JWTVulnerabilityTest {
     private static JWTVulnerability jwtVulnerability;
     private static String invalidToken;
     private static String validHighStrengthToken;
-    private static String validLowStrengthToken;
     private static String validAsymmetricToken;
     private static String validAsymmetricTokenWithJwk;
     private static HashMap<String, String> fetchQuery;
@@ -43,10 +42,12 @@ class JWTVulnerabilityTest {
     @BeforeAll
     static void setUpAll() throws UnsupportedEncodingException, ServiceApplicationException {
         IJWTTokenGenerator jwtTokenGenerator = new LibBasedJWTGenerator();
-        validHighStrengthToken = createSymmetricToken(KeyStrength.HIGH, jwtTokenGenerator);
-        invalidToken = validHighStrengthToken + "1";
-        validLowStrengthToken = createSymmetricToken(KeyStrength.LOW, jwtTokenGenerator);
+        // The signing secrets are generated per JWTAlgorithmKMS instance, so the token has to
+        // be signed with the very instance the endpoint will verify against.
         jwtAlgorithmKmsSpy = spy(new JWTAlgorithmKMS());
+        validHighStrengthToken =
+                createSymmetricToken(KeyStrength.HIGH, jwtTokenGenerator, jwtAlgorithmKmsSpy);
+        invalidToken = validHighStrengthToken + "1";
         validAsymmetricToken = createAsymmetricToken(jwtTokenGenerator, jwtAlgorithmKmsSpy);
         validAsymmetricTokenWithJwk =
                 createAsymmetricTokenWithJwk(jwtTokenGenerator, jwtAlgorithmKmsSpy);
@@ -58,11 +59,13 @@ static void setUpAll() throws UnsupportedEncodingException, ServiceApplicationEx
     }
 
     private static String createSymmetricToken(
-            KeyStrength keyStrength, IJWTTokenGenerator jwtTokenGenerator)
+            KeyStrength keyStrength,
+            IJWTTokenGenerator jwtTokenGenerator,
+            JWTAlgorithmKMS jwtAlgorithmKMS)
             throws UnsupportedEncodingException, ServiceApplicationException {
         Optional<SymmetricAlgorithmKey> symmetricAlgorithmKey =
-                new JWTAlgorithmKMS()
-                        .getSymmetricAlgorithmKey(JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, keyStrength);
+                jwtAlgorithmKMS.getSymmetricAlgorithmKey(
+                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM, keyStrength);
         assertTrue(symmetricAlgorithmKey.isPresent(), "SymmetricAlgorithmKey should be present");
         return jwtTokenGenerator.getHMACSignedJWTToken(
                 JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
@@ -145,9 +148,10 @@ private void assertTokenInCookie(
                 cookie.contains(JWTVulnerability.JWT_COOKIE_KEY),
                 "Cookie should contain the JWT cookie key");
         assertTrue(cookie.contains(expectedToken), "Cookie should contain the JWT token");
+        // Cookie attribute names are case insensitive, so match them that way.
         assertSame(
                 httpOnlyExpected,
-                cookie.contains("httponly"),
+                cookie.toLowerCase(java.util.Locale.ROOT).contains("httponly"),
                 "Cookie should" + (!httpOnlyExpected ? " NOT " : "") + "contain HttpOnly flag");
     }
 
@@ -169,39 +173,56 @@ private static void verifySymmetricAlgorithmKeyCreation(KeyStrength keyStrength)
     }
 
     @Test
-    @DisplayName("Level 1 - Test that a token is generated if none is submitted")
+    @DisplayName("Level 1 - Test that a token is issued in a cookie, not the body, if none is sent")
     void testLevel1Creation() throws Exception {
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
-                jwtVulnerability.getVulnerablePayloadLevelUnsecure(new HashMap<>());
+                jwtVulnerability.getVulnerablePayloadLevelUnsecure(
+                        RequestEntity.get("/").build(), new HashMap<>());
         assertValidOkResponse(response);
         assertNotNull(response.getBody(), "Response body should not be null");
-        assertTokenInBody(response);
+        assertNoTokenInBody(response);
+        assertTrue(
+                response.getHeaders()
+                        .getFirst(HttpHeaders.SET_COOKIE)
+                        .toLowerCase(java.util.Locale.ROOT)
+                        .contains("httponly"),
+                "Issued cookie should carry the HttpOnly flag");
         verifySymmetricAlgorithmKeyCreation(KeyStrength.HIGH);
     }
 
     @Test
-    @DisplayName("Level 1 - Test that a valid token is validated successfully")
+    @DisplayName("Level 1 - Test that a valid token cookie is validated successfully")
     void testLevel1SuccessfulValidation() throws Exception {
+        ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
+                jwtVulnerability.getVulnerablePayloadLevelUnsecure(
+                        getCookieTokenRequest(validHighStrengthToken), new HashMap<>());
+        assertValidOkResponse(response);
+        assertNoTokenInBody(response);
+    }
+
+    @Test
+    @DisplayName("Level 1 - Test that a token supplied in the URL is rejected, not ignored")
+    void testLevel1UrlSuppliedTokenIsRejected() throws Exception {
         HashMap<String, String> query = new HashMap<>();
         query.put(JWTVulnerability.JWT, validHighStrengthToken);
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
-                jwtVulnerability.getVulnerablePayloadLevelUnsecure(query);
-        assertValidOkResponse(response);
+                jwtVulnerability.getVulnerablePayloadLevelUnsecure(
+                        RequestEntity.get("/").build(), query);
+
+        // Even a correctly signed token is refused when it arrives in the query string, so a
+        // forged one can never be mistaken for accepted.
+        assertValidUnauthorizedResponse(response);
         assertNoTokenInBody(response);
     }
 
     @Test
-    @DisplayName("Level 1 - Test that an invalid token is not validated successfully")
+    @DisplayName("Level 1 - Test that an invalid token cookie is not validated successfully")
     void testLevel1FailedValidation() throws Exception {
-        HashMap<String, String> query = new HashMap<>();
-        query.put(JWTVulnerability.JWT, invalidToken);
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
-                jwtVulnerability.getVulnerablePayloadLevelUnsecure(query);
+                jwtVulnerability.getVulnerablePayloadLevelUnsecure(
+                        getCookieTokenRequest(invalidToken), new HashMap<>());
         assertValidUnauthorizedResponse(response);
-        assertEquals(
-                response.getBody().getContent(),
-                invalidToken,
-                "Response body should contain submitted JWT token");
+        assertNoTokenInBody(response);
     }
 
     private static RequestEntity<Void> getCookieTokenRequest(String token) {
@@ -210,6 +231,43 @@ private static RequestEntity<Void> getCookieTokenRequest(String token) {
                 .build();
     }
 
+    @Test
+    @DisplayName("Level 2 - Test that the JWT cookie is found when it is not the first cookie sent")
+    void testLevel2TokenFoundBehindAnotherCookie() throws Exception {
+        // A browser sends every cookie it holds in one header. Splitting the whole header on
+        // "=" only ever matched a JWT sent first, so a leading unrelated cookie hid the token
+        // and the request was silently handed a new one instead of being validated.
+        RequestEntity<Void> requestEntity =
+                RequestEntity.get("/")
+                        .header(
+                                "cookie",
+                                "unrelated=value; "
+                                        + JWTVulnerability.JWT_COOKIE_KEY
+                                        + validHighStrengthToken)
+                        .build();
+        ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
+                jwtVulnerability.getVulnerablePayloadLevelUnsecure2CookieBased(
+                        requestEntity, EMPTY_QUERY);
+        assertValidOkResponse(response);
+        assertTokenInCookie(response, validHighStrengthToken, true);
+        // Only the token is written back; unrelated cookies are not reflected into Set-Cookie.
+        assertFalse(
+                response.getHeaders().getFirst(HttpHeaders.SET_COOKIE).contains("unrelated"),
+                "Set-Cookie should not reflect the client's other cookies");
+    }
+
+    @Test
+    @DisplayName("Level 2 - Test that an unrelated cookie alone leaves the token unvalidated")
+    void testLevel2WithoutJWTCookie() throws Exception {
+        RequestEntity<Void> requestEntity =
+                RequestEntity.get("/").header("cookie", "unrelated=value").build();
+        ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
+                jwtVulnerability.getVulnerablePayloadLevelUnsecure2CookieBased(
+                        requestEntity, EMPTY_QUERY);
+        assertValidOkResponse(response);
+        assertNoTokenInBody(response);
+    }
+
     @Test
     @DisplayName("Level 2 - Test that a valid token cookie is validated successfully")
     void testLevel2SuccessfulValidation() throws Exception {
@@ -230,19 +288,30 @@ void testLevel2FailedValidation() throws Exception {
                 jwtVulnerability.getVulnerablePayloadLevelUnsecure2CookieBased(
                         requestEntity, EMPTY_QUERY);
         assertValidUnauthorizedResponse(response);
-        assertTokenInBody(response);
+        assertNoTokenInBody(response);
     }
 
     @Test
-    @DisplayName("Level 2 - Test that a token cookie is generated with fetch")
+    @DisplayName("Level 2 - Test that a token cookie is generated with fetch and carries HttpOnly")
     void testLevel2FetchCookieGeneration() throws Exception {
         RequestEntity<Void> requestEntity = getCookieTokenRequest(invalidToken);
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 jwtVulnerability.getVulnerablePayloadLevelUnsecure2CookieBased(
                         requestEntity, fetchQuery);
         assertValidOkResponse(response);
-        assertTokenInBody(response);
-        assertTokenInCookie(response, response.getBody().getContent(), false);
+        // An HttpOnly cookie is pointless if the same token is printed into the body, so the
+        // token is expected in the cookie and nowhere else.
+        assertNoTokenInBody(response);
+
+        String cookie = response.getHeaders().getFirst(HttpHeaders.SET_COOKIE);
+        assertTrue(
+                cookie.startsWith(JWTVulnerability.JWT_COOKIE_KEY),
+                "Cookie should be set under the JWT cookie name");
+        assertTrue(
+                cookie.toLowerCase(java.util.Locale.ROOT).contains("httponly"),
+                "Cookie should carry the HttpOnly flag");
+        assertTrue(cookie.contains("Secure"), "Cookie should carry the Secure flag");
+        assertTrue(cookie.contains("SameSite=Strict"), "Cookie should carry SameSite=Strict");
     }
 
     @Test
@@ -266,7 +335,7 @@ void testLevel3FailedValidation() throws Exception {
                 jwtVulnerability.getVulnerablePayloadLevelUnsecure3CookieBased(
                         requestEntity, EMPTY_QUERY);
         assertValidUnauthorizedResponse(response);
-        assertTokenInBody(response);
+        assertNoTokenInBody(response);
         assertTokenInCookie(response, invalidToken, true);
     }
 
@@ -278,21 +347,28 @@ void testLevel3FetchCookieGeneration() throws Exception {
                 jwtVulnerability.getVulnerablePayloadLevelUnsecure3CookieBased(
                         requestEntity, fetchQuery);
         assertValidOkResponse(response);
-        assertTokenInBody(response);
-        assertTokenInCookie(response, response.getBody().getContent(), true);
+        assertNoTokenInBody(response);
+
+        String cookie = response.getHeaders().getFirst(HttpHeaders.SET_COOKIE);
+        assertTrue(
+                cookie.startsWith(JWTVulnerability.JWT_COOKIE_KEY),
+                "Cookie should be set under the JWT cookie name");
+        assertTrue(
+                cookie.toLowerCase(java.util.Locale.ROOT).contains("httponly"),
+                "Cookie should carry the HttpOnly flag");
     }
 
     @Test
     @DisplayName("Level 4 - Test that a valid token cookie is validated successfully")
     void testLevel4SuccessfulValidation() throws Exception {
-        RequestEntity<Void> requestEntity = getCookieTokenRequest(validLowStrengthToken);
+        RequestEntity<Void> requestEntity = getCookieTokenRequest(validHighStrengthToken);
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 jwtVulnerability.getVulnerablePayloadLevelUnsecure4CookieBased(
                         requestEntity, EMPTY_QUERY);
         assertValidOkResponse(response);
         assertNoTokenInBody(response);
-        assertTokenInCookie(response, validLowStrengthToken, true);
-        verifySymmetricAlgorithmKeyCreation(KeyStrength.LOW);
+        assertTokenInCookie(response, validHighStrengthToken, true);
+        verifySymmetricAlgorithmKeyCreation(KeyStrength.HIGH);
     }
 
     @Test
@@ -305,7 +381,7 @@ void testLevel4FailedValidation() throws Exception {
         assertValidUnauthorizedResponse(response);
         assertTokenInBody(response);
         assertTokenInCookie(response, invalidToken, true);
-        verifySymmetricAlgorithmKeyCreation(KeyStrength.LOW);
+        verifySymmetricAlgorithmKeyCreation(KeyStrength.HIGH);
     }
 
     @Test
@@ -318,7 +394,7 @@ void testLevel4FetchCookieGeneration() throws Exception {
         assertValidOkResponse(response);
         assertTokenInBody(response);
         assertTokenInCookie(response, response.getBody().getContent(), true);
-        verifySymmetricAlgorithmKeyCreation(KeyStrength.LOW);
+        verifySymmetricAlgorithmKeyCreation(KeyStrength.HIGH);
     }
 
     @Test
@@ -333,7 +409,7 @@ void testLevel5SuccessfulValidation() throws Exception {
         assertTokenInCookie(response, validHighStrengthToken, true);
         verifySymmetricAlgorithmKeyCreation(KeyStrength.HIGH);
         verify(jwtValidator, times(1))
-                .customHMACNullByteVulnerableValidator(
+                .customHMACValidator(
                         eq(validHighStrengthToken), any(), eq(JWTUtils.JWT_HMAC_SHA_256_ALGORITHM));
     }
 
@@ -348,7 +424,7 @@ void testLevel5FailedValidation() throws Exception {
         assertTokenInBody(response);
         assertTokenInCookie(response, invalidToken, true);
         verify(jwtValidator, times(1))
-                .customHMACNullByteVulnerableValidator(
+                .customHMACValidator(
                         eq(invalidToken), any(), eq(JWTUtils.JWT_HMAC_SHA_256_ALGORITHM));
     }
 
@@ -376,7 +452,7 @@ void testLevel6SuccessfulValidation() throws Exception {
         assertTokenInCookie(response, validHighStrengthToken, true);
         verifySymmetricAlgorithmKeyCreation(KeyStrength.HIGH);
         verify(jwtValidator, times(1))
-                .customHMACNoneAlgorithmVulnerableValidator(
+                .customHMACValidator(
                         eq(validHighStrengthToken), any(), eq(JWTUtils.JWT_HMAC_SHA_256_ALGORITHM));
     }
 
@@ -391,7 +467,7 @@ void testLevel6FailedValidation() throws Exception {
         assertTokenInBody(response);
         assertTokenInCookie(response, invalidToken, true);
         verify(jwtValidator, times(1))
-                .customHMACNoneAlgorithmVulnerableValidator(
+                .customHMACValidator(
                         eq(invalidToken), any(), eq(JWTUtils.JWT_HMAC_SHA_256_ALGORITHM));
     }
 
@@ -459,7 +535,7 @@ void testLevel8SuccessfulValidation() throws Exception {
         assertNoTokenInBody(response);
         assertTokenInCookie(response, validAsymmetricToken, true);
         verify(jwtValidator, times(1))
-                .confusionAlgorithmVulnerableValidator(eq(validAsymmetricToken), any());
+                .genericJWTTokenValidator(eq(validAsymmetricToken), any(), eq("RS256"));
     }
 
     @Test
@@ -473,7 +549,7 @@ void testLevel8FailedValidation() throws Exception {
         assertTokenInBody(response);
         assertTokenInCookie(response, invalidToken, true);
         verify(jwtValidator, times(1))
-                .confusionAlgorithmVulnerableValidator(eq(invalidToken), any());
+                .genericJWTTokenValidator(eq(invalidToken), any(), eq("RS256"));
     }
 
     @Test
@@ -499,7 +575,7 @@ void testLevel9SuccessfulValidation() throws Exception {
         assertNoTokenInBody(response);
         assertTokenInCookie(response, validAsymmetricTokenWithJwk, true);
         verify(jwtValidator, times(1))
-                .jwkKeyHeaderPublicKeyTrustingVulnerableValidator(validAsymmetricTokenWithJwk);
+                .genericJWTTokenValidator(eq(validAsymmetricTokenWithJwk), any(), eq("RS256"));
     }
 
     @Test
@@ -513,7 +589,7 @@ void testLevel9FailedValidation() throws Exception {
         assertTokenInBody(response);
         assertTokenInCookie(response, invalidToken, true);
         verify(jwtValidator, times(1))
-                .jwkKeyHeaderPublicKeyTrustingVulnerableValidator(invalidToken);
+                .genericJWTTokenValidator(eq(invalidToken), any(), eq("RS256"));
     }
 
     @Test
@@ -539,7 +615,7 @@ void testLevel10SuccessfulValidation() throws Exception {
         assertNoTokenInBody(response);
         assertTokenInCookie(response, validHighStrengthToken, true);
         verify(jwtValidator, times(1))
-                .customHMACEmptyTokenVulnerableValidator(
+                .customHMACValidator(
                         eq(validHighStrengthToken), any(), eq(JWTUtils.JWT_HMAC_SHA_256_ALGORITHM));
     }
 
@@ -554,7 +630,7 @@ void testLevel10FailedValidation() throws Exception {
         assertTokenInBody(response);
         assertTokenInCookie(response, invalidToken, true);
         verify(jwtValidator, times(1))
-                .customHMACEmptyTokenVulnerableValidator(
+                .customHMACValidator(
                         eq(invalidToken), any(), eq(JWTUtils.JWT_HMAC_SHA_256_ALGORITHM));
     }
 
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidatorTest.java b/src/test/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidatorTest.java
index d17a222d6..bdc946bbc 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidatorTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/jwt/impl/JWTValidatorTest.java
@@ -116,16 +116,19 @@ void customHMACNullByteVulnerableValidatorInvalidToken() throws Exception {
 
     @Test
     @DisplayName(
-            "Test that customHMACNullByteVulnerableValidator stops reading the signature at a 0 byte")
-    void customHMACNullByteVulnerableValidatorStopsReadingSignatureAtNullByte() throws Exception {
+            "Test that customHMACNullByteVulnerableValidator reads the whole signature past a 0 byte")
+    void customHMACNullByteVulnerableValidatorReadsWholeSignature() throws Exception {
         String nullByte =
                 URLEncoder.encode(String.valueOf((char) 0), StandardCharsets.UTF_8.name());
-        jwtValidator.customHMACNullByteVulnerableValidator(
-                validHmacToken + nullByte + "this will not be read",
-                JWTUtils.getBytes(symmetricAlgorithmKey.getKey()),
-                JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
+        String tamperedToken = validHmacToken + nullByte + "this must be read";
+        // The signature is verified exactly as presented, so appending data invalidates it
+        assertFalse(
+                jwtValidator.customHMACNullByteVulnerableValidator(
+                        tamperedToken,
+                        JWTUtils.getBytes(symmetricAlgorithmKey.getKey()),
+                        JWTUtils.JWT_HMAC_SHA_256_ALGORITHM));
         Mockito.verify(jwtValidator, Mockito.times(1))
-                .customHMACValidator(eq(validHmacToken), any(), any());
+                .customHMACValidator(eq(tamperedToken), any(), any());
     }
 
     @Test
@@ -141,7 +144,7 @@ void customHMACNoneAlgorithmVulnerableValidatorValidToken() throws Exception {
 
     @Test
     @DisplayName(
-            "Test that customHMACNoneAlgorithmVulnerableValidator is vulnerable to an algorithm set to 'none'")
+            "Test that customHMACNoneAlgorithmVulnerableValidator rejects an algorithm set to 'none'")
     void customHMACNoneAlgorithmVulnerableValidatorVulnerableToNoneAlgorithm() throws Exception {
         String maliciousHeader =
                 JWTUtils.getBase64UrlSafeWithoutPaddingEncodedString("{'alg':'none','typ':'JWT'}");
@@ -150,7 +153,7 @@ void customHMACNoneAlgorithmVulnerableValidatorVulnerableToNoneAlgorithm() throw
                         + "."
                         + StringUtils.substringAfter(JWTUtils.GENERIC_BASE64_ENCODED_PAYLOAD, ".");
         String maliciousToken = getHmacSignedJWTToken(maliciousPayload);
-        assertTrue(
+        assertFalse(
                 jwtValidator.customHMACNoneAlgorithmVulnerableValidator(
                         maliciousToken,
                         JWTUtils.getBytes(symmetricAlgorithmKey.getKey()),
@@ -180,10 +183,10 @@ void customHMACEmptyTokenVulnerableValidatorValidToken() throws Exception {
     }
 
     @Test
-    @DisplayName("Test that customHMACEmptyTokenVulnerableValidator is vulnerable to a '.' token")
-    void customHMACEmptyTokenVulnerableValidatorVulnerableToEmptyToken() throws Exception {
+    @DisplayName("Test that customHMACEmptyTokenVulnerableValidator rejects a '.' token")
+    void customHMACEmptyTokenVulnerableValidatorRejectsEmptyToken() throws Exception {
         String maliciousToken = ".";
-        assertTrue(
+        assertFalse(
                 jwtValidator.customHMACEmptyTokenVulnerableValidator(
                         maliciousToken,
                         symmetricAlgorithmKey.getKey(),
@@ -212,7 +215,7 @@ void confusionAlgorithmVulnerableValidatorValidToken() throws Exception {
 
     @Test
     @DisplayName(
-            "Test that confusionAlgorithmVulnerableValidator is vulnerable to a token signed with a symmetric algorithm using the public key")
+            "Test that confusionAlgorithmVulnerableValidator rejects a token signed with a symmetric algorithm using the public key")
     void confusionAlgorithmVulnerableValidatorVulnerableToPublicKeyEncryptedToken()
             throws Exception {
         Key publicKey = asymmetricAlgorithmKeyPair.getPublic();
@@ -221,7 +224,8 @@ void confusionAlgorithmVulnerableValidatorVulnerableToPublicKeyEncryptedToken()
                         JWTUtils.HS256_TOKEN_TO_BE_SIGNED,
                         publicKey.getEncoded(),
                         JWTUtils.JWT_HMAC_SHA_256_ALGORITHM);
-        assertTrue(
+        // An RSA public key is public: signing with it as an HMAC secret must not verify
+        assertFalse(
                 jwtValidator.confusionAlgorithmVulnerableValidator(
                         tokenSignedWithPublicKey, publicKey));
     }
@@ -239,18 +243,26 @@ void confusionAlgorithmVulnerableValidatorInvalidToken() throws Exception {
     @DisplayName(
             "Test that jwkKeyHeaderPublicKeyTrustingVulnerableValidator validates a valid token successfully")
     void jwkKeyHeaderPublicKeyTrustingVulnerableValidatorValidToken() throws Exception {
-        assertTrue(jwtValidator.jwkKeyHeaderPublicKeyTrustingVulnerableValidator(validRS256Token));
+        assertTrue(
+                jwtValidator.jwkKeyHeaderPublicKeyTrustingVulnerableValidator(
+                        validRS256Token, asymmetricAlgorithmKeyPair.getPublic()));
     }
 
     @Test
     @DisplayName(
-            "Test that jwkKeyHeaderPublicKeyTrustingVulnerableValidator trusts a public key submitted by the client")
-    void jwkKeyHeaderPublicKeyTrustingVulnerableValidatorVulnerableToPublicKeyEncryptedToken()
+            "Test that jwkKeyHeaderPublicKeyTrustingVulnerableValidator ignores a public key submitted by the client")
+    void jwkKeyHeaderPublicKeyTrustingVulnerableValidatorIgnoresClientSuppliedPublicKey()
             throws Exception {
+        java.security.KeyPair attackerKeyPair =
+                java.security.KeyPairGenerator.getInstance("RSA").generateKeyPair();
         String token =
                 jwtGenerator.getJWTTokenWithJWKHeader_RS256(
-                        JWTUtils.HS256_TOKEN_TO_BE_SIGNED, asymmetricAlgorithmKeyPair);
-        assertTrue(jwtValidator.jwkKeyHeaderPublicKeyTrustingVulnerableValidator(token));
+                        JWTUtils.HS256_TOKEN_TO_BE_SIGNED, attackerKeyPair);
+        // Signed by the attacker and carrying their public key in the header, so it must
+        // not verify against the key the server actually trusts.
+        assertFalse(
+                jwtValidator.jwkKeyHeaderPublicKeyTrustingVulnerableValidator(
+                        token, asymmetricAlgorithmKeyPair.getPublic()));
     }
 
     @Test
@@ -259,6 +271,6 @@ void jwkKeyHeaderPublicKeyTrustingVulnerableValidatorVulnerableToPublicKeyEncryp
     void jwkKeyHeaderPublicKeyTrustingVulnerableValidatorInvalidToken() throws Exception {
         assertFalse(
                 jwtValidator.jwkKeyHeaderPublicKeyTrustingVulnerableValidator(
-                        validRS256Token + "a"));
+                        validRS256Token + "a", asymmetricAlgorithmKeyPair.getPublic()));
     }
 }
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerabilityTest.java
index 84edc3edb..e25702e88 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/ldapInjection/LDAPInjectionVulnerabilityTest.java
@@ -20,37 +20,42 @@ void setup() throws Exception {
         ldapInjectionVulnerability = new LDAPInjectionVulnerability();
     }
 
-    /** LEVEL 1 - Basic LDAP Injection */
+    /** LEVEL 1 - The wildcard is escaped rather than treated as a filter operator */
     @Test
     void testLevel1Injection() throws Exception {
 
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
                 ldapInjectionVulnerability.level1("*");
 
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("No users found", response.getBody().getContent());
+    }
+
+    /** LEVEL 1 - A genuine username still resolves */
+    @Test
+    void testLevel1LegitimateLookup() throws Exception {
+
+        ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
+                ldapInjectionVulnerability.level1("alice");
+
         Map<String, Object> content = (Map<String, Object>) response.getBody().getContent();
-        String filter = (String) content.get("filter");
         List<String> users = (List<String>) content.get("users");
 
-        assertEquals("(uid=*)", filter);
-        assertTrue(users.size() >= 3);
+        assertEquals(List.of("alice"), users);
     }
 
-    /** LEVEL 2 - OR filter injection */
+    /** LEVEL 2 - OR filter no longer expands a wildcard into every user */
     @Test
     void testLevel2Injection() throws Exception {
 
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
                 ldapInjectionVulnerability.level2("*");
 
-        Map<String, Object> content = (Map<String, Object>) response.getBody().getContent();
-        String filter = (String) content.get("filter");
-        List<String> users = (List<String>) content.get("users");
-
-        assertTrue(filter.contains("(|"));
-        assertTrue(users.size() >= 3);
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("No users found", response.getBody().getContent());
     }
 
-    /** LEVEL 3 - Authentication filter injection */
+    /** LEVEL 3 - Authentication filter injection is escaped */
     @Test
     void testLevel3Injection() {
 
@@ -59,12 +64,21 @@ void testLevel3Injection() {
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
                 ldapInjectionVulnerability.level3(username, password);
 
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("Invalid credentials", response.getBody().getContent());
+    }
+
+    /** LEVEL 3 - Real credentials still authenticate */
+    @Test
+    void testLevel3LegitimateLogin() {
+
+        ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
+                ldapInjectionVulnerability.level3("alice", "alicePass123");
+
         Map<String, Object> content = (Map<String, Object>) response.getBody().getContent();
-        String filter = (String) content.get("filter");
-        List<String> users = (List<String>) content.get("users");
-        assertTrue(filter.contains("(uid="));
-        assertTrue(filter.contains(")("));
-        assertEquals(1, users.size());
+
+        assertTrue(response.getBody().getIsValid());
+        assertEquals(List.of("alice"), content.get("users"));
     }
 
     /** LEVEL 4 - Sanitization */
@@ -76,13 +90,13 @@ void testLevel4Sanitization() throws Exception {
 
         Map<String, Object> content = (Map<String, Object>) response.getBody().getContent();
 
-        String filter = (String) content.get("filter");
-        assertFalse(filter.contains(")(uid=*"));
-        assertFalse(filter.contains("|"));
-        assertTrue(filter.startsWith("(uid="));
+        // The payload is escaped into a literal uid, so it matches nothing rather than
+        // breaking out of the filter and returning every entry.
+        assertFalse(response.getBody().getIsValid());
+        assertEquals(List.of(), content.get("users"));
     }
 
-    /** LEVEL 5 - Blind LDAP Injection */
+    /** LEVEL 5 - Blind LDAP Injection is escaped */
     @Test
     void testLevel5BlindInjection() {
 
@@ -92,9 +106,19 @@ void testLevel5BlindInjection() {
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
                 ldapInjectionVulnerability.level5(username, password);
 
-        String filter = response.getBody().getContent().toString();
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("Invalid credentials", response.getBody().getContent());
+    }
+
+    /** LEVEL 5 - Real credentials still authenticate */
+    @Test
+    void testLevel5LegitimateLogin() {
+
+        ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
+                ldapInjectionVulnerability.level5("alice", "alicePass123");
 
-        assertTrue(filter.contains("Login successful"));
+        assertTrue(response.getBody().getIsValid());
+        assertEquals("Login successful", response.getBody().getContent());
     }
 
     @Test
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java b/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java
index 734c9c30b..9cdcb6958 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java
@@ -24,18 +24,24 @@ void setUp() {
 
     @Test
     @DisplayName(
-            "Level 1- test that returnTo query parameter's value is directly added to the Location header")
-    void test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_Level1() {
+            "Level 1- test that an external returnTo query parameter's value is not added to the Location header")
+    void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_Level1() {
         String redirectUrl = "https://www.malicious.com";
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel1(redirectUrl);
-        assertThat(
-                        responseEntity
-                                .getHeaders()
-                                .get(LOCATION_HEADER_KEY)
-                                .contains("https://www.malicious.com"))
-                .isTrue();
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 1- test that a whitelisted returnTo query parameter's value is added to the Location header")
+    void test_That_WhitelistedReturnToQueryParameterValue_IsAddedToLocationHeader_Level1() {
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel1("/VulnerableApp/");
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
+                .contains("/VulnerableApp/");
     }
 
     @Test
@@ -95,9 +101,9 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
 
     @Test
     @DisplayName(
-            "Level 2- test that the returnTo query parameter's value is directly added to the Location header when it does not start with http, https or www")
+            "Level 2- test that the returnTo query parameter's value is not added to the Location header when it uses a non http scheme")
     void
-            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItDoesNotStartWith_Http_Https_Or_WWW_Level2()
+            test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItUsesANonHttpScheme_Level2()
                     throws URISyntaxException, MalformedURLException {
         String redirectUrl = "ftp://ftp.dlptest.com/";
         RequestEntity<String> requestEntity =
@@ -107,26 +113,45 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel2(
                         requestEntity, redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 2- test that the returnTo query parameter's value is added to the Location header when it is a relative path on the application's own origin")
+    void
+            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsA_RelativePath_Level2()
+                    throws MalformedURLException, URISyntaxException {
+        String redirectUrl = "/VulnerableApp/";
+        RequestEntity<String> requestEntity =
+                new RequestEntity<>(
+                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=/VulnerableApp/"));
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel2(
+                        requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
         assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
-                .contains("ftp://ftp.dlptest.com/");
+                .contains("/VulnerableApp/");
     }
 
     @Test
     @DisplayName(
-            "Level 2- test that the returnTo query parameter's value is directly added to the Location header when it is the same as the application domain")
+            "Level 2- test that an absolute returnTo query parameter's value is added to the Location header when its host is the application's own host")
     void
             test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsSameAs_ApplicationDomain_Level2()
                     throws MalformedURLException, URISyntaxException {
-        String redirectUrl = "somedomain.com";
+        String redirectUrl = "https://somedomain.com/home";
         RequestEntity<String> requestEntity =
                 new RequestEntity<>(
-                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=somedomain.com"));
+                        HttpMethod.GET,
+                        new URI("https://somedomain.com?returnTo=https://somedomain.com/home"));
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel2(
                         requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains("somedomain.com");
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
+                .contains("https://somedomain.com/home");
     }
 
     @Test
@@ -203,9 +228,9 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
 
     @Test
     @DisplayName(
-            "Level 3- test that the returnTo query parameter's value is directly added to the Location header when it does not start with http, https, // or www")
+            "Level 3- test that the returnTo query parameter's value is not added to the Location header when it smuggles an encoded tab before the host")
     void
-            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItDoesNotStartWith_Http_Https_DoubleSlashes_Or_WWW_Level3()
+            test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItContainsAn_EncodedTab_Level3()
                     throws MalformedURLException, URISyntaxException {
         String redirectUrl = "/%09/localdomain.pw";
         RequestEntity<String> requestEntity =
@@ -215,26 +240,45 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel3(
                         requestEntity, redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 3- test that the returnTo query parameter's value is added to the Location header when it is a relative path on the application's own origin")
+    void
+            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsA_RelativePath_Level3()
+                    throws MalformedURLException, URISyntaxException {
+        String redirectUrl = "/VulnerableApp/";
+        RequestEntity<String> requestEntity =
+                new RequestEntity<>(
+                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=/VulnerableApp/"));
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel3(
+                        requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
         assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
-                .contains("/%09/localdomain.pw");
+                .contains("/VulnerableApp/");
     }
 
     @Test
     @DisplayName(
-            "Level 3- test that the returnTo query parameter's value is directly added to the Location header when it is the same as the application domain")
+            "Level 3- test that an absolute returnTo query parameter's value is added to the Location header when its host is the application's own host")
     void
             test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsSameAs_ApplicationDomain_Level3()
                     throws MalformedURLException, URISyntaxException {
-        String redirectUrl = "somedomain.com";
+        String redirectUrl = "https://somedomain.com/home";
         RequestEntity<String> requestEntity =
                 new RequestEntity<>(
-                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=somedomain.com"));
+                        HttpMethod.GET,
+                        new URI("https://somedomain.com?returnTo=https://somedomain.com/home"));
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel3(
                         requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains("somedomain.com");
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
+                .contains("https://somedomain.com/home");
     }
 
     @Test
@@ -337,9 +381,9 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
 
     @Test
     @DisplayName(
-            "Level 4- test that the returnTo query parameter's value is directly added to the Location header when it does not start with http, https, //, null byte character or www")
+            "Level 4- test that the returnTo query parameter's value is not added to the Location header when it smuggles an encoded tab before the host")
     void
-            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItDoesNotStartWith_Http_Https_DoubleSlashes_Null_Byte_Character_Or_WWW_Level4()
+            test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItContainsAn_EncodedTab_Level4()
                     throws MalformedURLException, URISyntaxException {
         String redirectUrl = "/%09/localdomain.pw";
         RequestEntity<String> requestEntity =
@@ -349,26 +393,62 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel4(
                         requestEntity, redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 4- test that the returnTo query parameter's value is not added to the Location header when it uses a backslash to reach another origin")
+    void
+            test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItUsesA_Backslash_Level4()
+                    throws MalformedURLException, URISyntaxException {
+        String redirectUrl = "/\\/localdomain.pw";
+        RequestEntity<String> requestEntity =
+                new RequestEntity<>(
+                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=/localdomain.pw"));
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel4(
+                        requestEntity, redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 4- test that the returnTo query parameter's value is added to the Location header when it is a relative path on the application's own origin")
+    void
+            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsA_RelativePath_Level4()
+                    throws MalformedURLException, URISyntaxException {
+        String redirectUrl = "/VulnerableApp/";
+        RequestEntity<String> requestEntity =
+                new RequestEntity<>(
+                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=/VulnerableApp/"));
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel4(
+                        requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
         assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
-                .contains("/%09/localdomain.pw");
+                .contains("/VulnerableApp/");
     }
 
     @Test
     @DisplayName(
-            "Level 4- test that the returnTo query parameter's value is directly added to the Location header when it is the same as the application domain")
+            "Level 4- test that an absolute returnTo query parameter's value is added to the Location header when its host is the application's own host")
     void
             test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsSameAs_ApplicationDomain_Level4()
                     throws MalformedURLException, URISyntaxException {
-        String redirectUrl = "somedomain.com";
+        String redirectUrl = "https://somedomain.com/home";
         RequestEntity<String> requestEntity =
                 new RequestEntity<>(
-                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=somedomain.com"));
+                        HttpMethod.GET,
+                        new URI("https://somedomain.com?returnTo=https://somedomain.com/home"));
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel4(
                         requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains("somedomain.com");
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
+                .contains("https://somedomain.com/home");
     }
 
     @Test
@@ -485,9 +565,9 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
 
     @Test
     @DisplayName(
-            "Level 5- test that the returnTo query parameter's value is added to the Location header when it does not start with https, http, www, //, or null byte character")
+            "Level 5- test that the returnTo query parameter's value is not added to the Location header when it is a bare external host")
     void
-            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItDoesNotStartWith_Http_Https_DoubleSlashes_Null_Byte_Character_Or_WWW_Level5()
+            test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItIsA_BareExternalHost_Level5()
                     throws MalformedURLException, URISyntaxException {
         String redirectUrl = "localdomain.pw/";
         RequestEntity<String> requestEntity =
@@ -497,49 +577,85 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel5(
                         requestEntity, redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 5- test that the returnTo query parameter's value is added to the Location header when it is a relative path on the application's own origin")
+    void
+            test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsA_RelativePath_Level5()
+                    throws MalformedURLException, URISyntaxException {
+        String redirectUrl = "/VulnerableApp/";
+        RequestEntity<String> requestEntity =
+                new RequestEntity<>(
+                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=/VulnerableApp/"));
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel5(
+                        requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
         assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
-                .contains("localdomain.pw/");
+                .contains("/VulnerableApp/");
     }
 
     @Test
     @DisplayName(
-            "Level 5- test that the returnTo query parameter's value is directly added to the Location header when it is the same as the application domain")
+            "Level 5- test that an absolute returnTo query parameter's value is added to the Location header when its host is the application's own host")
     void
             test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_WhenItIsSameAs_ApplicationDomain_Level5()
                     throws MalformedURLException, URISyntaxException {
-        String redirectUrl = "somedomain.com";
+        String redirectUrl = "https://somedomain.com/home";
         RequestEntity<String> requestEntity =
                 new RequestEntity<>(
-                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=somedomain.com"));
+                        HttpMethod.GET,
+                        new URI("https://somedomain.com?returnTo=https://somedomain.com/home"));
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel5(
                         requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains("somedomain.com");
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
+                .contains("https://somedomain.com/home");
     }
 
     @Test
     @DisplayName(
-            "Level 6- test that the returnTo query parameter's value is directly added to the Location header by adding domain as prefix")
+            "Level 6- test that the returnTo query parameter's value is not appended to the domain prefix when it would extend the host instead of the path")
+    void
+            test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItExtendsTheHost_Level6()
+                    throws MalformedURLException, URISyntaxException {
+        String redirectUrl = ".malicious.com";
+        RequestEntity<String> requestEntity =
+                new RequestEntity<>(
+                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=.malicious.com"));
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel6(
+                        requestEntity, redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 6- test that a rooted relative returnTo query parameter's value is added to the Location header without a request derived domain prefix")
     void
             test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_ByAddingDomainToPrefix_Level6()
                     throws MalformedURLException, URISyntaxException {
-        String redirectUrl = "somedomain.com";
+        String redirectUrl = "/somedomain.com";
         RequestEntity<String> requestEntity =
                 new RequestEntity<>(
-                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=somedomain.com"));
+                        HttpMethod.GET, new URI("https://somedomain.com?returnTo=/somedomain.com"));
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel6(
                         requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
         assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
-                .contains("https://somedomain.comsomedomain.com");
+                .contains("/somedomain.com");
     }
 
     @Test
     @DisplayName(
-            "Level 7- test that the returnTo query parameter's value is directly added to the Location header by adding domain as prefix")
+            "Level 7- test that the returnTo query parameter's value is added to the Location header without a request derived domain prefix")
     void
             test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_ByAddingDomainToPrefix_Level7()
                     throws MalformedURLException, URISyntaxException {
@@ -552,7 +668,7 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
                         requestEntity, redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
         assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
-                .contains("https://somedomain.com/somedomain.com");
+                .contains("/somedomain.com");
     }
 
     @Test
@@ -591,35 +707,47 @@ void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_WhenItStar
     }
 
     @Test
-    @DisplayName("Level 9 - test that URL provided in returnTo parameter results in a 302 redirect")
-    void test_that_ReturnToQueryParameterValue_IsAddedToLocationHeader_Level9() {
+    @DisplayName(
+            "Level 9 - test that the phishing URL provided in returnTo parameter is not redirected to")
+    void test_that_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_Level9() {
         String phishingURL = "/VulnerableApp/phishing/fake-login.html";
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel9(phishingURL);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
+    }
+
+    @Test
+    @DisplayName(
+            "Level 9 - test that a whitelisted URL provided in returnTo parameter results in a 302 redirect")
+    void test_that_WhitelistedReturnToQueryParameterValue_IsAddedToLocationHeader_Level9() {
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel9("/VulnerableApp/");
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains(phishingURL);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY))
+                .contains("/VulnerableApp/");
     }
 
     @Test
     @DisplayName(
-            "Level 10- test that URL provided in returnTo parameter results in a 302 redirect with Location header set")
-    void test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_Level10() {
+            "Level 10- test that the phishing URL provided in returnTo parameter is not redirected to")
+    void test_That_ReturnToQueryParameterValue_IsNotAddedToLocationHeader_Level10() {
         String redirectUrl = "/VulnerableApp/phishing/fake-login.html";
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel10(redirectUrl);
-        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains(redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
     }
 
     @Test
     @DisplayName(
-            "Level 10- test that an external malicious URL is accepted and results in a 302 redirect without any domain restriction")
-    void test_That_ExternalMaliciousUrl_IsAccepted_AndAddedToLocationHeader_Level10() {
+            "Level 10- test that an external malicious URL is rejected rather than added to the Location header")
+    void test_That_ExternalMaliciousUrl_IsRejected_Level10() {
         String redirectUrl = "https://www.malicious.com";
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel10(redirectUrl);
-        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
-        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains(redirectUrl);
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isEqualTo(null);
     }
 
     @Test
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java b/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
index ed779b9cb..023c4f6ae 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
@@ -39,8 +39,9 @@ void testGetVulnerablePayloadLevel1WithWrongFileName() {
                 pathTraversalVulnerability.getVulnerablePayloadLevel1(queryParams);
         assertEquals(HttpStatus.OK, response.getStatusCode());
         assertNotNull(response.getBody());
-        assertTrue(response.getBody().getIsValid());
-        assertNotNull(response.getBody().getContent());
+        // A traversal sequence is not on the allow-list, so nothing is read
+        assertFalse(response.getBody().getIsValid());
+        assertNull(response.getBody().getContent());
     }
 
     @Test
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java
index 5883c6af6..3e7e47b44 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/BlindSQLInjectionVulnerabilityTest.java
@@ -16,6 +16,7 @@
 import org.springframework.http.ResponseEntity;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.PreparedStatementCreator;
+import org.springframework.jdbc.core.PreparedStatementSetter;
 import org.springframework.jdbc.core.ResultSetExtractor;
 
 public class BlindSQLInjectionVulnerabilityTest {
@@ -42,11 +43,14 @@ public void testGetCarInformationLevel1_CarPresent() throws SQLException {
 
         // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the
         // data from the mockResultSet (which mocks the query result)
-        when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class)))
+        when(jdbcTemplate.query(
+                        anyString(),
+                        any(PreparedStatementSetter.class),
+                        any(ResultSetExtractor.class)))
                 .thenAnswer(
                         invocation -> {
                             ResultSetExtractor<ResponseEntity<String>> rse =
-                                    invocation.getArgument(1);
+                                    invocation.getArgument(2);
                             return rse.extractData(mockResultSet);
                         });
 
@@ -72,11 +76,14 @@ public void testGetCarInformationLevel1_CarNotPresent() throws SQLException {
 
         // return rse.extractData(mockResultSet); indicates that the ResultSetExtractor extracts the
         // data from the mockResultSet (which mocks the query result)
-        when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class)))
+        when(jdbcTemplate.query(
+                        anyString(),
+                        any(PreparedStatementSetter.class),
+                        any(ResultSetExtractor.class)))
                 .thenAnswer(
                         invocation -> {
                             ResultSetExtractor<ResponseEntity<String>> rse =
-                                    invocation.getArgument(1);
+                                    invocation.getArgument(2);
                             return rse.extractData(mockResultSet);
                         });
 
@@ -103,11 +110,14 @@ public void testGetCarInformationLevel2_CarPresent() throws SQLException {
         when(mockResultSet.next()).thenReturn(true);
 
         // Mock the query method of JdbcTemplate
-        when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class)))
+        when(jdbcTemplate.query(
+                        anyString(),
+                        any(PreparedStatementSetter.class),
+                        any(ResultSetExtractor.class)))
                 .thenAnswer(
                         invocation -> {
                             ResultSetExtractor<ResponseEntity<String>> rse =
-                                    invocation.getArgument(1);
+                                    invocation.getArgument(2);
                             return rse.extractData(mockResultSet);
                         });
 
@@ -132,11 +142,14 @@ public void testGetCarInformationLevel2_CarNotPresent() throws SQLException {
         when(mockResultSet.next()).thenReturn(false);
 
         // Mock the query method of JdbcTemplate
-        when(jdbcTemplate.query(anyString(), any(ResultSetExtractor.class)))
+        when(jdbcTemplate.query(
+                        anyString(),
+                        any(PreparedStatementSetter.class),
+                        any(ResultSetExtractor.class)))
                 .thenAnswer(
                         invocation -> {
                             ResultSetExtractor<ResponseEntity<String>> rse =
-                                    invocation.getArgument(1);
+                                    invocation.getArgument(2);
                             return rse.extractData(mockResultSet);
                         });
 
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java
index a665b7540..e1ba6776c 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java
@@ -54,7 +54,8 @@ void doesCarInformationExistsLevel1_ExpectParamEscaped() throws IOException {
         // Assert
         verify(template)
                 .query(
-                        eq("select * from cars where id=1"),
+                        eq("select * from cars where id=?"),
+                        (PreparedStatementSetter) any(),
                         (ResultSetExtractor<? extends Object>) any());
     }
 
@@ -67,7 +68,8 @@ void doesCarInformationExistsLevel2_ExpectParamEscaped() throws IOException {
         // Assert
         verify(template)
                 .query(
-                        eq("select * from cars where id='1'"),
+                        eq("select * from cars where id=?"),
+                        (PreparedStatementSetter) any(),
                         (ResultSetExtractor<? extends Object>) any());
     }
 
@@ -75,12 +77,16 @@ void doesCarInformationExistsLevel2_ExpectParamEscaped() throws IOException {
     void doesCarInformationExistsLevel3_ExpectParamEscaped() throws IOException {
         // Act
         final Map<String, String> queryParams = Collections.singletonMap("id", "1'");
-        errorBasedSQLInjectionVulnerability.doesCarInformationExistsLevel3(queryParams);
+        ResponseEntity<String> response =
+                errorBasedSQLInjectionVulnerability.doesCarInformationExistsLevel3(queryParams);
 
-        // Assert
-        verify(template)
+        // Assert: the identifier is validated as a number, so a payload never reaches the
+        // database at all rather than reaching it safely bound.
+        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
+        verify(template, Mockito.never())
                 .query(
-                        eq("select * from cars where id='1'"),
+                        eq("select * from cars where id=?"),
+                        (PreparedStatementSetter) any(),
                         (ResultSetExtractor<? extends Object>) any());
     }
 
@@ -88,7 +94,9 @@ void doesCarInformationExistsLevel3_ExpectParamEscaped() throws IOException {
     void doesCarInformationExistsLevel4_ExpectValidResponse() {
         // Arrange
         Map<String, String> queryParams = new HashMap<>();
-        queryParams.put(Constants.ID, "1'");
+        // A legitimate identifier: this case asserts the happy path still works, and the
+        // identifier must now be a number to get that far.
+        queryParams.put(Constants.ID, "1");
 
         // Mock the response entity
         ResponseEntity<String> mockResponseEntity =
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerabilityTest.java
index 46ab7263d..43bb42b23 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/UnionBasedSQLInjectionVulnerabilityTest.java
@@ -1,5 +1,6 @@
 package org.sasanlabs.service.vulnerability.sqlInjection;
 
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.*;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.verify;
@@ -12,6 +13,8 @@
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentMatcher;
 import org.mockito.Mockito;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
 import org.springframework.jdbc.core.BeanPropertyRowMapper;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.core.PreparedStatementSetter;
@@ -55,30 +58,36 @@ void setUp() {
     }
 
     @Test
-    void getCarInformationLevel1_ExpectParamInjected() {
+    void getCarInformationLevel1_ExpectParamEscaped() {
         // Act
         final Map<String, String> params =
                 Collections.singletonMap("id", "1 UNION SELECT * FROM cars;");
-        unionBasedSQLInjectionVulnerability.getCarInformationLevel1(params);
+        ResponseEntity<CarInformation> response =
+                unionBasedSQLInjectionVulnerability.getCarInformationLevel1(params);
 
-        // Assert
-        verify(template)
+        // Assert: a non numeric identifier is refused before any query is issued.
+        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
+        verify(template, Mockito.never())
                 .query(
-                        eq("select * from cars where id=1 UNION SELECT * FROM cars;"),
+                        eq("select * from cars where id=?"),
+                        (PreparedStatementSetter) any(),
                         (ResultSetExtractor<? extends Object>) any());
     }
 
     @Test
-    void getCarInformationLevel2_ExpectParamInjected() {
+    void getCarInformationLevel2_ExpectParamEscaped() {
         // Act
         final Map<String, String> params =
                 Collections.singletonMap("id", "1' UNION SELECT * FROM cars; --");
-        unionBasedSQLInjectionVulnerability.getCarInformationLevel2(params);
+        ResponseEntity<CarInformation> response =
+                unionBasedSQLInjectionVulnerability.getCarInformationLevel2(params);
 
-        // Assert
-        verify(template)
+        // Assert: a non numeric identifier is refused before any query is issued.
+        assertEquals(HttpStatus.BAD_REQUEST, response.getStatusCode());
+        verify(template, Mockito.never())
                 .query(
-                        eq("select * from cars where id='1' UNION SELECT * FROM cars; --'"),
+                        eq("select * from cars where id=?"),
+                        (PreparedStatementSetter) any(),
                         (ResultSetExtractor<? extends Object>) any());
     }
 
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerabilityTest.java
index 4aa6a0ad6..43551e272 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/ssrf/SSRFVulnerabilityTest.java
@@ -65,10 +65,10 @@ private static Stream<Arguments> testParamsForLevel1() {
         return Stream.of(
                 // Arguments: Input URL, Expected isValid response, Expected response body content
                 Arguments.of(INVALID_URL, false, INVALID_URL_MESSAGE),
-                Arguments.of(tempFileUrl, true, TEMP_FILE_CONTENT),
-                Arguments.of(METADATA_URL_AWS, true, METADATA_URL_CONTENT),
-                Arguments.of(METADATA_URL_OTHER, true, METADATA_URL_CONTENT),
-                Arguments.of(OTHER_URL, true, OTHER_URL_CONTENT),
+                Arguments.of(tempFileUrl, false, INVALID_URL_MESSAGE),
+                Arguments.of(METADATA_URL_AWS, false, INVALID_URL_MESSAGE),
+                Arguments.of(METADATA_URL_OTHER, false, INVALID_URL_MESSAGE),
+                Arguments.of(OTHER_URL, false, INVALID_URL_MESSAGE),
                 Arguments.of(GIST_URL, true, GIST_URL_CONTENT));
     }
 
@@ -86,9 +86,9 @@ private static Stream<Arguments> testParamsForLevel2() {
                 // Arguments: Input URL, Expected isValid response, Expected response body content
                 Arguments.of(INVALID_URL, false, INVALID_URL_MESSAGE),
                 Arguments.of(tempFileUrl, false, INVALID_URL_MESSAGE),
-                Arguments.of(METADATA_URL_AWS, true, METADATA_URL_CONTENT),
-                Arguments.of(METADATA_URL_OTHER, true, METADATA_URL_CONTENT),
-                Arguments.of(OTHER_URL, true, OTHER_URL_CONTENT),
+                Arguments.of(METADATA_URL_AWS, false, INVALID_URL_MESSAGE),
+                Arguments.of(METADATA_URL_OTHER, false, INVALID_URL_MESSAGE),
+                Arguments.of(OTHER_URL, false, INVALID_URL_MESSAGE),
                 Arguments.of(GIST_URL, true, GIST_URL_CONTENT));
     }
 
@@ -107,8 +107,8 @@ private static Stream<Arguments> testParamsForLevel3() {
                 Arguments.of(INVALID_URL, false, INVALID_URL_MESSAGE),
                 Arguments.of(tempFileUrl, false, INVALID_URL_MESSAGE),
                 Arguments.of(METADATA_URL_AWS, false, INVALID_URL_MESSAGE),
-                Arguments.of(METADATA_URL_OTHER, true, METADATA_URL_CONTENT),
-                Arguments.of(OTHER_URL, true, OTHER_URL_CONTENT),
+                Arguments.of(METADATA_URL_OTHER, false, INVALID_URL_MESSAGE),
+                Arguments.of(OTHER_URL, false, INVALID_URL_MESSAGE),
                 Arguments.of(GIST_URL, true, GIST_URL_CONTENT));
     }
 
@@ -128,7 +128,7 @@ private static Stream<Arguments> testParamsForLevel4() {
                 Arguments.of(tempFileUrl, false, INVALID_URL_MESSAGE),
                 Arguments.of(METADATA_URL_AWS, false, INVALID_URL_MESSAGE),
                 Arguments.of(METADATA_URL_OTHER, false, INVALID_URL_MESSAGE),
-                Arguments.of(OTHER_URL, true, OTHER_URL_CONTENT),
+                Arguments.of(OTHER_URL, false, INVALID_URL_MESSAGE),
                 Arguments.of(GIST_URL, true, GIST_URL_CONTENT));
     }
 
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/xss/reflected/PersistentXSSInHTMLTagVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/xss/reflected/PersistentXSSInHTMLTagVulnerabilityTest.java
index 6e034c8e4..072d2e410 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/xss/reflected/PersistentXSSInHTMLTagVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/xss/reflected/PersistentXSSInHTMLTagVulnerabilityTest.java
@@ -339,8 +339,10 @@ public void testGetVulnerablePayloadLevel2_WithPatternReplacement() {
         // Assert on the content of the post being saved
         assertEquals("<img src='x' onerror='alert(1)'>", postCaptor.getValue().getContent());
 
-        // Assert on the modified content of the post being saved (pattern replaced)
-        assertEquals("<div id=\"comments\"> src='x' onerror='alert(1)'></div>", response.getBody());
+        // Assert on the modified content of the post being saved (HTML escaped)
+        assertEquals(
+                "<div id=\"comments\">&lt;img src='x' onerror='alert(1)'&gt;</div>",
+                response.getBody());
 
         // Assert on the HTTP response status code
         assertEquals(HttpStatus.OK, response.getStatusCode());
@@ -370,8 +372,10 @@ public void testGetVulnerablePayloadLevel3_WithResponseContentAssertions() {
         // Assert on the modified content of the post being saved
         assertEquals("<script>alert('XSS')</script>", postCaptor.getValue().getContent());
 
-        // Assert on the content of the response
-        assertEquals("<div id=\"comments\">>alert('XSS')</script></div>", response.getBody());
+        // Assert on the content of the response (HTML escaped)
+        assertEquals(
+                "<div id=\"comments\">&lt;script&gt;alert('XSS')&lt;/script&gt;</div>",
+                response.getBody());
 
         // Assert on the HTTP response status code
         assertEquals(HttpStatus.OK, response.getStatusCode());
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerabilityTest.java
index 71c1eeb08..eb455e647 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/xxe/XXEVulnerabilityTest.java
@@ -230,10 +230,13 @@ public void testLevel2_BlocksGeneralEntity() throws Exception {
         // 3. Assertions
         assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
 
-        // Since external-general-entities is FALSE, &xxe; will not expand to the file content
-        assertThat(response.getBody().getContent().getName())
-                .as("General entities should be blocked in Level 2")
-                .isNotEqualTo("/etc/passwd");
+        // The DOCTYPE declaration is now refused outright rather than parsed with its entity
+        // expansion turned off, so the document is rejected and no book is returned at all --
+        // there is no parsed content left to compare against the file path.
+        assertThat(response.getBody().getContent())
+                .as("A document declaring a DOCTYPE should be rejected in Level 2")
+                .isNull();
+        assertThat(response.getBody().getIsValid()).isFalse();
     }
 
     @Test