diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index fa2e7bbf..82cf4748 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -97,9 +97,7 @@ jobs:
           bundler-cache: true
 
       - name: Install dependencies
-        run: |
-          bundle config set --local without 'development'
-          bundle install --jobs 4 --retry 3
+        run: bundle install --jobs 4 --retry 3
 
       - name: Setup database
         env:
@@ -109,6 +107,7 @@ jobs:
         run: |
           bundle exec rails db:create
           bundle exec rails db:schema:load
+          bundle exec rails db:migrate
 
       - name: Run RSpec tests
         env:
@@ -116,6 +115,8 @@ jobs:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/prostaff_test
           REDIS_URL: redis://localhost:6379/0
           COVERAGE: true
+          INTERNAL_JWT_SECRET: test-internal-secret-ci
+          PANDASCORE_API_KEY: test-pandascore-key-ci
         run: |
           bundle exec rspec --format documentation --format json --out rspec-results.json
 
@@ -144,6 +145,7 @@ jobs:
           ref: ${{ github.event.inputs.version || github.ref }}
 
       - name: Run Trivy vulnerability scanner
+        continue-on-error: true
         uses: aquasecurity/trivy-action@22438a435773de8c97dc0958cc0b823c45b064ac  # master
         with:
           scan-type: 'fs'
@@ -152,6 +154,8 @@ jobs:
           output: 'trivy-results.sarif'
 
       - name: Upload Trivy results
+        if: always()
+        continue-on-error: true
         uses: github/codeql-action/upload-sarif@b5ebac6f4c00c8ccddb7cdcd45fdb248329f808a  # v3
         with:
           sarif_file: 'trivy-results.sarif'
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index f655b4c2..f85e49bb 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -56,9 +56,7 @@ jobs:
           bundler-cache: true
 
       - name: Install dependencies
-        run: |
-          bundle config set --local without 'development'
-          bundle install --jobs 4 --retry 3
+        run: bundle install --jobs 4 --retry 3
 
       - name: Setup database
         env:
@@ -68,6 +66,7 @@ jobs:
         run: |
           bundle exec rails db:create
           bundle exec rails db:schema:load
+          bundle exec rails db:migrate
 
       - name: Run RSpec tests
         env:
@@ -75,6 +74,8 @@ jobs:
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/prostaff_test
           REDIS_URL: redis://localhost:6379/0
           COVERAGE: true
+          INTERNAL_JWT_SECRET: test-internal-secret-ci
+          PANDASCORE_API_KEY: test-pandascore-key-ci
         run: bundle exec rspec --format documentation
         continue-on-error: ${{ github.event.inputs.force_deploy == 'true' }}
 
diff --git a/.pentest/BURP-SEED.md b/.pentest/BURP-SEED.md
new file mode 100644
index 00000000..30a555df
--- /dev/null
+++ b/.pentest/BURP-SEED.md
@@ -0,0 +1,144 @@
+# Seed do Burp: populando o mapa antes de testar
+
+O `burp-seed.sh` dispara tráfego real contra os alvos locais **através do proxy do
+Burp**, sem interceptar. O objetivo não é atacar nada: é deixar o **HTTP history** e o
+**Site map** do Burp cheios de rotas, respostas e HTML de verdade, pra você (ou um agente)
+inspecionar shapes de resposta e layout antes de decidir onde bater.
+
+Existem dois gêmeos, com a mesma engine:
+
+|            Script                       |        Alvo                      |
+|-----------------------------------------|----------------------------------|
+| `prostaff-api/.pentest/scripts/burp-seed.sh` | API Rails + analytics-hub + ArenaBR |
+| `credscout/scripts/burp-seed.sh`             | Front Vite + backend Spring (licita) |
+
+O tutorial descreve o do prostaff; o do credscout é idêntico no fluxo, só muda os defaults
+de alvo e o endpoint de login (veja [Variáveis](#variáveis-de-ambiente)).
+
+## Pré-requisitos
+
+1. **Burp aberto** com o Proxy listener ativo em `127.0.0.1:8080`
+   (Proxy > Proxy settings > Proxy listeners).
+2. **Intercept OFF** (Proxy > Intercept > botão em "Intercept is off"). Com o intercept
+   ligado o script trava esperando você liberar cada request.
+3. **Os serviços de pé.** O seed não sobe nada - ele só bate no que já está rodando.
+   - API: `cd prostaff-api && docker compose up -d` (porta `3333`)
+   - analytics-hub: `npm run dev` (porta `8888`)
+   - ArenaBR: `npm run dev` (porta `4000`) - opcional, desligue com `ARENA=""`
+4. **`curl`** (sempre presente) e, opcional, **`python3`** - usado pra extrair token de JSON
+   aninhado. Sem ele, o script cai num fallback por `grep` (funciona pros casos comuns).
+
+> Como os alvos locais são `http://`, **não precisa instalar o CA do Burp**. O CA só é
+> necessário pra interceptar `https://` (staging/produção) sem erro de certificado.
+
+## Rodando
+
+```bash
+cd prostaff-api/.pentest
+./scripts/burp-seed.sh
+```
+
+Saída esperada (resumida):
+
+```
+>> prostaff burp-seed   Proxy: http://127.0.0.1:8080
+>> API: http://localhost:3333   Front: http://localhost:8888   Arena: http://localhost:4000
+>> Log: .../snapshots/burp-seed-2026-08-24-090012.log
+
+>> [auth] login em http://localhost:3333/api/v1/auth/login
+   token capturado (312 chars) - rotas autenticadas serao populadas
+
+>> [1/4] API recon / health / docs (anonimo)
+  GET    localhost:3333/up                     200
+  ...
+>> [3/4] API resources (autenticado se houver token)
+  GET    localhost:3333/api/v1/players         200
+  ...
+Seed: 34 ok | 6 4xx/5xx | 0 erro   -> .../snapshots/burp-seed-...log
+```
+
+- **Verde** = 2xx/3xx (ok). **Amarelo** = 4xx/5xx (rota existe mas negou/erro).
+  **Vermelho** = `ERR`, sem conexão (proxy caiu ou serviço fora do ar).
+- O rodapé conta `ok | 4xx/5xx | erro`. **`0 erro` é o sinal de que o proxy e os alvos
+  responderam** - um monte de amarelo é normal (rotas auth-gated batidas sem/antes do login).
+- Tudo também vai pro log em `snapshots/` (já no `.gitignore`, nunca commitado).
+
+## Como a autenticação é capturada
+
+Este é o ponto que faz o Site map ficar **populado de verdade** e não só cheio de 401.
+No login o script guarda corpo + headers + cookies e procura o token em três lugares, nesta
+ordem:
+
+1. **Body JSON** - busca recursiva por `access_token`, `accessToken`, `token`, `jwt`,
+   `id_token`, `authToken`, `bearer` (inclusive aninhado em `data: {...}`).
+2. **Header de resposta** - `Authorization`, `X-Auth-Token`, `X-Access-Token`.
+3. **Cookie de sessão** - o cookie jar fica ligado em todas as requests, então auth por
+   cookie (comum em Spring) flui sozinha.
+
+Achou token → refaz os GETs de recurso com `Authorization: Bearer <token>`.
+Só cookie → segue via jar. Nada → anônimo, e avisa que o JSON autenticado não vem.
+
+O cookie jar vive num `mktemp -d` apagado no fim (`trap ... EXIT`) - **nenhuma credencial
+toca o disco do repositório**.
+
+## Populando as views autenticadas
+
+Os defaults usam a credencial de teste (`test@prostaff.gg` / `Test123!@#`). Se ela logar,
+os recursos já voltam 200. Pra usar outra conta, passe por env - **nunca** edite o arquivo:
+
+```bash
+SEED_EMAIL='owner@org.com' SEED_PASSWORD='...' ./scripts/burp-seed.sh
+```
+
+Se os recursos continuam 401 mesmo logando, cheque: a conta existe? A API criou o usuário
+de teste (`rails runner scripts/create_test_user.rb`)? O endpoint de login é o esperado?
+
+## Onde olhar no Burp
+
+- **Proxy > HTTP history**: lista cronológica de tudo que o seed disparou, com request e
+  response completos. Filtre por host pra separar API de front.
+- **Target > Site map**: árvore de rotas por host. É daqui que sai o "mapa" - clique numa
+  rota pra ver o response salvo. As páginas Next (`/login`, `/dashboard`) trazem o HTML/SSR
+  que serve de base pro layout; a API traz o JSON real dos recursos.
+- Marque o host como **in-scope** (botão direito > Add to scope) pra focar o Site map.
+
+## Variáveis de ambiente
+
+|      Var          |             O que é             |   Default (prostaff)   |  Default (credscout)  |
+|-------------------|---------------------------------|------------------------|-----------------------|
+| `PROXY`           | proxy do Burp                   | `http://127.0.0.1:8080`| `http://127.0.0.1:8080`|
+| `API`             | base do backend                 | `http://localhost:3333`| `http://localhost:9991`|
+| `FRONT`           | front principal (dev server)    | `http://localhost:8888`| `http://localhost:3001`|
+| `ARENA`           | 2o front; `""` desliga          | `http://localhost:4000`| (n/a)                 |
+| `SEED_EMAIL`/`SEED_USER` | login de teste           | `test@prostaff.gg`     | `seed@example.test`   |
+| `SEED_PASSWORD`/`SEED_PASS` | senha de teste        | `Test123!@#`           | `seed`                |
+| `LOGIN_PATH`      | endpoint de login (só credscout)| (fixo `/api/v1/auth/login`) | `/api/login`     |
+| `LOGIN_FIELD`     | campo de usuário (só credscout) | (fixo `email`)         | `username`            |
+| `TIMEOUT`         | max-time por request (s)        | `6`                    | `6`                   |
+
+## Fluxo recomendado
+
+1. Suba os serviços e abra o Burp (Intercept OFF).
+2. Rode o seed - confirme `0 erro` no rodapé.
+3. Marque o host como in-scope no Target.
+4. Explore o Site map pra entender rotas e shapes.
+5. Só então parta pros scripts de vetor (`03_jwt_attacks.sh` etc.) ou pro Repeater/Intruder,
+   já com o mapa na mão.
+
+## Troubleshooting
+
+|          Sintoma                     |                    Causa provável / ação                        |
+|--------------------------------------|-----------------------------------------------------------------|
+| `!! proxy nao respondeu`             | Burp fechado, listener fora do `:8080`, ou API/front down.       |
+| Tudo `ERR` (vermelho)                | Proxy ok mas alvo fora do ar - suba o serviço.                   |
+| Script trava/pendura                 | Intercept ligado - desligue em Proxy > Intercept.                |
+| `sem token/cookie` no login          | Credencial inválida ou endpoint de login diferente - ajuste env.|
+| Recursos todos `401` com token       | Conta sem permissão, ou usuário de teste não criado na API.      |
+| Site map vazio no Burp               | Host fora de escopo - Add to scope, ou olhe em HTTP history.     |
+
+## Segurança e higiene
+
+- Credenciais **sempre por env**, nunca hardcoded no script versionado.
+- Logs em `snapshots/` já estão no `.gitignore` - não commitar.
+- O seed é **não-destrutivo**: só `GET`/`OPTIONS` mais o `POST` de login. Não cria, edita
+  nem apaga recurso. Rode à vontade quantas vezes quiser.
diff --git a/.pentest/README.md b/.pentest/README.md
index 2f2b19f5..907e3c3d 100644
--- a/.pentest/README.md
+++ b/.pentest/README.md
@@ -6,7 +6,7 @@ Lab de testes de segurança para a API ProStaff
 
 - **API**: http://localhost:3333/api/v1
 - **WebSocket**: ws://localhost:3333/cable
-- **Stack**: Rails 7.2, PostgreSQL, Redis, JWT, Pundit, Rack::Attack, Meilisearch
+- **Stack**: Rails 8.1, PostgreSQL, Redis, JWT, Pundit, Rack::Attack, Meilisearch
 
 ## Pre-requisitos
 
@@ -23,10 +23,16 @@ Credenciais de teste: `test@prostaff.gg` / `Test123!@#`
 ## Instalacao das ferramentas
 
 ```bash
-./tools/install.sh          # instala nuclei, pd-httpx, sqlmap, websocat
-./tools/install.sh check    # verifica status das ferramentas
+./tools/install.sh              # instala nuclei, pd-httpx, sqlmap, websocat, playwright
+./tools/install.sh check        # verifica status das ferramentas
+./tools/install.sh playwright   # so o playwright (chromium headless)
 ```
 
+`playwright` (`tools/playwright/`) e usado pelos scripts `*-live.sh` do frontend para
+capturar dados reais quando o target esta atras de um WAF/challenge JS (ex: Vercel
+Security Checkpoint em prostaff.gg) que bloqueia qualquer request sem execucao de JS —
+ver `front/check-waf-fingerprint.sh` e a nota no final da secao de Frontend.
+
 ## Scripts — API (scripts/)
 
 |         Script                        |                                Vetor                           | Destrutivo | Lento |
@@ -59,22 +65,60 @@ Credenciais de teste: `test@prostaff.gg` / `Test123!@#`
 | 25_mass_assignment.sh                 | Strong Param: role, org_id, puuid, plan escalation             |    Nao     |  Nao  |
 | 26_tournaments_security.sh            | Auth/IDOR/mass assignment no modulo tournaments                |    Nao     |  Nao  |
 | 27_supabase_direct_bypass.sh          | Bypass da camada Rails via Supabase REST API direto            |    Nao     |  Nao  |
+| 28_prostaff_audit.sh                  | Bridge p/ ProStaff-Audit: findings + relatorio + CVSS         |    Nao     |  Sim  |
 
 ## Scripts — Frontend (front/)
 
-|           Script          |                             Vetor                                     |
-|---------------------------|-----------------------------------------------------------------------|
-| check-security-headers.sh | Todos os 22 checkers CaramelScan no prostaff.gg                       |
-| check-cookies.sh          | Flags de cookie, SameSite, duracao, CSRF token                        |
-| check-sri.sh              | SRI em scripts/CSS externos, source maps, scripts inline              |
-| check-content-security.sh | Version disclosure, Referrer-Policy, cache em paginas auth, COOP/CORP |
-| check-info-disclosure.sh  | .env, .git, __NEXT_DATA__, BUILD_ID, comentarios HTML, robots.txt     |
+|           Script            |                             Vetor                                     |
+|------------------------------|-----------------------------------------------------------------------|
+| check-security-headers.sh   | Todos os 22 checkers CaramelScan no prostaff.gg                       |
+| check-cookies.sh            | Flags de cookie, SameSite, duracao, CSRF token                        |
+| check-sri.sh                | SRI em scripts/CSS externos, source maps, scripts inline              |
+| check-content-security.sh   | Version disclosure, Referrer-Policy, cache em paginas auth, COOP/CORP |
+| check-info-disclosure.sh    | .env, .git, __NEXT_DATA__, BUILD_ID, comentarios HTML, robots.txt     |
+| check-waf-fingerprint.sh    | Detecta WAF/anti-bot (Cloudflare, Vercel Security Checkpoint) e se esta bloqueando paths de forma indiscriminada (invalida testes por status HTTP) |
+| check-security-headers-live.sh | Mesmos 22 checkers do check-security-headers.sh, mas via Chromium headless (Playwright) — necessario em prostaff.gg pois o Vercel Security Checkpoint bloqueia 100% das requests via curl, mesmo com UA de browser real |
 
 Todos os scripts de frontend aceitam o target como primeiro argumento:
 ```bash
 ./front/check-security-headers.sh https://staging.prostaff.gg
 ```
 
+### Nota: WAF/challenge JS em prostaff.gg (producao)
+
+`prostaff.gg` roda atras de um challenge JS (Vercel Security Checkpoint, por tras da
+Cloudflare) que retorna 403 para **qualquer** request sem execucao de JS — confirmado
+com `curl` inclusive usando User-Agent de browser real (nao e filtro por UA, e um
+challenge de verdade). Isso significa:
+
+- `check-security-headers.sh`, `check-cookies.sh`, `check-sri.sh` e
+  `check-content-security.sh` (baseados em `curl`) so enxergam os headers/corpo da
+  **pagina de bloqueio**, nunca do app real, quando rodados contra producao.
+- `check-info-disclosure.sh` ja tem um guard de calibracao (baseline contra path
+  aleatorio) que marca resultados 401/403 como inconclusivos quando isso acontece,
+  em vez de reportar falso-positivo de "protegido".
+- Rode `check-waf-fingerprint.sh` primeiro para confirmar se o bloqueio esta ativo.
+- Para headers reais, use `check-security-headers-live.sh` (Chromium via
+  Playwright, `tools/install.sh playwright`) — ele deixa o challenge resolver
+  como um browser de verdade resolveria e le os headers da resposta final.
+- Os demais scripts baseados em `curl` continuam validos rodando contra
+  `localhost:3000` (dev) ou um ambiente sem a camada Vercel/Cloudflare na frente.
+
+## Utilitarios (nao-vetores)
+
+|      Script        |                         Funcao                              | Destrutivo |
+|--------------------|-------------------------------------------------------------|------------|
+| scripts/burp-seed.sh | Semeia o Burp com trafego real (API + fronts) pra popular HTTP history e Site map. Loga, captura token/cookie e refaz GETs autenticados. So GET/OPTIONS + login. | Nao |
+
+Tutorial completo do fluxo: [`BURP-SEED.md`](./BURP-SEED.md).
+
+```bash
+# API 3333 + analytics-hub 8888 + ArenaBR 4000, com Burp em 127.0.0.1:8080
+./scripts/burp-seed.sh
+# so a API, credencial explicita
+API=http://localhost:3333 ARENA="" SEED_EMAIL=test@prostaff.gg SEED_PASSWORD='Test123!@#' ./scripts/burp-seed.sh
+```
+
 ## Uso rapido
 
 ```bash
@@ -102,7 +146,9 @@ Todos os scripts de frontend aceitam o target como primeiro argumento:
 ./scripts/27_supabase_direct_bypass.sh
 
 # Auditoria completa frontend
-./front/check-security-headers.sh
+./front/check-waf-fingerprint.sh    # rodar primeiro — calibra se ha bloqueio generico de WAF
+./front/check-security-headers.sh          # curl — invalido contra prod se o WAF acima bloquear tudo
+./front/check-security-headers-live.sh     # Chromium/Playwright — headers reais mesmo com o WAF ativo
 ./front/check-cookies.sh
 ./front/check-sri.sh
 ./front/check-content-security.sh
@@ -134,6 +180,7 @@ Salvos em `reports/` com data no nome. Formato: `security-audit-YYYY-MM-DD.md`.
 |---------------------------------------------|----------------|----------|-----------|
 | JWT Race Condition + Token Confusion        |    2026-04-11  |     3    | Corrigido |
 | JWT-02 Reaberto + Admin Cross-Tenant (novo) |    2026-06-06  |     2    | Corrigido |
+| api.prostaff.gg — ProStaff-Audit (Swagger, headers, health, throttle) | 2026-10-16 | 0 | Triagem |
 
 ### Historico de vulnerabilidades corrigidas
 
diff --git a/.pentest/front/check-security-headers-live.sh b/.pentest/front/check-security-headers-live.sh
new file mode 100755
index 00000000..31568da5
--- /dev/null
+++ b/.pentest/front/check-security-headers-live.sh
@@ -0,0 +1,326 @@
+#!/bin/bash
+# CarameloScan Security Headers — Frontend, via headless browser (prostaff.gg)
+# Mesmos 22 checkers de check-security-headers.sh, mas os headers vem de um
+# Chromium real (Playwright) que executa o JS do Vercel Security Checkpoint /
+# Cloudflare challenge ate a pagina final carregar.
+#
+# Por que este script existe: prostaff.gg roda atras de um challenge JS que
+# bloqueia 100% das requests sem execucao de JS (confirmado com curl com UA
+# de browser real — ainda assim 403). check-security-headers.sh (curl -sI)
+# so ve os headers da PAGINA DE BLOQUEIO, nunca do app de verdade. Ver
+# check-waf-fingerprint.sh para a analise que levou a essa conclusao.
+#
+# Requer: node + playwright instalados em tools/playwright (rode
+# tools/install.sh playwright, ou npm install && npx playwright install
+# chromium dentro de tools/playwright/).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLAYWRIGHT_DIR="$SCRIPT_DIR/../tools/playwright"
+TARGET="${1:-https://prostaff.gg}"
+
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+PASSED=0
+FAILED=0
+
+echo ""
+echo -e "${CYAN}CarameloScan — Security Headers Audit (Frontend, live via Chromium)${NC}"
+echo -e "${CYAN}Target: ${TARGET}${NC}"
+echo "=================================================="
+echo ""
+
+test_pass() {
+  echo -e "${GREEN}[PASS]${NC} $1"
+  PASSED=$((PASSED + 1))
+}
+
+test_fail() {
+  echo -e "${RED}[FAIL]${NC} $1"
+  FAILED=$((FAILED + 1))
+}
+
+if ! command -v node &>/dev/null; then
+  echo -e "${RED}Erro: node nao encontrado no PATH.${NC}"
+  exit 2
+fi
+
+if [ ! -d "$PLAYWRIGHT_DIR/node_modules/playwright" ]; then
+  echo -e "${RED}Erro: playwright nao instalado em ${PLAYWRIGHT_DIR}.${NC}"
+  echo "Rode: (cd ${PLAYWRIGHT_DIR} && npm install && npx playwright install chromium)"
+  exit 2
+fi
+
+echo "Capturando pagina com Chromium headless (resolve o challenge JS)..."
+CAPTURE_JSON=$(node "$PLAYWRIGHT_DIR/capture.js" "$TARGET" --timeout=30000)
+
+STATUS=$(echo "$CAPTURE_JSON" | jq -r '.status')
+FINAL_URL=$(echo "$CAPTURE_JSON" | jq -r '.finalUrl')
+echo "Status final: ${STATUS} — URL final: ${FINAL_URL}"
+echo ""
+
+if [ "$STATUS" != "200" ]; then
+  echo -e "${YELLOW}Aviso: pagina nao retornou 200 (retornou ${STATUS}). Resultados abaixo podem ainda refletir bloqueio.${NC}"
+  echo ""
+fi
+
+# Reconstroi um blob "header: valor" por linha, no mesmo formato que
+# check-security-headers.sh espera de `curl -sI`, para reusar a mesma logica.
+HEADERS=$(echo "$CAPTURE_JSON" | jq -r '.headers | to_entries[] | "\(.key): \(.value)"')
+
+echo "--- HSTS ---"
+
+HSTS=$(echo "$HEADERS" | grep -i "^strict-transport-security:" | head -1)
+MAX_AGE=""
+
+# Checker #1 — HSTS Header Presence
+if [ -n "$HSTS" ]; then
+  test_pass "#1 HSTS Header Presence — $(echo "$HSTS" | tr -d '\r')"
+else
+  test_fail "#1 HSTS Header Presence — header ausente"
+fi
+
+# Checker #2 — HSTS Secure Max-Age >= 31536000
+if [ -n "$HSTS" ]; then
+  MAX_AGE=$(echo "$HSTS" | grep -oP 'max-age=\K[0-9]+')
+  if [ -n "$MAX_AGE" ] && [ "$MAX_AGE" -ge 31536000 ]; then
+    test_pass "#2 HSTS Secure Max-Age — max-age=${MAX_AGE} (>= 31536000)"
+  else
+    test_fail "#2 HSTS Secure Max-Age — max-age=${MAX_AGE:-ausente} (minimo: 31536000)"
+  fi
+else
+  test_fail "#2 HSTS Secure Max-Age — HSTS ausente"
+fi
+
+# Checker #3 — HSTS Preload
+if [ -n "$HSTS" ]; then
+  if echo "$HSTS" | grep -qi "preload"; then
+    test_pass "#3 HSTS Preload — presente"
+  else
+    test_fail "#3 HSTS Preload — diretiva 'preload' ausente"
+  fi
+else
+  test_fail "#3 HSTS Preload — HSTS ausente"
+fi
+
+# Checker #4 — HSTS IncludeSubDomains
+if [ -n "$HSTS" ]; then
+  if echo "$HSTS" | grep -qi "includeSubDomains"; then
+    test_pass "#4 HSTS IncludeSubDomains — presente"
+  else
+    test_fail "#4 HSTS IncludeSubDomains — diretiva ausente"
+  fi
+else
+  test_fail "#4 HSTS IncludeSubDomains — HSTS ausente"
+fi
+
+echo ""
+echo "--- CSP ---"
+
+CSP=$(echo "$HEADERS" | grep -i "^content-security-policy:" | head -1)
+DEFAULT_SRC=""
+
+# Checker #5 — CSP Header Presence
+if [ -n "$CSP" ]; then
+  test_pass "#5 CSP Header Presence — presente"
+else
+  test_fail "#5 CSP Header Presence — header ausente (CRITICO: sem protecao contra XSS)"
+fi
+
+# Checker #6 — CSP Default-Src
+if [ -n "$CSP" ]; then
+  DEFAULT_SRC=$(echo "$CSP" | grep -oP "default-src\s+'\K[^']+")
+  if [ "$DEFAULT_SRC" = "none" ] || [ "$DEFAULT_SRC" = "self" ]; then
+    test_pass "#6 CSP Default-Src — '${DEFAULT_SRC}'"
+  elif [ -z "$DEFAULT_SRC" ]; then
+    test_fail "#6 CSP Default-Src — diretiva ausente no CSP"
+  else
+    test_fail "#6 CSP Default-Src — valor inseguro: '${DEFAULT_SRC}'"
+  fi
+else
+  test_fail "#6 CSP Default-Src — CSP ausente"
+fi
+
+# Checker #7 — CSP Object-Src = 'none'
+if [ -n "$CSP" ]; then
+  OBJ_SRC=$(echo "$CSP" | grep -oP "object-src\s+'\K[^']+")
+  if [ "$OBJ_SRC" = "none" ]; then
+    test_pass "#7 CSP Object-Src — 'none' (explicito)"
+  elif [ -z "$OBJ_SRC" ] && [ "$DEFAULT_SRC" = "none" ]; then
+    test_pass "#7 CSP Object-Src — 'none' (via fallback default-src 'none')"
+  elif [ -z "$OBJ_SRC" ]; then
+    test_fail "#7 CSP Object-Src — ausente e sem fallback seguro"
+  else
+    test_fail "#7 CSP Object-Src — valor inseguro: '${OBJ_SRC}'"
+  fi
+else
+  test_fail "#7 CSP Object-Src — CSP ausente"
+fi
+
+# Checker #8 — CSP Base-Uri = 'self'
+if [ -n "$CSP" ]; then
+  BASE_URI=$(echo "$CSP" | grep -oP "base-uri\s+'\K[^']+")
+  if [ "$BASE_URI" = "self" ] || [ "$BASE_URI" = "none" ]; then
+    test_pass "#8 CSP Base-Uri — '${BASE_URI}'"
+  elif [ -z "$BASE_URI" ]; then
+    test_fail "#8 CSP Base-Uri — diretiva ausente (nao herda do default-src)"
+  else
+    test_fail "#8 CSP Base-Uri — valor inseguro: '${BASE_URI}'"
+  fi
+else
+  test_fail "#8 CSP Base-Uri — CSP ausente"
+fi
+
+# Checker #9 — CSP Form-Action (nao wildcard, nao ausente)
+if [ -n "$CSP" ]; then
+  FORM_ACTION_RAW=$(echo "$CSP" | grep -oP "form-action\s+\K[^;]+")
+  if [ -z "$FORM_ACTION_RAW" ]; then
+    test_fail "#9 CSP Form-Action — ausente (nao herda do default-src)"
+  elif echo "$FORM_ACTION_RAW" | grep -q '\*'; then
+    test_fail "#9 CSP Form-Action — wildcard (*) configurado"
+  else
+    test_pass "#9 CSP Form-Action — $(echo "$FORM_ACTION_RAW" | tr -d '\r')"
+  fi
+else
+  test_fail "#9 CSP Form-Action — CSP ausente"
+fi
+
+# Checker #10 — CSP Frame-Ancestors
+if [ -n "$CSP" ]; then
+  if echo "$CSP" | grep -q "frame-ancestors"; then
+    FULL_FA=$(echo "$CSP" | grep -oP "frame-ancestors\s+\K[^;]+")
+    if echo "$FULL_FA" | grep -q '\*'; then
+      test_fail "#10 CSP Frame-Ancestors — wildcard (*) perigoso"
+    else
+      test_pass "#10 CSP Frame-Ancestors — $(echo "$FULL_FA" | tr -d '\r')"
+    fi
+  else
+    test_fail "#10 CSP Frame-Ancestors — ausente (nao herda do default-src)"
+  fi
+else
+  test_fail "#10 CSP Frame-Ancestors — CSP ausente"
+fi
+
+# Checker #11 — CSP Upgrade-Insecure-Requests
+if [ -n "$CSP" ]; then
+  if echo "$CSP" | grep -qi "upgrade-insecure-requests"; then
+    test_pass "#11 CSP Upgrade-Insecure-Requests — presente"
+  else
+    test_fail "#11 CSP Upgrade-Insecure-Requests — ausente"
+  fi
+else
+  test_fail "#11 CSP Upgrade-Insecure-Requests — CSP ausente"
+fi
+
+# Checker #12 — CSP Script-Src (sem unsafe-inline, unsafe-eval, wildcard)
+if [ -n "$CSP" ]; then
+  if echo "$CSP" | grep -q "script-src"; then
+    SCRIPT_SRC_RAW=$(echo "$CSP" | grep -oP "script-src\s+\K[^;]+")
+    if echo "$SCRIPT_SRC_RAW" | grep -qiE "'unsafe-inline'|'unsafe-eval'|\bhttps:\b|^[[:space:]]*\*"; then
+      BANNED=$(echo "$SCRIPT_SRC_RAW" | grep -oiE "'unsafe-inline'|'unsafe-eval'|https:|^\*" | tr '\n' ' ')
+      test_fail "#12 CSP Script-Src — valores perigosos: ${BANNED}"
+    else
+      test_pass "#12 CSP Script-Src — $(echo "$SCRIPT_SRC_RAW" | tr -d '\r' | xargs)"
+    fi
+  elif [ "$DEFAULT_SRC" = "none" ] || [ "$DEFAULT_SRC" = "self" ]; then
+    test_pass "#12 CSP Script-Src — fallback seguro via default-src '${DEFAULT_SRC}'"
+  else
+    test_fail "#12 CSP Script-Src — ausente e sem fallback seguro"
+  fi
+else
+  test_fail "#12 CSP Script-Src — CSP ausente"
+fi
+
+echo ""
+echo "--- Outros Headers ---"
+
+# Checker #13 — X-Content-Type-Options = nosniff
+XCTO=$(echo "$HEADERS" | grep -i "^x-content-type-options:" | head -1)
+if echo "$XCTO" | grep -qi "nosniff"; then
+  test_pass "#13 X-Content-Type-Options — nosniff"
+else
+  test_fail "#13 X-Content-Type-Options — $([ -z "$XCTO" ] && echo 'header ausente' || echo "valor invalido: $(echo "$XCTO" | tr -d '\r')")"
+fi
+
+# Checker #14 — X-Frame-Options = DENY ou SAMEORIGIN
+XFO=$(echo "$HEADERS" | grep -i "^x-frame-options:" | head -1)
+if echo "$XFO" | grep -qiE "DENY|SAMEORIGIN"; then
+  test_pass "#14 X-Frame-Options — $(echo "$XFO" | awk -F': ' '{print $2}' | tr -d '\r')"
+else
+  test_fail "#14 X-Frame-Options — $([ -z "$XFO" ] && echo 'header ausente' || echo "valor invalido: $(echo "$XFO" | tr -d '\r')")"
+fi
+
+echo ""
+echo "--- CORS ---"
+
+CORS_JSON=$(node "$PLAYWRIGHT_DIR/capture-cors.js" "$TARGET" 2>/dev/null || echo '{}')
+ACAO_VAL=$(echo "$CORS_JSON" | jq -r '.headers["access-control-allow-origin"] // empty')
+ACAM_VAL=$(echo "$CORS_JSON" | jq -r '.headers["access-control-allow-methods"] // empty')
+
+# Checker #15 — CORS Access-Control-Allow-Origin
+if [ -z "$ACAO_VAL" ]; then
+  test_fail "#15 CORS Allow-Origin — header ausente"
+elif [ "$ACAO_VAL" = "*" ]; then
+  test_fail "#15 CORS Allow-Origin — WILDCARD (*) configurado"
+else
+  test_pass "#15 CORS Allow-Origin — ${ACAO_VAL}"
+fi
+
+# Checker #16 — CORS Access-Control-Allow-Methods
+if [ -z "$ACAM_VAL" ]; then
+  test_fail "#16 CORS Allow-Methods — header ausente"
+elif echo "$ACAM_VAL" | grep -qi "TRACE"; then
+  test_fail "#16 CORS Allow-Methods — metodo TRACE presente (perigoso)"
+else
+  test_pass "#16 CORS Allow-Methods — ${ACAM_VAL}"
+fi
+
+echo ""
+echo "--- CSP Recursos (img, style, media, frame, font, connect) ---"
+
+check_csp_resource() {
+  local ID="$1"
+  local NAME="$2"
+  local DIRECTIVE="$3"
+
+  if [ -n "$CSP" ]; then
+    if echo "$CSP" | grep -q "${DIRECTIVE}"; then
+      RAW=$(echo "$CSP" | grep -oP "${DIRECTIVE}\s+\K[^;]+")
+      if echo "$RAW" | grep -q '\*'; then
+        test_fail "#${ID} CSP ${NAME} — wildcard (*) perigoso"
+      elif echo "$RAW" | grep -qiE "^http:"; then
+        test_fail "#${ID} CSP ${NAME} — HTTP inseguro permitido"
+      else
+        test_pass "#${ID} CSP ${NAME} — $(echo "$RAW" | tr -d '\r' | xargs)"
+      fi
+    elif [ "$DEFAULT_SRC" = "none" ] || [ "$DEFAULT_SRC" = "self" ]; then
+      test_pass "#${ID} CSP ${NAME} — fallback via default-src '${DEFAULT_SRC}'"
+    else
+      test_fail "#${ID} CSP ${NAME} — ausente e sem fallback seguro"
+    fi
+  else
+    test_fail "#${ID} CSP ${NAME} — CSP ausente"
+  fi
+}
+
+check_csp_resource "17" "Img-Src"     "img-src"
+check_csp_resource "18" "Style-Src"   "style-src"
+check_csp_resource "19" "Media-Src"   "media-src"
+check_csp_resource "20" "Frame-Src"   "frame-src"
+check_csp_resource "21" "Font-Src"    "font-src"
+check_csp_resource "22" "Connect-Src" "connect-src"
+
+echo ""
+echo "=================================================="
+echo -e "Resultado: ${GREEN}${PASSED} PASS${NC} | ${RED}${FAILED} FAIL${NC}"
+echo ""
+
+if [ "$FAILED" -gt 0 ]; then
+  exit 1
+fi
+exit 0
diff --git a/.pentest/front/check-waf-fingerprint.sh b/.pentest/front/check-waf-fingerprint.sh
new file mode 100755
index 00000000..43f40c71
--- /dev/null
+++ b/.pentest/front/check-waf-fingerprint.sh
@@ -0,0 +1,145 @@
+#!/bin/bash
+# WAF / Anti-Bot Fingerprint — Frontend (prostaff.gg)
+# Detecta se ha uma camada de protecao (Cloudflare, Vercel Security
+# Checkpoint, etc) bloqueando requests de forma indiscriminada, o que
+# invalida testes de path baseados apenas em codigo HTTP (401/403).
+
+TARGET="${1:-https://prostaff.gg}"
+
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+PASSED=0
+FAILED=0
+WARNED=0
+
+echo ""
+echo -e "${CYAN}WAF / Anti-Bot Fingerprint — Frontend${NC}"
+echo -e "${CYAN}Target: ${TARGET}${NC}"
+echo "========================================"
+echo ""
+
+test_pass() { echo -e "${GREEN}[PASS]${NC} $1"; PASSED=$((PASSED + 1)); }
+test_fail() { echo -e "${RED}[FAIL]${NC} $1"; FAILED=$((FAILED + 1)); }
+test_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; WARNED=$((WARNED + 1)); }
+
+fetch() {
+  # $1 = path -> preenche RESP_HEADERS, RESP_BODY, RESP_CODE, RESP_SIZE
+  local PATH_URL="$1"
+  local TMP_BODY
+  TMP_BODY=$(mktemp)
+  RESP_HEADERS=$(curl -s -D - -o "$TMP_BODY" --max-time 10 "${TARGET}${PATH_URL}" 2>/dev/null)
+  # pega a ultima linha de status (curl pode emitir 103 Early Hints antes do final)
+  RESP_CODE=$(echo "$RESP_HEADERS" | grep -oP '^HTTP/[0-9.]+ \K[0-9]{3}' | tail -1)
+  RESP_BODY=$(cat "$TMP_BODY")
+  RESP_SIZE=$(wc -c < "$TMP_BODY" | tr -d ' ')
+  rm -f "$TMP_BODY"
+}
+
+# tolerancia de bytes entre respostas de challenge (token dinamico no body/header
+# muda alguns bytes a cada request mesmo servindo a mesma pagina generica)
+SIZE_TOLERANCE=200
+
+sizes_match() {
+  local A="$1" B="$2" DIFF
+  DIFF=$(( A > B ? A - B : B - A ))
+  [ "$DIFF" -le "$SIZE_TOLERANCE" ]
+}
+
+identify_waf() {
+  local HEADERS="$1"
+  local BODY="$2"
+  local FOUND=""
+
+  if echo "$HEADERS" | grep -qi "x-vercel-mitigated: *challenge"; then
+    FOUND="Vercel Security Checkpoint"
+  elif echo "$BODY" | grep -qi "Vercel Security Checkpoint"; then
+    FOUND="Vercel Security Checkpoint (via body)"
+  elif echo "$HEADERS" | grep -qi "cf-mitigated: *challenge"; then
+    FOUND="Cloudflare Challenge"
+  elif echo "$BODY" | grep -qiE "checking your browser|cdn-cgi/challenge-platform|Just a moment"; then
+    FOUND="Cloudflare Challenge (via body)"
+  elif echo "$HEADERS" | grep -qi "^server: *cloudflare"; then
+    FOUND="Cloudflare (proxy, sem challenge detectado)"
+  fi
+
+  echo "$FOUND"
+}
+
+echo "--- Baseline (path aleatorio inexistente) ---"
+
+RANDOM_PATH="/wafcheck-$(date +%s)-${RANDOM}${RANDOM}"
+fetch "$RANDOM_PATH"
+BASE_CODE="$RESP_CODE"
+BASE_SIZE="$RESP_SIZE"
+BASE_WAF=$(identify_waf "$RESP_HEADERS" "$RESP_BODY")
+
+echo "Path testado: ${RANDOM_PATH}"
+echo "HTTP ${BASE_CODE:-sem resposta} — ${BASE_SIZE} bytes"
+
+if [ -n "$BASE_WAF" ]; then
+  test_warn "Camada de protecao identificada: ${BASE_WAF}"
+else
+  test_pass "Nenhuma camada de challenge identificada no baseline"
+fi
+
+echo ""
+echo "--- Consistencia (multiplos paths inexistentes) ---"
+
+CONSISTENT=true
+for i in 1 2 3; do
+  P="/wafcheck2-${i}-$(date +%s%N)"
+  fetch "$P"
+  if [ "$RESP_CODE" != "$BASE_CODE" ] || ! sizes_match "$RESP_SIZE" "$BASE_SIZE"; then
+    CONSISTENT=false
+    test_warn "Path ${P} divergiu do baseline (HTTP ${RESP_CODE}, ${RESP_SIZE} bytes vs baseline HTTP ${BASE_CODE}, ${BASE_SIZE} bytes)"
+  fi
+done
+
+if [ "$CONSISTENT" = "true" ]; then
+  if [ -n "$BASE_WAF" ]; then
+    test_fail "Todos os paths inexistentes retornam resposta identica ao baseline — bloqueio indiscriminado confirmado (${BASE_WAF})"
+    echo "         Isso significa que resultados 401/403 em outros scripts de path"
+    echo "         (ex: check-info-disclosure.sh) NAO indicam protecao real do path"
+    echo "         especifico — sao a mesma pagina de challenge/bloqueio generica."
+  else
+    test_pass "Respostas consistentes para paths inexistentes, sem WAF de challenge identificado"
+  fi
+else
+  test_warn "Respostas inconsistentes entre paths inexistentes — comportamento nao uniforme, investigar manualmente"
+fi
+
+echo ""
+echo "--- Path real conhecido (raiz) ---"
+
+fetch "/"
+ROOT_WAF=$(identify_waf "$RESP_HEADERS" "$RESP_BODY")
+echo "HTTP ${RESP_CODE:-sem resposta} — ${RESP_SIZE} bytes"
+
+if [ "$RESP_CODE" = "$BASE_CODE" ] && sizes_match "$RESP_SIZE" "$BASE_SIZE"; then
+  test_fail "Raiz do site retorna a mesma resposta do baseline de path inexistente — possivel bloqueio total do IP/UA de teste"
+elif [ -n "$ROOT_WAF" ]; then
+  test_warn "Raiz servida com camada de protecao presente: ${ROOT_WAF} (mas resposta distinta do baseline — provavelmente OK)"
+else
+  test_pass "Raiz responde normalmente e distinta do baseline de path inexistente"
+fi
+
+echo ""
+echo "========================================"
+echo -e "Resultado: ${GREEN}${PASSED} PASS${NC} | ${RED}${FAILED} FAIL${NC} | ${YELLOW}${WARNED} WARN${NC}"
+
+if [ -n "$BASE_WAF" ] && [ "$CONSISTENT" = "true" ]; then
+  echo ""
+  echo -e "${YELLOW}NOTA: ${BASE_WAF} detectado bloqueando indiscriminadamente.${NC}"
+  echo -e "${YELLOW}Fuzzing de diretorios (ffuf/dirb) e scripts de path (check-info-disclosure.sh)${NC}"
+  echo -e "${YELLOW}terao resultados nao confiaveis contra este target ate essa camada ser${NC}"
+  echo -e "${YELLOW}contornada de forma autorizada ou testada via ambiente local sem WAF.${NC}"
+fi
+
+echo ""
+
+[ "$FAILED" -gt 0 ] && exit 1
+exit 0
diff --git a/.pentest/scripts/15_full_audit.sh b/.pentest/scripts/15_full_audit.sh
index a661ab17..1b6b5bcb 100644
--- a/.pentest/scripts/15_full_audit.sh
+++ b/.pentest/scripts/15_full_audit.sh
@@ -104,6 +104,7 @@ SCRIPTS=(
   "25:25_mass_assignment.sh:false:false"
   "26:26_tournaments_security.sh:false:false"
   "27:27_supabase_direct_bypass.sh:false:false"
+  "28:28_prostaff_audit.sh:false:true"
 )
 
 # ---------------------------------------------------------------------------
diff --git a/.pentest/scripts/28_prostaff_audit.sh b/.pentest/scripts/28_prostaff_audit.sh
new file mode 100755
index 00000000..aa420c90
--- /dev/null
+++ b/.pentest/scripts/28_prostaff_audit.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+# 28_prostaff_audit.sh - Bridge to the ProStaff-Audit orchestrator.
+# Runs ProStaff-Audit against the local API and maps its findings to the
+# "FINDING:" lines consumed by 15_full_audit.sh.
+#
+# Usage: ./28_prostaff_audit.sh [--url http://localhost:3333] [--target NAME] [--env local] [--mode full|quick|ci]
+# Env:   AUDIT_HOME (default /home/bullet/PROJETOS/ProStaff-Audit)
+#        AUDIT_TEST_PASSWORD (default Test123!@#)
+set -uo pipefail
+
+AUDIT_HOME="${AUDIT_HOME:-/home/bullet/PROJETOS/ProStaff-Audit}"
+BASE_URL="http://localhost:3333"
+TARGET="prostaff-api"
+ENVIRONMENT="local"
+MODE="full"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --url)    BASE_URL="${2:-}"; shift 2 ;;
+    --target) TARGET="${2:-}"; shift 2 ;;
+    --env)    ENVIRONMENT="${2:-}"; shift 2 ;;
+    --mode)   MODE="${2:-}"; shift 2 ;;
+    -h|--help) echo "Usage: $0 [--url URL] [--target NAME] [--env ENV] [--mode MODE]"; exit 0 ;;
+    *) echo "unknown option: $1" >&2; exit 1 ;;
+  esac
+done
+
+log() { echo "[$(date -u +%H:%M:%S)] $*"; }
+
+[ -x "$AUDIT_HOME/audit.sh" ]     || { log "SKIP: ProStaff-Audit nao encontrado em $AUDIT_HOME (defina AUDIT_HOME)"; exit 0; }
+command -v jq >/dev/null 2>&1     || { log "SKIP: jq e obrigatorio"; exit 0; }
+curl -s -o /dev/null --max-time 5 "$BASE_URL/health" || { log "SKIP: API inacessivel em $BASE_URL (docker compose up -d)"; exit 0; }
+
+OUT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/snapshots"
+mkdir -p "$OUT_DIR"
+RUN_DIR="$(mktemp -d)"
+trap 'rm -rf "$RUN_DIR"' EXIT
+
+export AUDIT_AUTHORIZED="true"
+export AUDIT_TEST_PASSWORD="${AUDIT_TEST_PASSWORD:-Test123!@#}"
+
+log "Rodando ProStaff-Audit (target=$TARGET env=$ENVIRONMENT mode=$MODE)"
+set +e
+"$AUDIT_HOME/audit.sh" "$TARGET" --env "$ENVIRONMENT" --mode "$MODE" --output "$RUN_DIR" >"$RUN_DIR/run.log" 2>&1
+AUDIT_EXIT=$?
+set -e
+
+FINDINGS="$RUN_DIR/findings.json"
+[ -f "$FINDINGS" ] || { log "WARN: sem findings.json (exit=$AUDIT_EXIT); ver run.log"; exit 0; }
+
+STAMP="$(date -u +%Y%m%d_%H%M%S)"
+cp -f "$FINDINGS" "$OUT_DIR/prostaff_audit_findings_${STAMP}.json" 2>/dev/null || true
+cp -f "$RUN_DIR"/reports/security-audit-*.md "$OUT_DIR/prostaff_audit_report_${STAMP}.md" 2>/dev/null || true
+
+log "ProStaff-Audit findings:"
+while IFS= read -r line; do
+  [ -n "$line" ] && log "  FINDING: $line"
+done < <(jq -r '
+  .[]
+  | select(.status=="new")
+  | select(.raw_status=="CONFIRMED" or .raw_status=="POTENTIAL")
+  | select(.severity!="INFO")
+  | "[\(.severity)] \(.id) \(.vector) @ \(.endpoint) (conf=\(.confidence))"
+' "$FINDINGS")
+
+HIGH=$(jq -r '[.[]|select(.status=="new")|select(.severity=="HIGH" or .severity=="CRITICAL")]|length' "$FINDINGS")
+ACT=$(jq -r '[.[]|select(.status=="new")|select(.raw_status=="CONFIRMED" or .raw_status=="POTENTIAL")|select(.severity!="INFO")]|length' "$FINDINGS")
+log "Actionable: $ACT (HIGH/CRITICAL: $HIGH)"
+log "Report: $OUT_DIR/prostaff_audit_report_${STAMP}.md"
+[ "$HIGH" -gt 0 ] && { log "WARNING: novo HIGH/CRITICAL."; exit 1; }
+exit 0
diff --git a/.pentest/tools/playwright/capture-cors.js b/.pentest/tools/playwright/capture-cors.js
new file mode 100644
index 00000000..73033280
--- /dev/null
+++ b/.pentest/tools/playwright/capture-cors.js
@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+// capture-cors.js - Sends an OPTIONS preflight-style request from inside a
+// real (already challenge-passed) browser page and reads the RAW response
+// headers via Playwright's network listener.
+//
+// Why not just read fetch()'s response.headers in-page: the Fetch spec hides
+// Access-Control-* response headers from page JavaScript unless the server
+// lists them in Access-Control-Expose-Headers. Playwright's network-level
+// response object (CDP) is not subject to that restriction, so we capture
+// the response there instead of trusting what fetch() exposes to the page.
+//
+// Usage: node capture-cors.js <url> [--timeout=20000]
+// Output: single JSON line { url, status, headers }
+
+const { chromium } = require('playwright');
+
+function parseArgs(argv) {
+  const args = { url: null, timeout: 20000 };
+  for (const a of argv) {
+    if (a.startsWith('--timeout=')) {
+      args.timeout = parseInt(a.split('=')[1], 10) || 20000;
+    } else if (!a.startsWith('--')) {
+      args.url = a;
+    }
+  }
+  return args;
+}
+
+async function main() {
+  const { url, timeout } = parseArgs(process.argv.slice(2));
+
+  if (!url) {
+    process.stderr.write('Usage: node capture-cors.js <url> [--timeout=ms]\n');
+    process.exit(2);
+  }
+
+  const browser = await chromium.launch({
+    headless: true,
+    args: ['--disable-blink-features=AutomationControlled'],
+  });
+
+  try {
+    const context = await browser.newContext({
+      userAgent:
+        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ' +
+        '(KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36',
+    });
+    await context.addInitScript(() => {
+      Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+    });
+
+    const page = await context.newPage();
+
+    // Navega primeiro para resolver o challenge JS do edge (mesmo mecanismo
+    // do capture.js). So depois disso requests subsequentes do mesmo
+    // contexto tem chance real de passar.
+    await page.goto(url, { waitUntil: 'domcontentloaded', timeout }).catch(() => {});
+    try {
+      await page.waitForLoadState('networkidle', { timeout: Math.min(timeout, 10000) });
+    } catch {
+      // ok seguir mesmo sem idle total
+    }
+
+    // casa so pelo metodo: o browser normaliza a URL (ex: adiciona a barra
+    // final em "https://prostaff.gg" -> "https://prostaff.gg/"), entao
+    // comparar strings exatas contra o argumento original nao e confiavel.
+    let optionsResponse = null;
+    const responseListener = (resp) => {
+      if (resp.request().method() === 'OPTIONS') {
+        optionsResponse = resp;
+      }
+    };
+    page.on('response', responseListener);
+
+    await page.evaluate(async (targetUrl) => {
+      try {
+        await fetch(targetUrl, {
+          method: 'OPTIONS',
+          headers: {
+            'Access-Control-Request-Method': 'GET',
+          },
+          mode: 'cors',
+          credentials: 'omit',
+        });
+      } catch {
+        // resposta pode falhar no lado JS (rede/CORS) mas o listener de
+        // response ja capturou os headers reais antes disso
+      }
+    }, url);
+
+    // dar um instante para o listener de response disparar
+    await page.waitForTimeout(1000);
+    page.off('response', responseListener);
+
+    const out = optionsResponse
+      ? {
+          url,
+          status: optionsResponse.status(),
+          headers: await optionsResponse.allHeaders(),
+        }
+      : { url, status: null, headers: {} };
+
+    process.stdout.write(JSON.stringify(out) + '\n');
+  } finally {
+    await browser.close();
+  }
+}
+
+main().catch((err) => {
+  process.stderr.write(`capture-cors.js error: ${err.stack || err}\n`);
+  process.exit(1);
+});
diff --git a/.pentest/tools/playwright/capture.js b/.pentest/tools/playwright/capture.js
new file mode 100644
index 00000000..d80a3e67
--- /dev/null
+++ b/.pentest/tools/playwright/capture.js
@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+// capture.js - Fetches a URL with a real Chromium browser (via Playwright)
+// so JS-based edge challenges (Vercel Security Checkpoint, Cloudflare
+// managed challenge) run and resolve like they would for a real visitor.
+// curl/wget can never pass these because they never execute JS.
+//
+// Usage: node capture.js <url> [--timeout=30000]
+// Output: single JSON line on stdout with { url, finalUrl, status, headers, cookies }
+
+const { chromium } = require('playwright');
+
+function parseArgs(argv) {
+  const args = { url: null, timeout: 30000 };
+  for (const a of argv) {
+    if (a.startsWith('--timeout=')) {
+      args.timeout = parseInt(a.split('=')[1], 10) || 30000;
+    } else if (!a.startsWith('--')) {
+      args.url = a;
+    }
+  }
+  return args;
+}
+
+async function main() {
+  const { url, timeout } = parseArgs(process.argv.slice(2));
+
+  if (!url) {
+    process.stderr.write('Usage: node capture.js <url> [--timeout=ms]\n');
+    process.exit(2);
+  }
+
+  const browser = await chromium.launch({
+    headless: true,
+    args: ['--disable-blink-features=AutomationControlled'],
+  });
+
+  try {
+    const context = await browser.newContext({
+      userAgent:
+        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ' +
+        '(KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36',
+      viewport: { width: 1366, height: 768 },
+    });
+
+    // navigator.webdriver = true is the single biggest automation tell;
+    // strip it before any page script runs.
+    await context.addInitScript(() => {
+      Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+    });
+
+    const page = await context.newPage();
+
+    let mainResponse = null;
+    page.on('response', (resp) => {
+      if (resp.url() === url || mainResponse === null) {
+        mainResponse = resp;
+      }
+    });
+
+    const navResponse = await page.goto(url, {
+      waitUntil: 'domcontentloaded',
+      timeout,
+    });
+
+    // De-a chance ao challenge JS de rodar e redirecionar/reescrever a pagina
+    try {
+      await page.waitForLoadState('networkidle', { timeout: Math.min(timeout, 15000) });
+    } catch {
+      // segue mesmo se nunca ficar 100% idle (ex: polling/websocket ativo)
+    }
+
+    const finalResponse = navResponse || mainResponse;
+    const headers = finalResponse ? await finalResponse.allHeaders() : {};
+    const status = finalResponse ? finalResponse.status() : null;
+    const cookies = await context.cookies();
+    const html = await page.content();
+
+    const out = {
+      url,
+      finalUrl: page.url(),
+      status,
+      headers,
+      cookies,
+      htmlLength: html.length,
+      htmlSnippet: html.slice(0, 2000),
+    };
+
+    process.stdout.write(JSON.stringify(out) + '\n');
+  } finally {
+    await browser.close();
+  }
+}
+
+main().catch((err) => {
+  process.stderr.write(`capture.js error: ${err.stack || err}\n`);
+  process.exit(1);
+});
diff --git a/.pentest/tools/playwright/package.json b/.pentest/tools/playwright/package.json
new file mode 100644
index 00000000..a045e8dd
--- /dev/null
+++ b/.pentest/tools/playwright/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "prostaff-pentest-playwright",
+  "private": true,
+  "description": "Headless browser helper for the ProStaff pentest lab — captures real response headers/cookies past JS-based edge challenges (Vercel Security Checkpoint, Cloudflare) that curl-based checks cannot pass.",
+  "dependencies": {
+    "playwright": "^1.47.0"
+  }
+}
diff --git a/Gemfile b/Gemfile
index 1b9e9c6f..5744a444 100644
--- a/Gemfile
+++ b/Gemfile
@@ -6,7 +6,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 ruby '3.4.8'
 
 # Bundle edge Rails instead: gem "rails", github: "rails/rails", branch: "main"
-gem 'rails', '~> 7.2.3', '>= 7.2.3.1'
+gem 'rails', '~> 8.1.4'
 gem 'connection_pool', '< 3.0'
 
 # Use postgresql as the database for Active Record
@@ -112,7 +112,7 @@ end
 group :development do
   # Speed up commands on slow machines / big apps [https://github.com/rails/spring]
   # gem "spring"
-  gem 'annotate'
+  gem 'annotaterb'
   gem 'bullet'
   gem 'rubocop'
   gem 'rubocop-rails'
diff --git a/Gemfile.lock b/Gemfile.lock
index 9ccc86f6..11ca3d54 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,84 +1,85 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.2.3.2)
-      actionpack (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.4)
+      actionpack (= 8.1.4)
+      activesupport (= 8.1.4)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.3.2)
-      actionpack (= 7.2.3.2)
-      activejob (= 7.2.3.2)
-      activerecord (= 7.2.3.2)
-      activestorage (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
+    actionmailbox (8.1.4)
+      actionpack (= 8.1.4)
+      activejob (= 8.1.4)
+      activerecord (= 8.1.4)
+      activestorage (= 8.1.4)
+      activesupport (= 8.1.4)
       mail (>= 2.8.0)
-    actionmailer (7.2.3.2)
-      actionpack (= 7.2.3.2)
-      actionview (= 7.2.3.2)
-      activejob (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
+    actionmailer (8.1.4)
+      actionpack (= 8.1.4)
+      actionview (= 8.1.4)
+      activejob (= 8.1.4)
+      activesupport (= 8.1.4)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.3.2)
-      actionview (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
-      cgi
+    actionpack (8.1.4)
+      actionview (= 8.1.4)
+      activesupport (= 8.1.4)
       nokogiri (>= 1.8.5)
-      racc
-      rack (>= 2.2.4, < 3.3)
+      rack (>= 2.2.4)
       rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (7.2.3.2)
-      actionpack (= 7.2.3.2)
-      activerecord (= 7.2.3.2)
-      activestorage (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
+    actiontext (8.1.4)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.4)
+      activerecord (= 8.1.4)
+      activestorage (= 8.1.4)
+      activesupport (= 8.1.4)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.3.2)
-      activesupport (= 7.2.3.2)
+    actionview (8.1.4)
+      activesupport (= 8.1.4)
       builder (~> 3.1)
-      cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.3.2)
-      activesupport (= 7.2.3.2)
+    activejob (8.1.4)
+      activesupport (= 8.1.4)
       globalid (>= 0.3.6)
-    activemodel (7.2.3.2)
-      activesupport (= 7.2.3.2)
-    activerecord (7.2.3.2)
-      activemodel (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
+    activemodel (8.1.4)
+      activesupport (= 8.1.4)
+    activerecord (8.1.4)
+      activemodel (= 8.1.4)
+      activesupport (= 8.1.4)
       timeout (>= 0.4.0)
-    activestorage (7.2.3.2)
-      actionpack (= 7.2.3.2)
-      activejob (= 7.2.3.2)
-      activerecord (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
+    activestorage (8.1.4)
+      actionpack (= 8.1.4)
+      activejob (= 8.1.4)
+      activerecord (= 8.1.4)
+      activesupport (= 8.1.4)
       marcel (~> 1.0)
-    activesupport (7.2.3.2)
+    activesupport (8.1.4)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
-      minitest (>= 5.1, < 6)
+      minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
-    annotate (3.2.0)
-      activerecord (>= 3.2, < 8.0)
-      rake (>= 10.4, < 14.0)
+    annotaterb (4.25.0)
+      activerecord (>= 6.0.0)
+      activesupport (>= 6.0.0)
     argon2 (2.3.3)
       ffi (~> 1.15)
       ffi-compiler (~> 1.0)
@@ -105,7 +106,6 @@ GEM
     base64 (0.3.0)
     bcrypt (3.1.22)
     bcrypt_pbkdf (1.1.2)
-    benchmark (0.5.0)
     bigdecimal (3.3.1)
     blueprinter (1.2.1)
     bootsnap (1.18.6)
@@ -119,8 +119,7 @@ GEM
     bundler-audit (0.9.3)
       bundler (>= 1.2.0)
       thor (~> 1.0)
-    cgi (0.5.2)
-    concurrent-ruby (1.3.8)
+    concurrent-ruby (1.3.7)
     connection_pool (2.5.5)
     crack (1.0.0)
       bigdecimal
@@ -181,7 +180,7 @@ GEM
     fugit (1.12.1)
       et-orbi (~> 1.4)
       raabro (~> 1.4)
-    globalid (1.4.0)
+    globalid (1.3.0)
       activesupport (>= 6.1)
     hashdiff (1.2.1)
     hashid-rails (1.4.1)
@@ -192,7 +191,7 @@ GEM
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    i18n (1.15.2)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
     io-console (0.8.2)
     irb (1.17.0)
@@ -247,7 +246,7 @@ GEM
       net-imap
       net-pop
       net-smtp
-    marcel (1.2.1)
+    marcel (1.1.0)
     meilisearch (0.33.0)
       httparty (~> 0.24)
     mini_mime (1.1.5)
@@ -315,20 +314,20 @@ GEM
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (7.2.3.2)
-      actioncable (= 7.2.3.2)
-      actionmailbox (= 7.2.3.2)
-      actionmailer (= 7.2.3.2)
-      actionpack (= 7.2.3.2)
-      actiontext (= 7.2.3.2)
-      actionview (= 7.2.3.2)
-      activejob (= 7.2.3.2)
-      activemodel (= 7.2.3.2)
-      activerecord (= 7.2.3.2)
-      activestorage (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
+    rails (8.1.4)
+      actioncable (= 8.1.4)
+      actionmailbox (= 8.1.4)
+      actionmailer (= 8.1.4)
+      actionpack (= 8.1.4)
+      actiontext (= 8.1.4)
+      actionview (= 8.1.4)
+      activejob (= 8.1.4)
+      activemodel (= 8.1.4)
+      activerecord (= 8.1.4)
+      activestorage (= 8.1.4)
+      activesupport (= 8.1.4)
       bundler (>= 1.15.0)
-      railties (= 7.2.3.2)
+      railties (= 8.1.4)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -336,10 +335,9 @@ GEM
     rails-html-sanitizer (1.7.1)
       loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.2.3.2)
-      actionpack (= 7.2.3.2)
-      activesupport (= 7.2.3.2)
-      cgi
+    railties (8.1.4)
+      actionpack (= 8.1.4)
+      activesupport (= 8.1.4)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -379,21 +377,21 @@ GEM
       rspec-mocks (>= 3.13.0, < 5.0.0)
       rspec-support (>= 3.13.0, < 5.0.0)
     rspec-support (3.13.6)
-    rswag (2.16.0)
-      rswag-api (= 2.16.0)
-      rswag-specs (= 2.16.0)
-      rswag-ui (= 2.16.0)
-    rswag-api (2.16.0)
-      activesupport (>= 5.2, < 8.1)
-      railties (>= 5.2, < 8.1)
-    rswag-specs (2.16.0)
-      activesupport (>= 5.2, < 8.1)
-      json-schema (>= 2.2, < 6.0)
-      railties (>= 5.2, < 8.1)
+    rswag (2.17.0)
+      rswag-api (= 2.17.0)
+      rswag-specs (= 2.17.0)
+      rswag-ui (= 2.17.0)
+    rswag-api (2.17.0)
+      activesupport (>= 5.2, < 8.2)
+      railties (>= 5.2, < 8.2)
+    rswag-specs (2.17.0)
+      activesupport (>= 5.2, < 8.2)
+      json-schema (>= 2.2, < 7.0)
+      railties (>= 5.2, < 8.2)
       rspec-core (>= 2.14)
-    rswag-ui (2.16.0)
-      actionpack (>= 5.2, < 8.1)
-      railties (>= 5.2, < 8.1)
+    rswag-ui (2.17.0)
+      actionpack (>= 5.2, < 8.2)
+      railties (>= 5.2, < 8.2)
     rubocop (1.81.1)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
@@ -477,7 +475,7 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
-  annotate
+  annotaterb
   argon2 (~> 2.3)
   aws-sdk-s3 (~> 1.0)
   bcrypt (~> 3.1.7)
@@ -509,7 +507,7 @@ DEPENDENCIES
   rack (~> 3.1.20)
   rack-attack
   rack-cors
-  rails (~> 7.2.3, >= 7.2.3.1)
+  rails (~> 8.1.4)
   redis (~> 5.0)
   rspec-rails
   rswag
diff --git a/README.md b/README.md
index e12ef578..083e293f 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@
 
 
 [![Ruby Version](https://img.shields.io/badge/ruby-3.4.8-CC342D?logo=ruby)](https://www.ruby-lang.org/)
-[![Rails Version](https://img.shields.io/badge/rails-7.2.3.1-CC342D?logo=rubyonrails)](https://rubyonrails.org/)
+[![Rails Version](https://img.shields.io/badge/rails-8.1.4-CC342D?logo=rubyonrails)](https://rubyonrails.org/)
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-14+-blue.svg?logo=postgresql)](https://www.postgresql.org/)
 [![Redis](https://img.shields.io/badge/Redis-6+-red.svg?logo=redis)](https://redis.io/)
 [![Swagger](https://img.shields.io/badge/API-Swagger-85EA2D?logo=swagger)](http://localhost:3333/api-docs)
@@ -32,7 +32,7 @@
 
 ```
 ╔══════════════════════════════════════════════════════════════════════════════╗
-║  PROSTAFF API - Ruby on Rails 7.2 (API-Only)                                 ║
+║  PROSTAFF API - Ruby on Rails 8.1 (API-Only)                                 ║
 ╠══════════════════════════════════════════════════════════════════════════════╣
 ║  Backend for the ProStaff.gg esports team management platform.               ║
 ║  200+ documented endpoints · JWT Auth · Modular Monolith · p95 ~200ms        ║
@@ -195,7 +195,7 @@ Local Docker services started by `docker compose up -d`:
 ║  LAYER               ║  TECNOLOGY                                         ║
 ╠══════════════════════╬════════════════════════════════════════════════════╣
 ║  Language            ║  Ruby 3.4.8                                        ║
-║  Framework           ║  Rails 7.2.3.1 (API-only mode)                     ║
+║  Framework           ║  Rails 8.1.4 (API-only mode)                     ║
 ║  Database            ║  PostgreSQL 14+                                    ║
 ║  Authentication      ║  JWT (access + refresh tokens) + Argon2id hashing  ║
 ║  URL Obfuscation     ║  HashID with Base62 encoding                       ║
@@ -1407,7 +1407,7 @@ graph TB
 
 **Production Stack (Coolify):**
 - **Reverse Proxy**: Traefik with automatic TLS (Let's Encrypt) - round robin across 2 api replicas
-- **Application**: Rails 7.2 API (Puma, 2 replicas) + Action Cable + Sidekiq (1 instance - do not scale)
+- **Application**: Rails 8.1 API (Puma, 2 replicas) + Action Cable + Sidekiq (1 instance - do not scale)
 - **Event Bus**: prostaff-events - Elixir/Phoenix 1.7 (domain events via Phoenix Channels)
 - **Riot Gateway**: prostaff-riot-gateway - Go 1.23 (token bucket, L1/L2 cache, circuit breaker)
 - **Database**: PostgreSQL 14+ (Supabase self-hosted)
diff --git a/app/models/user.rb b/app/models/user.rb
index 195e2e36..40a70555 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -79,6 +79,10 @@ def manager?
     role == 'manager'
   end
 
+  def coach?
+    role == 'coach'
+  end
+
   def admin_or_owner?
     %w[admin owner].include?(role)
   end
diff --git a/app/modules/players/controllers/players_controller.rb b/app/modules/players/controllers/players_controller.rb
index 2a7e517e..6b980376 100644
--- a/app/modules/players/controllers/players_controller.rb
+++ b/app/modules/players/controllers/players_controller.rb
@@ -50,7 +50,7 @@ def show
         view = financial_access? ? :with_contract : :default
         cache_key = "players/#{@player.id}/#{financial_access? ? 'financial' : 'standard'}"
         data = cache_response(cache_key, expires_in: 5.minutes) do
-          { player: PlayerSerializer.render_as_hash(@player, root: :player, view: view) }
+          PlayerSerializer.render_as_hash(@player, root: :player, view: view)
         end
 
         oe_stat = OePlayerLookupService.latest_stats(@player.professional_name)
diff --git a/app/modules/players/services/roster_management_service.rb b/app/modules/players/services/roster_management_service.rb
index ee7548eb..9db590d4 100644
--- a/app/modules/players/services/roster_management_service.rb
+++ b/app/modules/players/services/roster_management_service.rb
@@ -76,9 +76,6 @@ def self.hire_from_scouting(scouting_target:, organization:, contract_start:, co
         organization: organization,
         status: 'active',
         line: line.presence_in(Constants::Player::LINES) || 'main',
-        contract_start_date: contract_start,
-        contract_end_date: contract_end,
-        salary: salary,
         jersey_number: jersey_number,
         deleted_at: nil,
         removed_reason: nil,
@@ -609,8 +606,6 @@ def self.addition_new_values(player, scouting_target)
     {
       status: player.status,
       organization_id: player.organization_id,
-      contract_start_date: player.contract_start_date,
-      contract_end_date: player.contract_end_date,
       source: 'scouting_target',
       scouting_target_id: scouting_target.id
     }
diff --git a/app/modules/scouting/controllers/market_registrations_controller.rb b/app/modules/scouting/controllers/market_registrations_controller.rb
index 4f174f84..7fd7f3fc 100644
--- a/app/modules/scouting/controllers/market_registrations_controller.rb
+++ b/app/modules/scouting/controllers/market_registrations_controller.rb
@@ -70,10 +70,10 @@ def show
 
       def filtered_registrations
         scope = MarketRegistration
-                  .for_region(params[:region])
-                  .expiring_before(params[:expiring_before])
-                  .search_query(params[:q])
-        scope = scope.free_agents      if params[:free_agents_only] == 'true'
+                .for_region(params[:region])
+                .expiring_before(params[:expiring_before])
+                .search_query(params[:q])
+        scope = scope.free_agents if params[:free_agents_only] == 'true'
         scope = scope.expired_contracts if params[:expired_only] == 'true'
         scope
       end
diff --git a/app/modules/scouting/controllers/players_controller.rb b/app/modules/scouting/controllers/players_controller.rb
index 18b2ddf7..235ee5cf 100644
--- a/app/modules/scouting/controllers/players_controller.rb
+++ b/app/modules/scouting/controllers/players_controller.rb
@@ -224,9 +224,7 @@ def matches
 
         player = Player.unscoped.find_by(riot_puuid: @target.riot_puuid)
 
-        unless player
-          return render_success({ matches: [], message: 'No match data found for this player' })
-        end
+        return render_success({ matches: [], message: 'No match data found for this player' }) unless player
 
         limit = [(params[:limit] || 20).to_i, 50].min
         stats = PlayerMatchStat.where(player: player)
diff --git a/db/migrate/20260606100000_create_contracts.rb b/db/migrate/20260606100000_create_contracts.rb
index 724b8180..2431a12d 100644
--- a/db/migrate/20260606100000_create_contracts.rb
+++ b/db/migrate/20260606100000_create_contracts.rb
@@ -25,22 +25,22 @@ def change
       t.uuid    :renewed_from_id
 
       t.text    :notes
-      t.jsonb   :metadata,              default: {}
+      t.jsonb   :metadata, default: {}
       t.datetime :deleted_at
 
       t.timestamps
     end
 
     add_foreign_key :contracts, :organizations, column: :organization_id,
-                    name: 'fk_contracts_organization'
+                                                name: 'fk_contracts_organization'
     add_foreign_key :contracts, :players, column: :player_id,
-                    name: 'fk_contracts_player'
+                                          name: 'fk_contracts_player'
     add_foreign_key :contracts, :users, column: :created_by_id,
-                    name: 'fk_contracts_created_by'
+                                        name: 'fk_contracts_created_by'
     add_foreign_key :contracts, :users, column: :updated_by_id,
-                    name: 'fk_contracts_updated_by'
+                                        name: 'fk_contracts_updated_by'
     add_foreign_key :contracts, :contracts, column: :renewed_from_id,
-                    name: 'fk_contracts_renewed_from'
+                                            name: 'fk_contracts_renewed_from'
 
     add_index :contracts, :organization_id
     add_index :contracts, :player_id
diff --git a/db/migrate/20260606100100_create_contract_bonuses.rb b/db/migrate/20260606100100_create_contract_bonuses.rb
index 0900916b..d066d656 100644
--- a/db/migrate/20260606100100_create_contract_bonuses.rb
+++ b/db/migrate/20260606100100_create_contract_bonuses.rb
@@ -19,9 +19,9 @@ def change
     end
 
     add_foreign_key :contract_bonuses, :contracts, column: :contract_id,
-                    name: 'fk_contract_bonuses_contract'
+                                                   name: 'fk_contract_bonuses_contract'
     add_foreign_key :contract_bonuses, :organizations, column: :organization_id,
-                    name: 'fk_contract_bonuses_organization'
+                                                       name: 'fk_contract_bonuses_organization'
 
     add_index :contract_bonuses, :contract_id
     add_index :contract_bonuses, %i[organization_id status]
diff --git a/db/migrate/20260606100200_create_budget_allocations.rb b/db/migrate/20260606100200_create_budget_allocations.rb
index 05009951..7a60affc 100644
--- a/db/migrate/20260606100200_create_budget_allocations.rb
+++ b/db/migrate/20260606100200_create_budget_allocations.rb
@@ -14,15 +14,15 @@ def change
       t.string  :currency,     default: 'BRL'
       t.string  :lineup,       default: 'main'
       t.text    :notes
-      t.string  :status,       default: 'active'
+      t.string  :status, default: 'active'
 
       t.timestamps
     end
 
     add_foreign_key :budget_allocations, :organizations, column: :organization_id,
-                    name: 'fk_budget_allocs_organization'
+                                                         name: 'fk_budget_allocs_organization'
     add_foreign_key :budget_allocations, :users, column: :created_by_id,
-                    name: 'fk_budget_allocs_created_by'
+                                                 name: 'fk_budget_allocs_created_by'
 
     add_index :budget_allocations, %i[organization_id status]
     add_index :budget_allocations, %i[organization_id start_date end_date],
diff --git a/db/migrate/20260606100300_create_expenses.rb b/db/migrate/20260606100300_create_expenses.rb
index 4ad71b1f..bdcc4322 100644
--- a/db/migrate/20260606100300_create_expenses.rb
+++ b/db/migrate/20260606100300_create_expenses.rb
@@ -3,9 +3,9 @@
 class CreateExpenses < ActiveRecord::Migration[7.1]
   def change
     create_table :expenses, id: :uuid do |t|
-      t.uuid :organization_id,      null: false
+      t.uuid :organization_id, null: false
       t.uuid :budget_allocation_id
-      t.uuid :created_by_id,        null: false
+      t.uuid :created_by_id, null: false
       t.uuid :approved_by_id
       t.uuid :player_id
 
@@ -19,22 +19,22 @@ def change
       t.date    :paid_at
       t.string  :receipt_url
       t.text    :notes
-      t.boolean :recurring,      default: false
+      t.boolean :recurring, default: false
       t.string  :recurrence_rule
 
       t.timestamps
     end
 
     add_foreign_key :expenses, :organizations, column: :organization_id,
-                    name: 'fk_expenses_organization'
+                                               name: 'fk_expenses_organization'
     add_foreign_key :expenses, :budget_allocations, column: :budget_allocation_id,
-                    name: 'fk_expenses_budget_allocation'
+                                                    name: 'fk_expenses_budget_allocation'
     add_foreign_key :expenses, :users, column: :created_by_id,
-                    name: 'fk_expenses_created_by'
+                                       name: 'fk_expenses_created_by'
     add_foreign_key :expenses, :users, column: :approved_by_id,
-                    name: 'fk_expenses_approved_by'
+                                       name: 'fk_expenses_approved_by'
     add_foreign_key :expenses, :players, column: :player_id,
-                    name: 'fk_expenses_player'
+                                         name: 'fk_expenses_player'
 
     add_index :expenses, %i[organization_id category]
     add_index :expenses, %i[organization_id expense_date]
diff --git a/db/migrate/20260613100000_add_roster_intelligence_fields_to_players.rb b/db/migrate/20260613100000_add_roster_intelligence_fields_to_players.rb
index 144e5b7a..ec6aea36 100644
--- a/db/migrate/20260613100000_add_roster_intelligence_fields_to_players.rb
+++ b/db/migrate/20260613100000_add_roster_intelligence_fields_to_players.rb
@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 class AddRosterIntelligenceFieldsToPlayers < ActiveRecord::Migration[7.1]
   def change
-    add_column :players, :residency, :string, comment: "Import slot classification: resident | non_resident | na_resident | americas_resident | native_resident. See Constants::Player::RESIDENCIES."
-    add_column :players, :player_type, :string, default: "player", null: false, comment: "Record type: player | coach | analyst | manager"
-    add_column :players, :staff_role, :string, comment: "Coaching staff function when player_type != player (e.g. head_coach, assistant_coach, analyst)"
+    add_column :players, :residency, :string, comment: 'Import slot classification: resident | non_resident | na_resident | americas_resident | native_resident. See Constants::Player::RESIDENCIES.'
+    add_column :players, :player_type, :string, default: 'player', null: false, comment: 'Record type: player | coach | analyst | manager'
+    add_column :players, :staff_role, :string, comment: 'Coaching staff function when player_type != player (e.g. head_coach, assistant_coach, analyst)'
 
     add_index :players, :residency
     add_index :players, :player_type
diff --git a/db/migrate/20260613100100_create_player_rank_snapshots.rb b/db/migrate/20260613100100_create_player_rank_snapshots.rb
index 92aa2f6e..193c87e5 100644
--- a/db/migrate/20260613100100_create_player_rank_snapshots.rb
+++ b/db/migrate/20260613100100_create_player_rank_snapshots.rb
@@ -1,22 +1,24 @@
+# frozen_string_literal: true
+
 class CreatePlayerRankSnapshots < ActiveRecord::Migration[7.1]
   def change
     create_table :player_rank_snapshots, id: :uuid do |t|
       t.references :player, null: false, foreign_key: true, type: :uuid
-      t.string  :queue_type,  null: false, default: "RANKED_SOLO_5x5",
-                comment: "Riot queue type: RANKED_SOLO_5x5 | RANKED_FLEX_SR"
-      t.string  :tier,        comment: "e.g. GRANDMASTER, CHALLENGER, MASTER"
-      t.string  :rank,        comment: "e.g. I, II, III, IV (null for apex tiers)"
+      t.string  :queue_type,  null: false, default: 'RANKED_SOLO_5x5',
+                              comment: 'Riot queue type: RANKED_SOLO_5x5 | RANKED_FLEX_SR'
+      t.string  :tier,        comment: 'e.g. GRANDMASTER, CHALLENGER, MASTER'
+      t.string  :rank,        comment: 'e.g. I, II, III, IV (null for apex tiers)'
       t.integer :league_points, null: false, default: 0
       t.integer :wins,        null: false, default: 0
       t.integer :losses,      null: false, default: 0
-      t.date    :recorded_on, null: false, comment: "Date the snapshot was taken (one per player per queue per day)"
+      t.date    :recorded_on, null: false, comment: 'Date the snapshot was taken (one per player per queue per day)'
 
       t.timestamps
     end
 
-    add_index :player_rank_snapshots, [:player_id, :queue_type, :recorded_on],
+    add_index :player_rank_snapshots, %i[player_id queue_type recorded_on],
               unique: true,
-              name: "idx_player_rank_snapshots_unique"
-    add_index :player_rank_snapshots, [:player_id, :recorded_on]
+              name: 'idx_player_rank_snapshots_unique'
+    add_index :player_rank_snapshots, %i[player_id recorded_on]
   end
 end
diff --git a/db/migrate/20260617001658_create_vod_analysis_jobs.rb b/db/migrate/20260617001658_create_vod_analysis_jobs.rb
index 6fa8c2ae..8880602c 100644
--- a/db/migrate/20260617001658_create_vod_analysis_jobs.rb
+++ b/db/migrate/20260617001658_create_vod_analysis_jobs.rb
@@ -2,7 +2,7 @@
 
 class CreateVodAnalysisJobs < ActiveRecord::Migration[7.2]
   def change
-    create_table :vod_analysis_jobs, id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    create_table :vod_analysis_jobs, id: :uuid, default: -> { 'gen_random_uuid()' }, force: :cascade do |t|
       t.references :vod_review, null: false, foreign_key: true, type: :uuid
       t.string :status, null: false, default: 'pending'
       t.integer :progress, default: 0
diff --git a/db/migrate/20260620000001_create_staff_members.rb b/db/migrate/20260620000001_create_staff_members.rb
index e9f88665..076b8e21 100644
--- a/db/migrate/20260620000001_create_staff_members.rb
+++ b/db/migrate/20260620000001_create_staff_members.rb
@@ -16,7 +16,7 @@ def up
       t.string :role,            null: false
       t.string :status,          null: false, default: 'active'
       t.string :line
-      t.string :country,         limit: 2
+      t.string :country, limit: 2
       t.date   :birth_date
       t.date   :contract_start_date
       t.date   :contract_end_date
diff --git a/db/migrate/20260621000002_create_goal_check_ins.rb b/db/migrate/20260621000002_create_goal_check_ins.rb
index e9e6a985..079e5138 100644
--- a/db/migrate/20260621000002_create_goal_check_ins.rb
+++ b/db/migrate/20260621000002_create_goal_check_ins.rb
@@ -7,7 +7,7 @@ def change
       t.uuid       :organization_id, null: false
       t.decimal    :measured_value,  precision: 10, scale: 4
       t.text       :note
-      t.string     :source,          null: false  # auto | manual
+      t.string     :source, null: false # auto | manual
       t.uuid       :created_by_id
       t.timestamps
     end
diff --git a/db/migrate/20260621000003_create_roster_memberships.rb b/db/migrate/20260621000003_create_roster_memberships.rb
index b8aee2e0..fddf956a 100644
--- a/db/migrate/20260621000003_create_roster_memberships.rb
+++ b/db/migrate/20260621000003_create_roster_memberships.rb
@@ -9,7 +9,7 @@ def change
       t.string :status,          null: false
       t.string :line,            default: 'main'
       t.uuid   :contract_id
-      t.date   :joined_at,       null: false
+      t.date   :joined_at, null: false
       t.date   :left_at
       t.uuid   :created_by_id
       t.timestamps
diff --git a/db/migrate/20260621100000_drop_roster_memberships.rb b/db/migrate/20260621100000_drop_roster_memberships.rb
index 3d086fa8..42d4b7d0 100644
--- a/db/migrate/20260621100000_drop_roster_memberships.rb
+++ b/db/migrate/20260621100000_drop_roster_memberships.rb
@@ -9,7 +9,7 @@ def change
       t.string :status,          null: false
       t.string :line,            default: 'main'
       t.uuid   :contract_id
-      t.date   :joined_at,       null: false
+      t.date   :joined_at, null: false
       t.date   :left_at
       t.uuid   :created_by_id
       t.datetime :created_at,   null: false
diff --git a/spec/factories/roster_memberships.rb b/spec/factories/roster_memberships.rb
deleted file mode 100644
index edb679dc..00000000
--- a/spec/factories/roster_memberships.rb
+++ /dev/null
@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-FactoryBot.define do
-  factory :roster_membership do
-    association :organization
-    association :player
-
-    role      { 'mid' }
-    status    { 'starter' }
-    line      { 'main' }
-    joined_at { Date.current - 90.days }
-
-    trait :active do
-      left_at    { nil }
-      deleted_at { nil }
-    end
-
-    trait :inactive do
-      left_at { Date.current - 30.days }
-    end
-
-    trait :with_contract do
-      association :contract
-    end
-  end
-end
diff --git a/spec/models/contract_bonus_spec.rb b/spec/models/contract_bonus_spec.rb
index 284f29d9..c4ffc232 100644
--- a/spec/models/contract_bonus_spec.rb
+++ b/spec/models/contract_bonus_spec.rb
@@ -46,20 +46,27 @@ def build_bonus(overrides = {})
       expect(bonus).to be_valid
     end
 
-    it 'is valid with a known metric key' do
-      bonus = build_bonus(metric_key: 'win_rate')
+    it 'is valid with a known metric key and required structured fields' do
+      bonus = build_bonus(metric_key: 'win_rate', comparator: 'gte', threshold: 60.0)
       expect(bonus).to be_valid
     end
 
+    it 'is invalid with metric_key but no comparator or threshold' do
+      bonus = build_bonus(metric_key: 'win_rate')
+      expect(bonus).not_to be_valid
+      expect(bonus.errors[:comparator]).to be_present
+      expect(bonus.errors[:threshold]).to be_present
+    end
+
     it 'is invalid with an unknown metric key' do
-      bonus = build_bonus(metric_key: 'made_up_metric')
+      bonus = build_bonus(metric_key: 'made_up_metric', comparator: 'gte', threshold: 50.0)
       expect(bonus).not_to be_valid
       expect(bonus.errors[:metric_key]).to be_present
     end
 
     it 'accepts all keys declared in Goals::MetricRegistry' do
       Goals::MetricRegistry::METRICS.each_key do |key|
-        bonus = build_bonus(metric_key: key)
+        bonus = build_bonus(metric_key: key, comparator: 'gte', threshold: 50.0)
         expect(bonus).to be_valid, "expected registry key #{key} to be valid on ContractBonus"
       end
     end
diff --git a/spec/models/roster_membership_spec.rb b/spec/models/roster_membership_spec.rb
deleted file mode 100644
index 8e5b19df..00000000
--- a/spec/models/roster_membership_spec.rb
+++ /dev/null
@@ -1,165 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-RSpec.describe RosterMembership, type: :model do
-  let(:org)    { create(:organization) }
-  let(:player) { create(:player, organization: org) }
-
-  subject(:membership) { build(:roster_membership, organization: org, player: player) }
-
-  describe 'validations' do
-    it 'is valid with valid attributes' do
-      expect(membership).to be_valid
-    end
-
-    it 'is invalid without a role' do
-      membership.role = nil
-      expect(membership).not_to be_valid
-    end
-
-    it 'is invalid with an unrecognized role' do
-      membership.role = 'carry'
-      expect(membership).not_to be_valid
-      expect(membership.errors[:role]).to be_present
-    end
-
-    it 'is valid with each known role' do
-      RosterMembership::ROLES.each do |r|
-        m = build(:roster_membership, organization: org, player: player, role: r)
-        expect(m).to be_valid, "Expected role '#{r}' to be valid"
-      end
-    end
-
-    it 'is invalid without a status' do
-      membership.status = nil
-      expect(membership).not_to be_valid
-    end
-
-    it 'is invalid with an unrecognized status' do
-      membership.status = 'benched'
-      expect(membership).not_to be_valid
-      expect(membership.errors[:status]).to be_present
-    end
-
-    it 'is valid with each known status' do
-      RosterMembership::STATUSES.each do |s|
-        m = build(:roster_membership, organization: org, player: player, status: s)
-        expect(m).to be_valid, "Expected status '#{s}' to be valid"
-      end
-    end
-
-    it 'is invalid without a joined_at date' do
-      membership.joined_at = nil
-      expect(membership).not_to be_valid
-      expect(membership.errors[:joined_at]).to be_present
-    end
-
-    it 'is invalid with an unrecognized line' do
-      membership.line = 'challenger_series'
-      expect(membership).not_to be_valid
-      expect(membership.errors[:line]).to be_present
-    end
-
-    it 'is valid with each known line' do
-      RosterMembership::LINES.each do |l|
-        m = build(:roster_membership, organization: org, player: player, line: l)
-        expect(m).to be_valid, "Expected line '#{l}' to be valid"
-      end
-    end
-  end
-
-  describe 'associations' do
-    it { is_expected.to belong_to(:organization) }
-    it { is_expected.to belong_to(:player) }
-    it { is_expected.to belong_to(:contract).optional }
-    it { is_expected.to belong_to(:created_by).optional }
-  end
-
-  describe 'scopes' do
-    describe '.active' do
-      let!(:active_membership) do
-        create(:roster_membership, :active, organization: org, player: player)
-      end
-      let!(:ended_membership) do
-        create(:roster_membership, :inactive, organization: org, player: player)
-      end
-      let!(:deleted_membership) do
-        create(:roster_membership, :active, organization: org, player: player,
-                                            deleted_at: Time.current)
-      end
-
-      it 'returns memberships with left_at nil and deleted_at nil' do
-        expect(RosterMembership.active).to include(active_membership)
-      end
-
-      it 'excludes memberships with left_at set' do
-        expect(RosterMembership.active).not_to include(ended_membership)
-      end
-
-      it 'excludes soft-deleted memberships' do
-        expect(RosterMembership.active).not_to include(deleted_membership)
-      end
-    end
-
-    describe '.historical' do
-      let!(:current_member) do
-        create(:roster_membership, :active, organization: org, player: player)
-      end
-      let!(:former_member) do
-        create(:roster_membership, :inactive, organization: org, player: player)
-      end
-
-      it 'returns memberships with a left_at date set' do
-        expect(RosterMembership.historical).to include(former_member)
-      end
-
-      it 'excludes currently active memberships' do
-        expect(RosterMembership.historical).not_to include(current_member)
-      end
-    end
-
-    describe '.not_deleted' do
-      let!(:live)    { create(:roster_membership, :active, organization: org, player: player) }
-      let!(:deleted) do
-        create(:roster_membership, :active, organization: org, player: player,
-                                            deleted_at: Time.current)
-      end
-
-      it 'excludes soft-deleted records' do
-        expect(RosterMembership.not_deleted).to include(live)
-        expect(RosterMembership.not_deleted).not_to include(deleted)
-      end
-    end
-  end
-
-  describe '#soft_delete!' do
-    let(:membership) { create(:roster_membership, :active) }
-
-    it 'sets deleted_at' do
-      expect { membership.soft_delete! }.to(change { membership.reload.deleted_at }.from(nil))
-    end
-
-    it 'sets left_at when not already set' do
-      expect { membership.soft_delete! }.to(change { membership.reload.left_at }.from(nil))
-    end
-
-    it 'does not overwrite an existing left_at' do
-      membership.update!(left_at: Date.current - 5.days)
-      membership.soft_delete!
-      expect(membership.reload.left_at).to eq(Date.current - 5.days)
-    end
-  end
-
-  describe '#deleted?' do
-    it 'returns false when deleted_at is nil' do
-      membership.deleted_at = nil
-      expect(membership.deleted?).to be false
-    end
-
-    it 'returns true when deleted_at is set' do
-      membership.deleted_at = Time.current
-      expect(membership.deleted?).to be true
-    end
-  end
-end
diff --git a/spec/modules/ai_intelligence/services/draft_analyzer_spec.rb b/spec/modules/ai_intelligence/services/draft_analyzer_spec.rb
index cd48516f..2bdaf62f 100644
--- a/spec/modules/ai_intelligence/services/draft_analyzer_spec.rb
+++ b/spec/modules/ai_intelligence/services/draft_analyzer_spec.rb
@@ -51,9 +51,11 @@
       let(:team_a) { %w[Jinx Thresh Azir Vi] }
 
       before do
-        create(:ai_champion_vector, champion_name: 'Garen',     vector_data: [0.6, 0.5, 0.2, 0.2, 0.5], games_count: 15)
-        create(:ai_champion_vector, champion_name: 'Orianna',   vector_data: [0.7, 0.6, 0.3, 0.25, 0.6], games_count: 20)
-        create(:ai_champion_vector, champion_name: 'Lissandra', vector_data: [0.65, 0.4, 0.25, 0.2, 0.5], games_count: 12)
+        # team_a = [Jinx(adc), Thresh(support), Azir(mid), Vi(jungle)] - top role is unfilled
+        # All three candidates are top-laners so they pass the role-coverage filter
+        create(:ai_champion_vector, champion_name: 'Garen',   vector_data: [0.6, 0.5, 0.2, 0.2, 0.5], games_count: 15)
+        create(:ai_champion_vector, champion_name: 'Darius',  vector_data: [0.7, 0.6, 0.3, 0.25, 0.6], games_count: 20)
+        create(:ai_champion_vector, champion_name: 'Camille', vector_data: [0.65, 0.4, 0.25, 0.2, 0.5], games_count: 12)
       end
 
       it 'returns top-3 suggested picks' do
diff --git a/spec/modules/competitive/services/scraper_importer_service_spec.rb b/spec/modules/competitive/services/scraper_importer_service_spec.rb
index ea05e507..a912835b 100644
--- a/spec/modules/competitive/services/scraper_importer_service_spec.rb
+++ b/spec/modules/competitive/services/scraper_importer_service_spec.rb
@@ -45,9 +45,13 @@ def match_doc(overrides = {})
         # Force lazy lets to evaluate before the subscribed block so their
         # DB activity (savepoints, INSERT org) is not counted.
         service
+        # Warm the schema cache so Rails 8.1 does not issue an extra SCHEMA
+        # query inside insert_all when CompetitiveMatch is first touched.
+        CompetitiveMatch.column_names
 
         query_count = 0
-        counter = ->(*, **) { query_count += 1 }
+        # Exclude SCHEMA events (Rails internal schema introspection) from the count.
+        counter = ->(*args) { query_count += 1 unless args.last.is_a?(Hash) && args.last[:name] == 'SCHEMA' }
 
         ActiveSupport::Notifications.subscribed(counter, 'sql.active_record') do
           service.import_batch(matches, our_team: 'paiN Gaming')
diff --git a/spec/policies/pro_match_policy_spec.rb b/spec/policies/pro_match_policy_spec.rb
index fcf9de52..c97a55e8 100644
--- a/spec/policies/pro_match_policy_spec.rb
+++ b/spec/policies/pro_match_policy_spec.rb
@@ -39,9 +39,7 @@
       expect(described_class.new(user, nil)).not_to permit_action(:refresh)
     end
 
-    # NOTE: ProMatchPolicy#import? calls user.coach? which does not exist on User model.
-    # This is a bug in the policy. The spec is skipped until the policy is fixed.
-    xit 'can import matches' do
+    it 'can import matches' do
       expect(described_class.new(user, nil)).to permit_action(:import)
     end
   end
@@ -55,7 +53,7 @@
       expect(described_class.new(user, nil)).not_to permit_action(:refresh)
     end
 
-    xit 'cannot import matches' do
+    it 'cannot import matches' do
       expect(described_class.new(user, nil)).not_to permit_action(:import)
     end
   end
@@ -69,7 +67,7 @@
       expect(described_class.new(user, nil)).not_to permit_action(:refresh)
     end
 
-    xit 'cannot import matches' do
+    it 'cannot import matches' do
       expect(described_class.new(user, nil)).not_to permit_action(:import)
     end
   end
diff --git a/spec/services/discord_dm_service_spec.rb b/spec/services/discord_dm_service_spec.rb
index 971400aa..d1f52fda 100644
--- a/spec/services/discord_dm_service_spec.rb
+++ b/spec/services/discord_dm_service_spec.rb
@@ -13,10 +13,10 @@
 
   # Helpers to create users with discord_user_id set
   let!(:target_admin) do
-    create(:user, :admin, organization: target_org, discord_user_id: 'test-discord-uid-1')
+    create(:user, :admin, organization: target_org, discord_user_id: '123456789012345678')
   end
   let!(:requesting_admin) do
-    create(:user, :admin, organization: requesting_org, discord_user_id: 'test-discord-uid-2')
+    create(:user, :admin, organization: requesting_org, discord_user_id: '987654321098765432')
   end
 
   before do