diff --git a/backend/integration/crowdsec_lapi_integration_test.go b/backend/integration/crowdsec_lapi_integration_test.go
index 615b66c51..721bad69f 100644
--- a/backend/integration/crowdsec_lapi_integration_test.go
+++ b/backend/integration/crowdsec_lapi_integration_test.go
@@ -532,8 +532,6 @@ func TestCrowdSecDiagnosticsConfig(t *testing.T) {
 	optionalFields := []string{
 		"config_valid",
 		"acquis_valid",
-		"config_path",
-		"acquis_path",
 	}
 
 	for _, field := range optionalFields {
diff --git a/backend/internal/api/handlers/crowdsec_curated_apply_handler_test.go b/backend/internal/api/handlers/crowdsec_curated_apply_handler_test.go
index 80d8059ee..46c26ff5e 100644
--- a/backend/internal/api/handlers/crowdsec_curated_apply_handler_test.go
+++ b/backend/internal/api/handlers/crowdsec_curated_apply_handler_test.go
@@ -123,7 +123,8 @@ func TestApplyCuratedPresetInstallsViaCSCLI(t *testing.T) {
 	require.Equal(t, "curated-"+slug, resp["cache_key"])
 	backup, _ := resp["backup"].(string)
 	require.NotEmpty(t, backup)
-	require.DirExists(t, backup)
+	require.Equal(t, filepath.Base(backup), backup, "response carries a name, not a path")
+	require.DirExists(t, filepath.Join(filepath.Dir(c.dataDir), backup))
 
 	preset, ok := crowdsec.FindPreset(slug)
 	require.True(t, ok)
@@ -133,7 +134,7 @@ func TestApplyCuratedPresetInstallsViaCSCLI(t *testing.T) {
 	require.Len(t, events, 1)
 	require.Equal(t, slug, events[0].Slug)
 	require.Equal(t, "applied", events[0].Status)
-	require.Equal(t, backup, events[0].BackupPath)
+	require.Equal(t, backup, filepath.Base(events[0].BackupPath))
 }
 
 func TestApplyCuratedPresetCSCLIUnavailableReturns503(t *testing.T) {
@@ -180,7 +181,7 @@ func TestApplyCuratedPresetInstallFailureReturns500WithBackup(t *testing.T) {
 	events := c.events()
 	require.Len(t, events, 1)
 	require.Equal(t, "failed", events[0].Status)
-	require.Equal(t, backup, events[0].BackupPath)
+	require.Equal(t, backup, filepath.Base(events[0].BackupPath))
 	require.Contains(t, events[0].Error, "install exploded")
 }
 
diff --git a/backend/internal/api/handlers/crowdsec_data_mutation_test.go b/backend/internal/api/handlers/crowdsec_data_mutation_test.go
index ebc3d1422..997cdf697 100644
--- a/backend/internal/api/handlers/crowdsec_data_mutation_test.go
+++ b/backend/internal/api/handlers/crowdsec_data_mutation_test.go
@@ -9,6 +9,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -104,8 +105,10 @@ func TestImportConfigReplacesConfigButPreservesEngineStateAndDataDir(t *testing.
 
 	var resp map[string]any
 	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
-	backup, _ := resp["backup"].(string)
-	require.Equal(t, dir+".backup.", backup[:len(dir)+len(".backup.")])
+	backupName, _ := resp["backup"].(string)
+	require.True(t, strings.HasPrefix(backupName, filepath.Base(dir)+".backup."), backupName)
+	require.Equal(t, filepath.Base(backupName), backupName, "response carries a name, not a path")
+	backup := filepath.Join(filepath.Dir(dir), backupName)
 
 	after, err := os.Stat(dir)
 	require.NoError(t, err)
diff --git a/backend/internal/api/handlers/crowdsec_files.go b/backend/internal/api/handlers/crowdsec_files.go
index e2bdf3f68..3b0a08a27 100644
--- a/backend/internal/api/handlers/crowdsec_files.go
+++ b/backend/internal/api/handlers/crowdsec_files.go
@@ -39,8 +39,10 @@ var (
 		".yaml": {}, ".yml": {}, ".json": {}, ".txt": {}, ".conf": {},
 	}
 
-	// protectedWriteNames are credential files the editor never overwrites.
-	protectedWriteNames = map[string]struct{}{
+	// hiddenSecretNames are lowercase base names of secret files that are neither listed nor readable nor
+	// writable through the editor.
+	hiddenSecretNames = map[string]struct{}{
+		"bouncer_key":                 {},
 		"local_api_credentials.yaml":  {},
 		"online_api_credentials.yaml": {},
 	}
@@ -75,14 +77,14 @@ func cleanRelPath(raw string) (string, *fileError) {
 }
 
 // isReadable reports whether rel may be listed and read: engine-owned state (databases, the data and
-// hub_cache trees) and secrets are hidden, everything else stays visible.
+// hub_cache trees) and secrets (see hiddenSecretNames) are hidden, everything else stays visible.
 func isReadable(rel string) bool {
 	slash := filepath.ToSlash(rel)
 	if slash == "" || slash == "." || crowdsec.IsEngineOwnedPath(slash) {
 		return false
 	}
 	base := strings.ToLower(path.Base(slash))
-	if base == "bouncer_key" {
+	if _, hidden := hiddenSecretNames[base]; hidden {
 		return false
 	}
 	if matched, _ := path.Match("*.db*", base); matched {
@@ -102,9 +104,6 @@ func isWritable(rel string) bool {
 	if _, ok := writableExtensions[strings.ToLower(path.Ext(base))]; !ok {
 		return false
 	}
-	if _, protected := protectedWriteNames[base]; protected {
-		return false
-	}
 	if strings.HasPrefix(base, writeTempPrefix) {
 		return false
 	}
@@ -412,7 +411,7 @@ func (h *CrowdsecHandler) WriteFile(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to write file"})
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"status": "written", "backup": backupDir})
+	c.JSON(http.StatusOK, gin.H{"status": "written", "backup": crowdsec.BackupID(backupDir)})
 }
 
 // fileErrorLog returns a log entry carrying err with control characters
diff --git a/backend/internal/api/handlers/crowdsec_files_test.go b/backend/internal/api/handlers/crowdsec_files_test.go
index a1d0504bb..db25481d0 100644
--- a/backend/internal/api/handlers/crowdsec_files_test.go
+++ b/backend/internal/api/handlers/crowdsec_files_test.go
@@ -92,25 +92,31 @@ func errorOf(t *testing.T, w *httptest.ResponseRecorder) string {
 func TestCrowdsecFiles_Predicates(t *testing.T) {
 	t.Parallel()
 	readable := map[string]bool{
-		"config.yaml":                 true,
-		"config/config.yaml":          true,
-		"config/scenarios/x.yaml":     true,
-		"config/acquis.d/a.conf":      true,
-		"notes.md":                    true,
-		"config/data/nested.yaml":     true, // only the top-level data/ is protected
-		"bouncer_key":                 false,
-		"config/bouncer_key":          false,
-		"crowdsec.db":                 false,
-		"config/crowdsec.db-wal":      false,
-		"data/crowdsec.db":            false,
-		"data/GeoLite2-City.mmdb":     false,
-		"hub_cache/a.tgz":             false,
-		"config/other.db":             false,
-		"config/other.db-journal":     false,
-		"config/CASE.DB":              false,
-		"data":                        false,
-		"hub_cache":                   false,
-		"config/hub_cache/thing.yaml": true,
+		"config.yaml":                           true,
+		"config/config.yaml":                    true,
+		"config/scenarios/x.yaml":               true,
+		"config/acquis.d/a.conf":                true,
+		"notes.md":                              true,
+		"config/data/nested.yaml":               true, // only the top-level data/ is protected
+		"bouncer_key":                           false,
+		"config/bouncer_key":                    false,
+		"crowdsec.db":                           false,
+		"config/crowdsec.db-wal":                false,
+		"data/crowdsec.db":                      false,
+		"data/GeoLite2-City.mmdb":               false,
+		"hub_cache/a.tgz":                       false,
+		"config/other.db":                       false,
+		"config/other.db-journal":               false,
+		"config/CASE.DB":                        false,
+		"data":                                  false,
+		"hub_cache":                             false,
+		"local_api_credentials.yaml":            false,
+		"config/local_api_credentials.yaml":     false,
+		"config/online_api_credentials.yaml":    false,
+		"config/Local_API_Credentials.YAML":     false,
+		"config/ONLINE_API_CREDENTIALS.yaml":    false,
+		"config/local_api_credentials.yaml.bak": true,
+		"config/hub_cache/thing.yaml":           true,
 	}
 	for rel, want := range readable {
 		assert.Equal(t, want, isReadable(rel), "isReadable(%q)", rel)
@@ -493,10 +499,12 @@ func TestCrowdsecFiles_Write_BackupHoldsOnlyPreviousVersionAndIsCappedIndependen
 	var resp map[string]string
 	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
 	require.NotEmpty(t, resp["backup"])
-	prev, err := os.ReadFile(filepath.Join(resp["backup"], "config", "config.yaml")) // #nosec G304 -- test path
+	require.Equal(t, filepath.Base(resp["backup"]), resp["backup"], "response carries a name, not a path")
+	backupDir := filepath.Join(f.root, resp["backup"])
+	prev, err := os.ReadFile(filepath.Join(backupDir, "config", "config.yaml")) // #nosec G304 -- test path
 	require.NoError(t, err)
 	assert.Equal(t, "v: 0\n", string(prev))
-	_, err = os.Stat(filepath.Join(resp["backup"], "config", "other.yaml"))
+	_, err = os.Stat(filepath.Join(backupDir, "config", "other.yaml"))
 	assert.True(t, os.IsNotExist(err), "backup must hold only the replaced file")
 
 	for i := 2; i <= 14; i++ {
@@ -689,3 +697,51 @@ func TestCrowdsecFiles_Write_FilesystemFailuresAre500(t *testing.T) {
 		assert.NoFileExists(t, filepath.Join(cfg, "new.yaml"))
 	})
 }
+
+var credentialsFileNames = []string{
+	"local_api_credentials.yaml", "online_api_credentials.yaml",
+	"Local_API_Credentials.yaml", "ONLINE_API_CREDENTIALS.YAML",
+}
+
+func TestCrowdsecFiles_CredentialsHiddenFromListReadAndWrite(t *testing.T) {
+	t.Parallel()
+	f := newFilesFixture(t)
+	f.put("config/config.yaml", "a: 1\n")
+	for _, name := range credentialsFileNames {
+		f.put("config/"+name, "password: hunter2\n")
+	}
+
+	assert.Equal(t, []string{filepath.Join("config", "config.yaml")}, f.list())
+
+	for _, name := range credentialsFileNames {
+		rel := "config/" + name
+		w := f.read(rel)
+		assert.Equal(t, http.StatusBadRequest, w.Code, rel)
+		assert.Equal(t, "invalid path", errorOf(t, w), rel)
+		assert.NotContains(t, w.Body.String(), "hunter2", rel)
+
+		w = f.write(rel, "a: 1\n")
+		assert.Equal(t, http.StatusBadRequest, w.Code, rel)
+		assert.Equal(t, errFileCannotBeEdited, errorOf(t, w), rel)
+	}
+
+	for _, name := range credentialsFileNames[:2] {
+		b, err := os.ReadFile(filepath.Join(f.dir, "config", name)) // #nosec G304 -- test path
+		require.NoError(t, err)
+		assert.Equal(t, "password: hunter2\n", string(b), "rejected write must not modify %s", name)
+	}
+}
+
+func TestCrowdsecFiles_Read_SymlinkToCredentialsRefused(t *testing.T) {
+	t.Parallel()
+	f := newFilesFixture(t)
+	f.put("config/local_api_credentials.yaml", "password: hunter2\n")
+	require.NoError(t, os.Symlink(
+		filepath.Join(f.dir, "config", "local_api_credentials.yaml"),
+		filepath.Join(f.dir, "config", "innocent.yaml")))
+
+	w := f.read("config/innocent.yaml")
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	assert.Equal(t, "invalid path", errorOf(t, w))
+	assert.NotContains(t, w.Body.String(), "hunter2")
+}
diff --git a/backend/internal/api/handlers/crowdsec_handler.go b/backend/internal/api/handlers/crowdsec_handler.go
index 8adb5aa57..af97eea72 100644
--- a/backend/internal/api/handlers/crowdsec_handler.go
+++ b/backend/internal/api/handlers/crowdsec_handler.go
@@ -519,7 +519,8 @@ func (h *CrowdsecHandler) Start(c *gin.Context) {
 			revertSetting := models.Setting{Key: "security.crowdsec.enabled", Value: "false", Category: "security", Type: "bool"}
 			h.DB.Where(models.Setting{Key: "security.crowdsec.enabled"}).Assign(revertSetting).FirstOrCreate(&revertSetting)
 		}
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		logger.Log().WithField("error", sanitizeForLog(err.Error())).Warn("failed to start crowdsec")
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to start CrowdSec"})
 		return
 	}
 
@@ -593,7 +594,8 @@ func (h *CrowdsecHandler) Start(c *gin.Context) {
 func (h *CrowdsecHandler) Stop(c *gin.Context) {
 	ctx := c.Request.Context()
 	if err := h.Executor.Stop(ctx, h.DataDir); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		logger.Log().WithField("error", sanitizeForLog(err.Error())).Warn("failed to stop crowdsec")
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to stop CrowdSec"})
 		return
 	}
 
@@ -621,7 +623,8 @@ func (h *CrowdsecHandler) Status(c *gin.Context) {
 	ctx := c.Request.Context()
 	running, pid, err := h.Executor.Status(ctx, h.DataDir)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		logger.Log().WithField("error", sanitizeForLog(err.Error())).Warn("failed to read crowdsec status")
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read CrowdSec status"})
 		return
 	}
 
@@ -679,7 +682,7 @@ func (h *CrowdsecHandler) ImportConfig(c *gin.Context) {
 	}
 
 	if err = validator.Validate(dst); err != nil {
-		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": fmt.Sprintf("validation failed: %v", err)})
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": fmt.Sprintf("validation failed: %v", crowdsec.RedactPaths(err.Error()))})
 		return
 	}
 
@@ -711,8 +714,9 @@ func (h *CrowdsecHandler) ImportConfig(c *gin.Context) {
 	// Extract archive
 	extractErr := h.extractArchive(dst, h.DataDir)
 	if extractErr != nil {
+		logger.Log().WithField("error", sanitizeForLog(extractErr.Error())).Warn("crowdsec import extraction failed")
 		rollback()
-		c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("extraction failed: %v", extractErr)})
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "extraction failed"})
 		return
 	}
 
@@ -720,11 +724,11 @@ func (h *CrowdsecHandler) ImportConfig(c *gin.Context) {
 	configPath := filepath.Join(h.DataDir, "config.yaml")
 	if err := validateYAMLFile(configPath); err != nil {
 		rollback()
-		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": fmt.Sprintf("config validation failed: %v", err)})
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": fmt.Sprintf("config validation failed: %v", crowdsec.RedactPaths(err.Error()))})
 		return
 	}
 
-	c.JSON(http.StatusOK, gin.H{"status": "imported", "backup": backupDir})
+	c.JSON(http.StatusOK, gin.H{"status": "imported", "backup": crowdsec.BackupID(backupDir)})
 }
 
 // pruneSnapshots bounds the full-tree snapshots kept next to DataDir; failures are logged only.
@@ -875,8 +879,9 @@ func (h *CrowdsecHandler) ExportConfig(c *gin.Context) {
 		return nil
 	})
 	if err != nil {
+		logger.Log().WithField("error", sanitizeForLog(err.Error())).Warn("crowdsec export failed")
 		// If any error occurred while creating the archive, return 500
-		c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": "failed to export crowdsec config"})
 		return
 	}
 }
@@ -922,7 +927,7 @@ func (h *CrowdsecHandler) ConsoleEnroll(c *gin.Context) {
 		if h.Security != nil {
 			_ = h.Security.LogAudit(&models.SecurityAudit{Actor: auditActor(c), Action: "crowdsec_console_enroll_failed", Details: fmt.Sprintf("status=%s tenant=%s agent=%s correlation_id=%s", status.Status, payload.Tenant, payload.AgentName, status.CorrelationID)})
 		}
-		resp := gin.H{"error": err.Error(), "status": status.Status}
+		resp := gin.H{"error": crowdsec.RedactPaths(err.Error()), "status": status.Status}
 		if status.CorrelationID != "" {
 			resp["correlation_id"] = status.CorrelationID
 		}
@@ -973,7 +978,7 @@ func (h *CrowdsecHandler) DeleteConsoleEnrollment(c *gin.Context) {
 	ctx := c.Request.Context()
 	if err := h.Console.ClearEnrollment(ctx); err != nil {
 		logger.Log().WithError(err).Warn("failed to clear console enrollment state")
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to clear enrollment state"})
 		return
 	}
 
@@ -1972,7 +1977,7 @@ func (h *CrowdsecHandler) GetAcquisitionConfig(c *gin.Context) {
 	content, err := readAcquisitionConfig(acquisPath)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			c.JSON(http.StatusNotFound, gin.H{"error": "acquisition config not found", "path": acquisPath})
+			c.JSON(http.StatusNotFound, gin.H{"error": "acquisition config not found"})
 			return
 		}
 		logger.Log().WithError(err).WithField("path", acquisPath).Warn("Failed to read acquisition config")
@@ -1982,7 +1987,6 @@ func (h *CrowdsecHandler) GetAcquisitionConfig(c *gin.Context) {
 
 	c.JSON(http.StatusOK, gin.H{
 		"content": string(content),
-		"path":    acquisPath,
 	})
 }
 
@@ -2027,7 +2031,7 @@ func (h *CrowdsecHandler) UpdateAcquisitionConfig(c *gin.Context) {
 
 	c.JSON(http.StatusOK, gin.H{
 		"status":      "updated",
-		"backup":      backupPath,
+		"backup":      crowdsec.BackupID(backupPath),
 		"reload_hint": true,
 	})
 }
@@ -2162,7 +2166,6 @@ func (h *CrowdsecHandler) DiagnosticsConfig(c *gin.Context) {
 
 	if _, err := os.Stat(cleanConfigPath); err == nil {
 		validation["config_exists"] = true
-		validation["config_path"] = cleanConfigPath
 
 		// Read config and check LAPI port
 		// #nosec G304 -- Path validated against DataDir above
@@ -2207,7 +2210,6 @@ func (h *CrowdsecHandler) DiagnosticsConfig(c *gin.Context) {
 
 	if _, err := os.Stat(cleanAcquisPath); err == nil {
 		validation["acquis_exists"] = true
-		validation["acquis_path"] = cleanAcquisPath
 
 		// Check if it has datasources
 		// #nosec G304 -- Path validated against DataDir above
@@ -2245,7 +2247,8 @@ func (h *CrowdsecHandler) ConsoleHeartbeat(c *gin.Context) {
 	ctx := c.Request.Context()
 	status, err := h.Console.Status(ctx)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		logger.Log().WithField("error", sanitizeForLog(err.Error())).Warn("failed to read console heartbeat status")
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read enrollment status"})
 		return
 	}
 
diff --git a/backend/internal/api/handlers/crowdsec_handler_coverage_test.go b/backend/internal/api/handlers/crowdsec_handler_coverage_test.go
index 4bace2daf..209f497d1 100644
--- a/backend/internal/api/handlers/crowdsec_handler_coverage_test.go
+++ b/backend/internal/api/handlers/crowdsec_handler_coverage_test.go
@@ -43,7 +43,7 @@ func TestCrowdsec_Start_Error(t *testing.T) {
 	r.ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Contains(t, w.Body.String(), "failed to start crowdsec")
+	assert.Contains(t, w.Body.String(), "failed to start CrowdSec")
 }
 
 func TestCrowdsec_Stop_Error(t *testing.T) {
@@ -61,7 +61,7 @@ func TestCrowdsec_Stop_Error(t *testing.T) {
 	r.ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Contains(t, w.Body.String(), "failed to stop crowdsec")
+	assert.Contains(t, w.Body.String(), "failed to stop CrowdSec")
 }
 
 func TestCrowdsec_Status_Error(t *testing.T) {
@@ -79,7 +79,7 @@ func TestCrowdsec_Status_Error(t *testing.T) {
 	r.ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
-	assert.Contains(t, w.Body.String(), "failed to get status")
+	assert.Contains(t, w.Body.String(), "failed to read CrowdSec status")
 }
 
 // ReadFile tests
diff --git a/backend/internal/api/handlers/crowdsec_handler_test.go b/backend/internal/api/handlers/crowdsec_handler_test.go
index 3fb468f79..18b555aaf 100644
--- a/backend/internal/api/handlers/crowdsec_handler_test.go
+++ b/backend/internal/api/handlers/crowdsec_handler_test.go
@@ -1082,7 +1082,7 @@ labels:
 	require.Equal(t, http.StatusOK, w.Code)
 	var resp map[string]any
 	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
-	require.Equal(t, acquisPath, resp["path"])
+	require.NotContains(t, resp, "path")
 	require.Equal(t, acquisContent, resp["content"])
 }
 
@@ -1323,7 +1323,7 @@ func TestCrowdsecHandler_Status_Error(t *testing.T) {
 	r.ServeHTTP(w, req)
 
 	require.Equal(t, http.StatusInternalServerError, w.Code)
-	require.Contains(t, w.Body.String(), "status check failed")
+	require.Contains(t, w.Body.String(), "failed to read CrowdSec status")
 }
 
 func TestCrowdsecHandler_Start_ExecutorError(t *testing.T) {
@@ -1342,7 +1342,7 @@ func TestCrowdsecHandler_Start_ExecutorError(t *testing.T) {
 	r.ServeHTTP(w, req)
 
 	require.Equal(t, http.StatusInternalServerError, w.Code)
-	require.Contains(t, w.Body.String(), "failed to start process")
+	require.Contains(t, w.Body.String(), "failed to start CrowdSec")
 }
 
 func TestCrowdsecHandler_ExportConfig_DirNotFound(t *testing.T) {
@@ -3249,9 +3249,10 @@ func TestCrowdsecHandler_WriteFile_BackupCreation(t *testing.T) {
 	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
 	require.Contains(t, resp, "backup")
 
-	backupPath := resp["backup"].(string)
-	require.NotEmpty(t, backupPath)
-	require.True(t, strings.HasPrefix(backupPath, tmpDir+".filebackup."), backupPath)
+	backupName := resp["backup"].(string)
+	require.True(t, strings.HasPrefix(backupName, filepath.Base(tmpDir)+".filebackup."), backupName)
+	require.Equal(t, filepath.Base(backupName), backupName, "response carries a name, not a path")
+	backupPath := filepath.Join(filepath.Dir(tmpDir), backupName)
 
 	// Only the replaced file is backed up, with its previous content; DataDir stays in place.
 	// #nosec G304 -- test reads a path it just created
diff --git a/backend/internal/api/handlers/crowdsec_preset_event_test.go b/backend/internal/api/handlers/crowdsec_preset_event_test.go
index b2f71891b..9c05cb946 100644
--- a/backend/internal/api/handlers/crowdsec_preset_event_test.go
+++ b/backend/internal/api/handlers/crowdsec_preset_event_test.go
@@ -62,10 +62,10 @@ func TestApplyResponseHelpers(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	respondApplySuccess(c, crowdsec.ApplyResult{Status: "applied", BackupPath: "/b", ReloadHint: true, UsedCSCLI: true, CacheKey: "k", AppliedPreset: "s"})
+	respondApplySuccess(c, crowdsec.ApplyResult{Status: "applied", BackupPath: "/data/crowdsec.backup.1", ReloadHint: true, UsedCSCLI: true, CacheKey: "k", AppliedPreset: "s"})
 	require.Equal(t, http.StatusOK, w.Code)
-	require.JSONEq(t, `{"status":"applied","backup":"/b","reload_hint":true,"used_cscli":true,"cache_key":"k","slug":"s"}`, w.Body.String())
+	require.JSONEq(t, `{"status":"applied","backup":"crowdsec.backup.1","reload_hint":true,"used_cscli":true,"cache_key":"k","slug":"s"}`, w.Body.String())
 
 	require.Equal(t, gin.H{"error": "m"}, applyFailureBody("m", crowdsec.ApplyResult{}))
-	require.Equal(t, gin.H{"error": "m", "backup": "/b", "cache_key": "k"}, applyFailureBody("m", crowdsec.ApplyResult{BackupPath: "/b", CacheKey: "k"}))
+	require.Equal(t, gin.H{"error": "m", "backup": "crowdsec.backup.1", "cache_key": "k"}, applyFailureBody("m", crowdsec.ApplyResult{BackupPath: "/data/crowdsec.backup.1", CacheKey: "k"}))
 }
diff --git a/backend/internal/api/handlers/crowdsec_preset_handler.go b/backend/internal/api/handlers/crowdsec_preset_handler.go
index 66f2db62f..e22609ebf 100644
--- a/backend/internal/api/handlers/crowdsec_preset_handler.go
+++ b/backend/internal/api/handlers/crowdsec_preset_handler.go
@@ -168,7 +168,7 @@ func (h *CrowdsecHandler) PullPreset(c *gin.Context) {
 		// control characters (0x00-0x1F, 0x7F) including CRLF
 		// codeql[go/log-injection]
 		logger.Log().WithField("error", util.SanitizeForLog(err.Error())).WithField("slug", util.SanitizeForLog(slug)).WithField("hub_base_url", util.SanitizeForLog(h.Hub.HubBaseURL)).Warn("crowdsec preset pull failed")
-		c.JSON(status, gin.H{"error": err.Error(), "hub_endpoints": h.hubEndpoints()})
+		c.JSON(status, gin.H{"error": crowdsec.RedactPaths(err.Error()), "hub_endpoints": h.hubEndpoints()})
 		return
 	}
 
@@ -273,7 +273,7 @@ func (h *CrowdsecHandler) ApplyPreset(c *gin.Context) {
 		logger.Log().WithField("error", util.SanitizeForLog(err.Error())).WithField("slug", util.SanitizeForLog(slug)).WithField("hub_base_url", util.SanitizeForLog(h.Hub.HubBaseURL)).WithField("backup_path", util.SanitizeForLog(res.BackupPath)).WithField("cache_key", util.SanitizeForLog(res.CacheKey)).Warn("crowdsec preset apply failed")
 		h.recordPresetEvent(slug, res, err)
 		// Build detailed error response
-		errorMsg := err.Error()
+		errorMsg := crowdsec.RedactPaths(err.Error())
 		// Add actionable guidance based on error type
 		if errors.Is(err, crowdsec.ErrCacheMiss) || strings.Contains(errorMsg, "cache miss") {
 			errorMsg = "Preset cache missing or expired. Pull the preset again, then retry apply."
@@ -299,7 +299,7 @@ func (h *CrowdsecHandler) applyCuratedPreset(c *gin.Context, preset crowdsec.Pre
 		h.recordPresetEvent(preset.Slug, res, err)
 
 		status := mapCrowdsecStatus(err, http.StatusInternalServerError)
-		msg := err.Error()
+		msg := crowdsec.RedactPaths(err.Error())
 		if errors.Is(err, crowdsec.ErrCSCLIUnavailable) {
 			status = http.StatusServiceUnavailable
 			msg = "CrowdSec CLI is not available; curated presets require cscli"
@@ -350,7 +350,7 @@ func (h *CrowdsecHandler) recordPresetEvent(slug string, res crowdsec.ApplyResul
 func applyFailureBody(msg string, res crowdsec.ApplyResult) gin.H {
 	body := gin.H{"error": msg}
 	if res.BackupPath != "" {
-		body["backup"] = res.BackupPath
+		body["backup"] = crowdsec.BackupID(res.BackupPath)
 	}
 	if res.CacheKey != "" {
 		body["cache_key"] = res.CacheKey
@@ -362,7 +362,7 @@ func applyFailureBody(msg string, res crowdsec.ApplyResult) gin.H {
 func respondApplySuccess(c *gin.Context, res crowdsec.ApplyResult) {
 	c.JSON(http.StatusOK, gin.H{
 		"status":      res.Status,
-		"backup":      res.BackupPath,
+		"backup":      crowdsec.BackupID(res.BackupPath),
 		"reload_hint": res.ReloadHint,
 		"used_cscli":  res.UsedCSCLI,
 		"cache_key":   res.CacheKey,
@@ -392,12 +392,14 @@ func (h *CrowdsecHandler) GetCachedPreset(c *gin.Context) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "cache miss"})
 			return
 		}
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		logger.Log().WithField("error", util.SanitizeForLog(err.Error())).WithField("slug", util.SanitizeForLog(slug)).Warn("failed to load crowdsec preset preview")
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load preset preview"})
 		return
 	}
 	meta, metaErr := h.Hub.Cache.Load(ctx, slug)
 	if metaErr != nil && !errors.Is(metaErr, crowdsec.ErrCacheMiss) && !errors.Is(metaErr, crowdsec.ErrCacheExpired) {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": metaErr.Error()})
+		logger.Log().WithField("error", util.SanitizeForLog(metaErr.Error())).WithField("slug", util.SanitizeForLog(slug)).Warn("failed to load crowdsec preset cache metadata")
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load preset cache metadata"})
 		return
 	}
 	cacheTTL := h.Hub.Cache.TTL()
diff --git a/backend/internal/api/handlers/crowdsec_preset_handler_test.go b/backend/internal/api/handlers/crowdsec_preset_handler_test.go
index 690cc8906..08a6da3fc 100644
--- a/backend/internal/api/handlers/crowdsec_preset_handler_test.go
+++ b/backend/internal/api/handlers/crowdsec_preset_handler_test.go
@@ -52,9 +52,9 @@ func TestListPresetsIncludesCacheAndIndex(t *testing.T) {
 	require.NoError(t, err)
 
 	hub := crowdsec.NewHubService(nil, cache, t.TempDir())
-	hub.HubBaseURL = "http://example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: presetRoundTripper(func(req *http.Request) (*http.Response, error) {
-		if req.URL.String() == "http://example.com/api/index.json" {
+		if req.URL.String() == "https://hub.crowdsec.net/api/index.json" {
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(`{"items":[{"name":"crowdsecurity/demo","title":"Demo","description":"desc","type":"collection"}]}`)), Header: make(http.Header)}, nil
 		}
 		return &http.Response{StatusCode: http.StatusNotFound, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -97,14 +97,14 @@ func TestPullPresetHandlerSuccess(t *testing.T) {
 	archive := makePresetTar(t, map[string]string{"config.yaml": "key: value"})
 
 	hub := crowdsec.NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: presetRoundTripper(func(req *http.Request) (*http.Response, error) {
 		switch req.URL.String() {
-		case "http://example.com/api/index.json":
-			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(`{"items":[{"name":"crowdsecurity/demo","title":"Demo","description":"desc","etag":"e1","download_url":"http://example.com/demo.tgz","preview_url":"http://example.com/demo.yaml"}]}`)), Header: make(http.Header)}, nil
-		case "http://example.com/demo.yaml":
+		case "https://hub.crowdsec.net/api/index.json":
+			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(`{"items":[{"name":"crowdsecurity/demo","title":"Demo","description":"desc","etag":"e1","download_url":"https://hub.crowdsec.net/demo.tgz","preview_url":"https://hub.crowdsec.net/demo.yaml"}]}`)), Header: make(http.Header)}, nil
+		case "https://hub.crowdsec.net/demo.yaml":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("preview")), Header: make(http.Header)}, nil
-		case "http://example.com/demo.tgz":
+		case "https://hub.crowdsec.net/demo.tgz":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 		default:
 			return &http.Response{StatusCode: http.StatusNotFound, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -187,7 +187,7 @@ func TestPullPresetHandlerHubError(t *testing.T) {
 	require.NoError(t, err)
 
 	hub := crowdsec.NewHubService(nil, cache, t.TempDir())
-	hub.HubBaseURL = "http://example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: presetRoundTripper(func(req *http.Request) (*http.Response, error) {
 		return &http.Response{StatusCode: http.StatusBadGateway, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
 	})}
@@ -213,7 +213,7 @@ func TestPullPresetHandlerTimeout(t *testing.T) {
 	require.NoError(t, err)
 
 	hub := crowdsec.NewHubService(nil, cache, t.TempDir())
-	hub.HubBaseURL = "http://example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: presetRoundTripper(func(req *http.Request) (*http.Response, error) {
 		return nil, context.DeadlineExceeded
 	})}
@@ -319,9 +319,9 @@ func TestApplyPresetHandlerBackupFailure(t *testing.T) {
 func TestListPresetsMergesCuratedAndHub(t *testing.T) {
 
 	hub := crowdsec.NewHubService(nil, nil, t.TempDir())
-	hub.HubBaseURL = "http://hub.example"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: presetRoundTripper(func(req *http.Request) (*http.Response, error) {
-		if req.URL.String() == "http://hub.example/api/index.json" {
+		if req.URL.String() == "https://hub.crowdsec.net/api/index.json" {
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(`{"items":[{"name":"crowdsecurity/custom","title":"Custom","description":"d","type":"collection"}]}`)), Header: make(http.Header)}, nil
 		}
 		return nil, errors.New("unexpected request")
@@ -435,7 +435,7 @@ func TestGetCachedPresetPreviewError(t *testing.T) {
 	r.ServeHTTP(w, req)
 
 	require.Equal(t, http.StatusInternalServerError, w.Code)
-	require.Contains(t, w.Body.String(), "no such file")
+	require.Contains(t, w.Body.String(), "failed to load preset preview")
 }
 
 func TestPullCuratedPresetSkipsHub(t *testing.T) {
diff --git a/backend/internal/api/handlers/crowdsec_pull_apply_integration_test.go b/backend/internal/api/handlers/crowdsec_pull_apply_integration_test.go
index f714e42d2..6a277e062 100644
--- a/backend/internal/api/handlers/crowdsec_pull_apply_integration_test.go
+++ b/backend/internal/api/handlers/crowdsec_pull_apply_integration_test.go
@@ -37,16 +37,16 @@ func TestPullThenApplyIntegration(t *testing.T) {
 	})
 
 	hub := crowdsec.NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.hub"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{
 		Transport: testRoundTripper(func(req *http.Request) (*http.Response, error) {
 			switch req.URL.String() {
-			case "http://test.hub/api/index.json":
-				body := `{"items":[{"name":"test/preset","title":"Test","description":"Test preset","etag":"abc123","download_url":"http://test.hub/test.tgz","preview_url":"http://test.hub/test.yaml"}]}`
+			case "https://hub.crowdsec.net/api/index.json":
+				body := `{"items":[{"name":"test/preset","title":"Test","description":"Test preset","etag":"abc123","download_url":"https://hub.crowdsec.net/test.tgz","preview_url":"https://hub.crowdsec.net/test.yaml"}]}`
 				return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
-			case "http://test.hub/test.yaml":
+			case "https://hub.crowdsec.net/test.yaml":
 				return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader("preview content")), Header: make(http.Header)}, nil
-			case "http://test.hub/test.tgz":
+			case "https://hub.crowdsec.net/test.tgz":
 				return &http.Response{StatusCode: 200, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 			default:
 				return &http.Response{StatusCode: 404, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -119,7 +119,7 @@ func TestApplyWithoutPullReturnsProperError(t *testing.T) {
 
 	// Empty cache, no cscli
 	hub := crowdsec.NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.hub"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: testRoundTripper(func(req *http.Request) (*http.Response, error) {
 		return &http.Response{StatusCode: http.StatusInternalServerError, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
 	})}
@@ -165,7 +165,7 @@ func TestApplyRollbackWhenCacheMissingAndRepullFails(t *testing.T) {
 	require.NoError(t, err)
 
 	hub := crowdsec.NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.hub"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: testRoundTripper(func(req *http.Request) (*http.Response, error) {
 		// Force repull failure
 		return &http.Response{StatusCode: 500, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
diff --git a/backend/internal/api/handlers/crowdsec_response_paths_test.go b/backend/internal/api/handlers/crowdsec_response_paths_test.go
new file mode 100644
index 000000000..891c415e0
--- /dev/null
+++ b/backend/internal/api/handlers/crowdsec_response_paths_test.go
@@ -0,0 +1,259 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/Wikid82/charon/backend/internal/models"
+)
+
+// serverPathPattern matches absolute server path prefixes that must never reach a client.
+var serverPathPattern = regexp.MustCompile(`(^|[\s"'(=:])/(app|data|etc|tmp|var|home)(/|\b)`)
+
+// requireNoServerPaths fails when body leaks an absolute server path or any of the extra
+// test-specific directories (typically t.TempDir()).
+func requireNoServerPaths(t *testing.T, body string, extra ...string) {
+	t.Helper()
+	require.Falsef(t, serverPathPattern.MatchString(body), "response leaks a server path: %s", body)
+	for _, e := range extra {
+		require.NotContainsf(t, body, e, "response leaks %s: %s", e, body)
+	}
+}
+
+func TestResponses_FileWriteCarriesBackupNameOnly(t *testing.T) {
+	f := newFilesFixture(t)
+	f.put("config/config.yaml", "v: 0\n")
+
+	w := f.write("config/config.yaml", "v: 1\n")
+	require.Equal(t, http.StatusOK, w.Code)
+	requireNoServerPaths(t, w.Body.String(), f.root)
+
+	var resp map[string]string
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+	require.Regexp(t, `^crowdsec\.filebackup\.\d{8}-\d{6}\.\d{6}$`, resp["backup"])
+}
+
+func TestResponses_ImportSuccessAndFailuresCarryNoPaths(t *testing.T) {
+	t.Parallel()
+	dir := filepath.Join(t.TempDir(), "crowdsec")
+	require.NoError(t, os.MkdirAll(dir, 0o750))
+	seedEngineState(t, dir)
+	root := filepath.Dir(dir)
+	_, r := newImportRouter(t, dir)
+
+	cases := []struct {
+		name  string
+		files map[string]string
+		code  int
+	}{
+		{"success", map[string]string{"config.yaml": importableConfig}, http.StatusOK},
+		{"extraction failure", map[string]string{"config.yaml": importableConfig, "a": "file", "a/b": "nested"}, http.StatusInternalServerError},
+		{"validation failure", map[string]string{"other.yaml": "x"}, http.StatusUnprocessableEntity},
+		{"config validation failure", map[string]string{"config.yaml": "not: valid"}, http.StatusUnprocessableEntity},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			r.ServeHTTP(w, importRequest(t, tc.files))
+			require.Equal(t, tc.code, w.Code, w.Body.String())
+			requireNoServerPaths(t, w.Body.String(), root)
+			if tc.code == http.StatusInternalServerError {
+				require.JSONEq(t, `{"error":"extraction failed"}`, w.Body.String())
+			}
+		})
+	}
+}
+
+func TestResponses_CuratedApplyCarriesNoPaths(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		c := newCuratedHarness(t, nil)
+		code, resp := c.apply(t, "honeypot-friendly-defaults")
+		require.Equal(t, http.StatusOK, code)
+		body, _ := json.Marshal(resp)
+		requireNoServerPaths(t, string(body), filepath.Dir(c.dataDir))
+		require.Regexp(t, `\.backup\.\d{8}-\d{6}\.\d{6}$`, resp["backup"])
+	})
+
+	t.Run("rollback failure", func(t *testing.T) {
+		var c *curatedHarness
+		c = newCuratedHarness(t, func(_ context.Context, cmd string) ([]byte, error) {
+			if strings.Contains(cmd, " install ") {
+				// Make the restore fail too: DataDir becomes a regular file mid-apply.
+				require.NoError(t, os.RemoveAll(c.dataDir))
+				require.NoError(t, os.WriteFile(c.dataDir, []byte("not a dir"), 0o600))
+				return nil, context.DeadlineExceeded
+			}
+			return nil, nil
+		})
+		code, resp := c.apply(t, "geoip-enrichment")
+		require.GreaterOrEqual(t, code, http.StatusInternalServerError)
+		body, _ := json.Marshal(resp)
+		require.Contains(t, string(body), "see server logs")
+		requireNoServerPaths(t, string(body), filepath.Dir(c.dataDir))
+	})
+}
+
+func TestResponses_AcquisitionUpdateCarriesBackupNameOnly(t *testing.T) {
+	dir := t.TempDir()
+	acquis := filepath.Join(dir, "acquis.yaml")
+	require.NoError(t, os.WriteFile(acquis, []byte("old: true\n"), 0o600))
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", acquis)
+
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
+	r := gin.New()
+	r.PUT("/acquisition", h.UpdateAcquisitionConfig)
+
+	body, _ := json.Marshal(map[string]string{"content": "source: file\n"})
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPut, "/acquisition", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code, w.Body.String())
+	requireNoServerPaths(t, w.Body.String(), dir)
+	var resp map[string]any
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+	require.Regexp(t, `^acquis\.yaml\.backup\.\d{8}-\d{6}$`, resp["backup"])
+	require.FileExists(t, filepath.Join(dir, resp["backup"].(string)))
+}
+
+func TestResponses_ExportErrorCarriesNoPaths(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("permission checks do not apply to root")
+	}
+	dir := t.TempDir()
+	secret := filepath.Join(dir, "unreadable.yaml")
+	require.NoError(t, os.WriteFile(secret, []byte("x"), 0o000))
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", dir)
+	r := gin.New()
+	h.RegisterRoutes(r.Group("/api/v1"))
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/export", http.NoBody))
+
+	require.Equal(t, http.StatusInternalServerError, w.Code)
+	requireNoServerPaths(t, w.Body.String(), dir)
+	require.Contains(t, w.Body.String(), "failed to export crowdsec config")
+}
+
+// pathErrExec fails every lifecycle call with an error that embeds an absolute server path.
+type pathErrExec struct{}
+
+func (p *pathErrExec) err() error {
+	return &os.PathError{Op: "open", Path: "/app/data/crowdsec/crowdsec.pid", Err: os.ErrPermission}
+}
+func (p *pathErrExec) Start(context.Context, string, string) (int, error) { return 0, p.err() }
+func (p *pathErrExec) Stop(context.Context, string) error                 { return p.err() }
+func (p *pathErrExec) Status(context.Context, string) (running bool, pid int, err error) {
+	return false, 0, p.err()
+}
+
+func serveCrowdsec(h *CrowdsecHandler, method, target string) *httptest.ResponseRecorder {
+	r := gin.New()
+	h.RegisterRoutes(r.Group("/api/v1"))
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(method, target, http.NoBody))
+	return w
+}
+
+func TestResponses_AcquisitionGetCarriesNoPath(t *testing.T) {
+	dir := t.TempDir()
+	acquis := filepath.Join(dir, "acquis.yaml")
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", acquis)
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
+
+	w := serveCrowdsec(h, http.MethodGet, "/api/v1/admin/crowdsec/acquisition")
+	require.Equal(t, http.StatusNotFound, w.Code)
+	requireNoServerPaths(t, w.Body.String(), dir)
+	require.JSONEq(t, `{"error":"acquisition config not found"}`, w.Body.String())
+
+	require.NoError(t, os.WriteFile(acquis, []byte("source: file\n"), 0o600))
+	w = serveCrowdsec(h, http.MethodGet, "/api/v1/admin/crowdsec/acquisition")
+	require.Equal(t, http.StatusOK, w.Code)
+	requireNoServerPaths(t, w.Body.String(), dir)
+	require.JSONEq(t, `{"content":"source: file\n"}`, w.Body.String())
+}
+
+func TestResponses_DiagnosticsConfigCarriesNoPaths(t *testing.T) {
+	dataDir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dataDir, "config"), 0o750))
+	require.NoError(t, os.WriteFile(filepath.Join(dataDir, "config", "config.yaml"), []byte("listen_uri: 127.0.0.1:8080\n"), 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(dataDir, "config", "acquis.yaml"), []byte("source: file\nfilenames: [a]\n"), 0o600))
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", dataDir)
+
+	w := serveCrowdsec(h, http.MethodGet, "/api/v1/admin/crowdsec/diagnostics/config")
+	require.Equal(t, http.StatusOK, w.Code)
+	requireNoServerPaths(t, w.Body.String(), dataDir)
+	var resp map[string]any
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+	require.Equal(t, true, resp["config_exists"])
+	require.Equal(t, true, resp["acquis_exists"])
+	require.NotContains(t, resp, "config_path")
+	require.NotContains(t, resp, "acquis_path")
+}
+
+func TestResponses_LifecycleFailuresReturnFixedMessages(t *testing.T) {
+	dataDir := t.TempDir()
+	h := newTestCrowdsecHandler(t, setupCrowdDB(t), &pathErrExec{}, "/bin/false", dataDir)
+	cases := []struct {
+		name, method, target, want string
+	}{
+		{"start", http.MethodPost, "/api/v1/admin/crowdsec/start", "failed to start CrowdSec"},
+		{"stop", http.MethodPost, "/api/v1/admin/crowdsec/stop", "failed to stop CrowdSec"},
+		{"status", http.MethodGet, "/api/v1/admin/crowdsec/status", "failed to read CrowdSec status"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			w := serveCrowdsec(h, tc.method, tc.target)
+			require.Equal(t, http.StatusInternalServerError, w.Code, w.Body.String())
+			requireNoServerPaths(t, w.Body.String(), dataDir)
+			require.JSONEq(t, `{"error":"`+tc.want+`"}`, w.Body.String())
+		})
+	}
+}
+
+func TestResponses_ConsoleFailuresReturnFixedMessages(t *testing.T) {
+	t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
+	h := setupTestConsoleEnrollment(t)
+	require.NoError(t, h.DB.Migrator().DropTable(&models.CrowdsecConsoleEnrollment{}))
+
+	cases := []struct {
+		name, method, target, want string
+	}{
+		{"status", http.MethodGet, "/api/v1/admin/crowdsec/console/status", "failed to read enrollment status"},
+		{"heartbeat", http.MethodGet, "/api/v1/admin/crowdsec/console/heartbeat", "failed to read enrollment status"},
+		{"clear", http.MethodDelete, "/api/v1/admin/crowdsec/console/enrollment", "failed to clear enrollment state"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			w := serveCrowdsec(h, tc.method, tc.target)
+			require.Equal(t, http.StatusInternalServerError, w.Code, w.Body.String())
+			requireNoServerPaths(t, w.Body.String())
+			require.JSONEq(t, `{"error":"`+tc.want+`"}`, w.Body.String())
+		})
+	}
+}
+
+func TestResponses_PresetCacheReadFailureReturnsFixedMessage(t *testing.T) {
+	dataDir := t.TempDir()
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", dataDir)
+	meta, err := h.Hub.Cache.Store(context.Background(), "demo", "etag", "hub", "preview", []byte("x"))
+	require.NoError(t, err)
+	require.NoError(t, os.Remove(meta.PreviewPath))
+
+	w := serveCrowdsec(h, http.MethodGet, "/api/v1/admin/crowdsec/presets/cache/demo")
+	require.Equal(t, http.StatusInternalServerError, w.Code, w.Body.String())
+	requireNoServerPaths(t, w.Body.String(), dataDir)
+	require.JSONEq(t, `{"error":"failed to load preset preview"}`, w.Body.String())
+}
diff --git a/backend/internal/api/routes/crowdsec_export_gzip_test.go b/backend/internal/api/routes/crowdsec_export_gzip_test.go
new file mode 100644
index 000000000..2a5a65f60
--- /dev/null
+++ b/backend/internal/api/routes/crowdsec_export_gzip_test.go
@@ -0,0 +1,72 @@
+package routes
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/Wikid82/charon/backend/internal/api/handlers"
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+// TestCrowdsecExport_NotDoubleCompressed guards against the router-wide gzip middleware
+// wrapping the export handler's own tar.gz stream a second time.
+func TestCrowdsecExport_NotDoubleCompressed(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(isolatedMemoryDSN(t)), &gorm.Config{})
+	require.NoError(t, err)
+
+	dataDir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dataDir, "config"), 0o750))
+	require.NoError(t, os.WriteFile(filepath.Join(dataDir, "config", "config.yaml"), []byte("test: config\n"), 0o600))
+
+	h := handlers.NewCrowdsecHandler(db, nil, "/bin/false", dataDir)
+	t.Cleanup(func() {
+		if h.Security != nil {
+			h.Security.Close()
+		}
+	})
+
+	r := gin.New()
+	r.Use(compressionMiddleware())
+	h.RegisterRoutes(r.Group("/api/v1"))
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/export", http.NoBody)
+	req.Header.Set("Accept-Encoding", "gzip")
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, "application/gzip", w.Header().Get("Content-Type"))
+	require.Contains(t, w.Header().Get("Content-Disposition"), "attachment; filename=crowdsec-config-")
+
+	// Decode transport compression exactly as a client would (honouring Content-Encoding).
+	var body io.Reader = w.Body
+	if w.Header().Get("Content-Encoding") == "gzip" {
+		zr, zerr := gzip.NewReader(body)
+		require.NoError(t, zerr)
+		body = zr
+	}
+	// What remains must be the tar.gz file itself.
+	gr, err := gzip.NewReader(body)
+	require.NoError(t, err, "download is not a single-layer tar.gz")
+	tr := tar.NewReader(gr)
+	var names []string
+	for {
+		hdr, nerr := tr.Next()
+		if nerr == io.EOF {
+			break
+		}
+		require.NoError(t, nerr)
+		names = append(names, hdr.Name)
+	}
+	require.Contains(t, names, filepath.Join("config", "config.yaml"))
+}
diff --git a/backend/internal/api/routes/routes.go b/backend/internal/api/routes/routes.go
index de1321d25..fa4ca3184 100644
--- a/backend/internal/api/routes/routes.go
+++ b/backend/internal/api/routes/routes.go
@@ -210,7 +210,7 @@ func RegisterWithDeps(ctx context.Context, router *gin.Engine, db *gorm.DB, cfg
 	router.Use(middleware.EmergencyBypass(cfg.Security.ManagementCIDRs, db))
 
 	// Enable gzip compression for API responses (reduces payload size ~70%)
-	router.Use(gzip.Gzip(gzip.DefaultCompression))
+	router.Use(compressionMiddleware())
 
 	// Apply security headers middleware globally
 	// This sets CSP, HSTS, X-Frame-Options, etc.
@@ -1253,3 +1253,13 @@ func logAuthThrottlePolicy(st middleware.AuthRateLimitStatus) {
 			config.EnvAuthRateLimitEnabled)
 	}
 }
+
+// precompressedPaths lists routes whose handlers already emit a gzip stream (tar.gz downloads).
+// They must bypass the router-wide gzip middleware, otherwise the body is compressed twice
+// and the downloaded archive cannot be extracted.
+var precompressedPaths = []string{"/api/v1/admin/crowdsec/export"}
+
+// compressionMiddleware returns the router-wide gzip middleware, skipping precompressed downloads.
+func compressionMiddleware() gin.HandlerFunc {
+	return gzip.Gzip(gzip.DefaultCompression, gzip.WithExcludedPaths(precompressedPaths))
+}
diff --git a/backend/internal/crowdsec/archive_error_paths_test.go b/backend/internal/crowdsec/archive_error_paths_test.go
new file mode 100644
index 000000000..70264f739
--- /dev/null
+++ b/backend/internal/crowdsec/archive_error_paths_test.go
@@ -0,0 +1,91 @@
+package crowdsec
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWithoutPath(t *testing.T) {
+	t.Parallel()
+	cause := errors.New("permission denied")
+	require.Equal(t, cause, withoutPath(&fs.PathError{Op: "open", Path: "/secret/x", Err: cause}))
+	require.Equal(t, cause, withoutPath(&os.LinkError{Op: "rename", Old: "/a", New: "/b", Err: cause}))
+	require.Equal(t, cause, withoutPath(cause))
+}
+
+func TestCreateFileNoSymlinkMkdirParentFailure(t *testing.T) {
+	t.Parallel()
+	skipIfRoot(t)
+	root := t.TempDir()
+	// parentMode 0 lets MkdirAll create "a" but not its child, so the mkdir fails.
+	dest := filepath.Join(root, "a", "b", "c.txt")
+	t.Cleanup(func() { _ = os.Chmod(filepath.Join(root, "a"), 0o700) }) //nolint:gosec // G302: restore dir access so TempDir cleanup works
+	f, err := CreateFileNoSymlink(root, dest, 0o000, 0o600)
+	require.Nil(t, f)
+	require.ErrorContains(t, err, "mkdir parent")
+	require.NotContains(t, err.Error(), root)
+}
+
+func tarGzRaw(t *testing.T, build func(tw *tar.Writer)) []byte {
+	t.Helper()
+	buf := &bytes.Buffer{}
+	gw := gzip.NewWriter(buf)
+	tw := tar.NewWriter(gw)
+	build(tw)
+	require.NoError(t, gw.Close())
+	return buf.Bytes()
+}
+
+func TestExtractTarGzDirMkdirFailure(t *testing.T) {
+	t.Parallel()
+	skipIfRoot(t)
+	target := t.TempDir()
+	t.Cleanup(func() { _ = os.Chmod(filepath.Join(target, "a"), 0o700) }) //nolint:gosec // G302: restore dir access so TempDir cleanup works
+	archive := tarGzRaw(t, func(tw *tar.Writer) {
+		require.NoError(t, tw.WriteHeader(&tar.Header{Name: "a/", Typeflag: tar.TypeDir, Mode: 0o000}))
+		require.NoError(t, tw.WriteHeader(&tar.Header{Name: "a/b/", Typeflag: tar.TypeDir, Mode: 0o700}))
+		require.NoError(t, tw.Close())
+	})
+	err := NewHubService(nil, nil, target).extractTarGz(t.Context(), archive, target)
+	require.ErrorContains(t, err, "mkdir a/b")
+	require.NotContains(t, err.Error(), target)
+}
+
+func TestExtractTarGzTruncatedEntry(t *testing.T) {
+	t.Parallel()
+	target := t.TempDir()
+	// Header promises 10 bytes but the stream ends after 3 and the tar is never closed.
+	archive := tarGzRaw(t, func(tw *tar.Writer) {
+		require.NoError(t, tw.WriteHeader(&tar.Header{Name: "f.yaml", Mode: 0o600, Size: 10}))
+		_, err := tw.Write([]byte("abc"))
+		require.NoError(t, err)
+	})
+	err := NewHubService(nil, nil, target).extractTarGz(t.Context(), archive, target)
+	require.ErrorContains(t, err, "write f.yaml")
+	require.NotContains(t, err.Error(), target)
+}
+
+func TestExtractTarGzDecompressionBomb(t *testing.T) {
+	t.Parallel()
+	target := t.TempDir()
+	const size = 100 * 1024 * 1024
+	archive := tarGzRaw(t, func(tw *tar.Writer) {
+		require.NoError(t, tw.WriteHeader(&tar.Header{Name: "bomb.bin", Mode: 0o600, Size: size}))
+		chunk := make([]byte, 1024*1024)
+		for i := 0; i < size/len(chunk); i++ {
+			_, err := tw.Write(chunk)
+			require.NoError(t, err)
+		}
+		require.NoError(t, tw.Close())
+	})
+	err := NewHubService(nil, nil, target).extractTarGz(t.Context(), archive, target)
+	require.ErrorContains(t, err, "decompression bomb")
+}
diff --git a/backend/internal/crowdsec/backup.go b/backend/internal/crowdsec/backup.go
index 0e9fa0187..842007b74 100644
--- a/backend/internal/crowdsec/backup.go
+++ b/backend/internal/crowdsec/backup.go
@@ -6,6 +6,7 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 	"time"
@@ -287,10 +288,20 @@ func PruneBackups(dataDir, kind string, keep int) (removed []string, err error)
 	return removed, errors.Join(errs...)
 }
 
-// rollbackFailure annotates cause with a failed restore and the snapshot kept for manual recovery.
+// BackupID returns the client-safe name of a backup: the final path element, never the absolute
+// location. It covers the directory kinds (*.backup.<ts>, *.filebackup.<ts>) and file backups
+// (acquis.yaml.backup.<ts>); an empty path yields an empty name.
+func BackupID(path string) string {
+	if path == "" {
+		return ""
+	}
+	return filepath.Base(path)
+}
+
+// rollbackFailure annotates cause with a failed restore; the snapshot location is logged, never returned.
 func rollbackFailure(cause, restoreErr error, backupPath string) error {
 	logger.Log().WithError(restoreErr).WithField("backup_path", util.SanitizeForLog(backupPath)).Error("preset rollback failed; backup retained for manual recovery")
-	return fmt.Errorf("%w (rollback failed: %v; backup retained at %s)", cause, restoreErr, backupPath)
+	return fmt.Errorf("%w (rollback failed; backup retained, see server logs)", cause)
 }
 
 // BackupFile copies the single file dataDir/rel into a new <dataDir>.filebackup.<ts>/<rel> directory
@@ -335,3 +346,43 @@ func BackupFile(dataDir, rel string) (string, error) {
 	}
 	return dir, nil
 }
+
+// absPathPattern matches an absolute filesystem path that starts the string or follows whitespace,
+// a quote, or one of ( [ { < = ,. URL path segments are preceded by ":" or a word character
+// and are therefore left alone. A path ends at whitespace, a quote, or one of : ; , ) ] } > <.
+var absPathPattern = regexp.MustCompile(`(^|[\s(\[{<=,'"])(/[^\s:;,)\]}>'"<]+)`)
+
+// apiRoutePrefix marks route-looking text (for example " /api/v1/x") that RedactPaths must not
+// rewrite, since API routes are not filesystem paths.
+const apiRoutePrefix = "/api/"
+
+// RedactPaths replaces absolute filesystem paths in an error message with "<path>" so server
+// layout never reaches an API client. Detail belongs in server logs.
+//
+// Limits: this is a heuristic over free text. Any absolute path in the recognised positions is
+// redacted except those under /api/, so a bare route outside /api/ is also redacted (safe
+// direction). Paths containing spaces or ":", Windows-style paths, and relative paths are not
+// recognised; callers must not rely on it for those, and should prefer fixed messages.
+func RedactPaths(msg string) string {
+	return absPathPattern.ReplaceAllStringFunc(msg, func(m string) string {
+		sub := absPathPattern.FindStringSubmatch(m)
+		if strings.HasPrefix(sub[2], apiRoutePrefix) {
+			return m
+		}
+		return sub[1] + "<path>"
+	})
+}
+
+// withoutPath unwraps a filesystem error to its underlying cause (for example "permission
+// denied"), dropping the absolute path that *fs.PathError and *os.LinkError embed.
+func withoutPath(err error) error {
+	var pathErr *fs.PathError
+	if errors.As(err, &pathErr) {
+		return pathErr.Err
+	}
+	var linkErr *os.LinkError
+	if errors.As(err, &linkErr) {
+		return linkErr.Err
+	}
+	return err
+}
diff --git a/backend/internal/crowdsec/backup_name_test.go b/backend/internal/crowdsec/backup_name_test.go
new file mode 100644
index 000000000..61aec13a5
--- /dev/null
+++ b/backend/internal/crowdsec/backup_name_test.go
@@ -0,0 +1,44 @@
+package crowdsec
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestBackupID(t *testing.T) {
+	t.Parallel()
+	require.Equal(t, "crowdsec.backup.20260101-000000.000000", BackupID("/app/data/crowdsec.backup.20260101-000000.000000"))
+	require.Equal(t, "crowdsec.filebackup.20260101-000000.000000", BackupID("/data/crowdsec.filebackup.20260101-000000.000000/"))
+	require.Equal(t, "acquis.yaml.backup.20260101-000000", BackupID("/etc/crowdsec/acquis.yaml.backup.20260101-000000"))
+	require.Empty(t, BackupID(""))
+}
+
+func TestRedactPaths(t *testing.T) {
+	t.Parallel()
+	require.Equal(t, "open <path>: no such file", RedactPaths("open /app/data/x/y.yaml: no such file"))
+	require.Equal(t, "mkdir <path>: denied", RedactPaths("mkdir /tmp/a-b/c: denied"))
+	require.Equal(t, `fetch "<path>"`, RedactPaths(`fetch "/var/lib/x"`))
+	require.Equal(t, "fetch https://hub.crowdsec.net/a/index.json failed", RedactPaths("fetch https://hub.crowdsec.net/a/index.json failed"))
+	require.Equal(t, "plain message", RedactPaths("plain message"))
+	require.Equal(t, "<path>", RedactPaths("/app/data/x"))
+	require.Equal(t, "list [<path>]", RedactPaths("list [/data/crowdsec/a.yaml]"))
+	require.Equal(t, "{<path>}", RedactPaths("{/etc/crowdsec/config.yaml}"))
+	require.Equal(t, "a=1,<path>,b", RedactPaths("a=1,/srv/x/y,b"))
+	require.Equal(t, "<<path>>", RedactPaths("</opt/crowdsec/bin>"))
+	require.Equal(t, "stat <path>; retry <path>", RedactPaths("stat /custom/dir/f; retry /other/g"))
+	require.Equal(t, "route /api/v1/x failed", RedactPaths("route /api/v1/x failed"))
+	require.Equal(t, "GET (/api/v1/admin/crowdsec) failed", RedactPaths("GET (/api/v1/admin/crowdsec) failed"))
+	require.Equal(t, "see https://hub.crowdsec.net//a and a/b/c", RedactPaths("see https://hub.crowdsec.net//a and a/b/c"))
+}
+
+func TestExtractTarGzErrorsOmitAbsolutePaths(t *testing.T) {
+	t.Parallel()
+	// A file entry colliding with a later nested entry forces a mkdir failure.
+	target := t.TempDir()
+	svc := NewHubService(nil, nil, target)
+	require.NoError(t, svc.extractTarGz(t.Context(), makeTarGz(t, map[string]string{"a": "file"}), target))
+	err := svc.extractTarGz(t.Context(), makeTarGz(t, map[string]string{"a/b": "nested"}), target)
+	require.Error(t, err)
+	require.NotContains(t, err.Error(), target)
+}
diff --git a/backend/internal/crowdsec/backup_test.go b/backend/internal/crowdsec/backup_test.go
index 68f9726c5..3191bbfbd 100644
--- a/backend/internal/crowdsec/backup_test.go
+++ b/backend/internal/crowdsec/backup_test.go
@@ -639,7 +639,9 @@ func TestApplyRestoreFailureIsReported(t *testing.T) {
 
 	res, err := svc.Apply(context.Background(), "test/preset")
 	require.ErrorContains(t, err, "rollback failed")
-	require.ErrorContains(t, err, "backup retained at "+res.BackupPath)
+	require.ErrorContains(t, err, "backup retained, see server logs")
+	require.NotContains(t, err.Error(), res.BackupPath, "the backup location stays in server logs")
+	require.NotContains(t, err.Error(), dir)
 }
 
 func TestApplySnapshotFailureChangesNothing(t *testing.T) {
@@ -689,8 +691,9 @@ func TestRollbackFailureWrapsCause(t *testing.T) {
 	cause := errors.New("boom")
 	err := rollbackFailure(cause, errors.New("restore broke"), "/b")
 	require.ErrorIs(t, err, cause)
-	require.ErrorContains(t, err, "restore broke")
-	require.ErrorContains(t, err, "/b")
+	require.ErrorContains(t, err, "see server logs")
+	require.NotContains(t, err.Error(), "restore broke")
+	require.NotContains(t, err.Error(), "/b")
 }
 
 // makeTarGzWithSymlink returns an archive that writes one file and then hits a symlink entry.
diff --git a/backend/internal/crowdsec/curated_apply_test.go b/backend/internal/crowdsec/curated_apply_test.go
index b3eb8dced..22656d690 100644
--- a/backend/internal/crowdsec/curated_apply_test.go
+++ b/backend/internal/crowdsec/curated_apply_test.go
@@ -441,7 +441,7 @@ func TestApplyCuratedRollbackFailureIsReported(t *testing.T) {
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "install exploded")
 	require.Contains(t, err.Error(), "rollback failed")
-	require.Contains(t, err.Error(), res.BackupPath)
+	require.NotContains(t, err.Error(), res.BackupPath, "the backup location stays in server logs")
 	require.Equal(t, "failed", res.Status)
 	require.DirExists(t, dir, "DataDir itself is never removed")
 }
diff --git a/backend/internal/crowdsec/hub_pull_apply_test.go b/backend/internal/crowdsec/hub_pull_apply_test.go
index 5d5f8e6b5..c44a00ef2 100644
--- a/backend/internal/crowdsec/hub_pull_apply_test.go
+++ b/backend/internal/crowdsec/hub_pull_apply_test.go
@@ -51,24 +51,24 @@ func TestPullThenApplyFlow(t *testing.T) {
 
 	// Create hub service with mock HTTP client
 	hub := NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{
 		Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
 			switch req.URL.String() {
-			case "http://test.example.com/api/index.json":
-				body := `{"items":[{"name":"test/preset","title":"Test Preset","description":"Test","etag":"etag123","download_url":"http://test.example.com/test.tgz","preview_url":"http://test.example.com/test.yaml"}]}`
+			case "https://hub.crowdsec.net/api/index.json":
+				body := `{"items":[{"name":"test/preset","title":"Test Preset","description":"Test","etag":"etag123","download_url":"https://hub.crowdsec.net/test.tgz","preview_url":"https://hub.crowdsec.net/test.yaml"}]}`
 				return &http.Response{
 					StatusCode: http.StatusOK,
 					Body:       io.NopCloser(strings.NewReader(body)),
 					Header:     make(http.Header),
 				}, nil
-			case "http://test.example.com/test.yaml":
+			case "https://hub.crowdsec.net/test.yaml":
 				return &http.Response{
 					StatusCode: http.StatusOK,
 					Body:       io.NopCloser(strings.NewReader("test: preview\nkey: value")),
 					Header:     make(http.Header),
 				}, nil
-			case "http://test.example.com/test.tgz":
+			case "https://hub.crowdsec.net/test.tgz":
 				return &http.Response{
 					StatusCode: http.StatusOK,
 					Body:       io.NopCloser(bytes.NewReader(archive)),
@@ -141,15 +141,15 @@ func TestApplyRepullsOnCacheMissAfterCSCLIFailure(t *testing.T) {
 
 	exec := &stubExec{responses: map[string]error{"install": fmt.Errorf("install failed")}}
 	hub := NewHubService(exec, cache, dataDir)
-	hub.HubBaseURL = "http://test.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
 		switch req.URL.String() {
-		case "http://test.example.com/api/index.json":
+		case "https://hub.crowdsec.net/api/index.json":
 			body := `{"items":[{"name":"test/preset","title":"Test","etag":"e1"}]}`
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
-		case "http://test.example.com/test/preset.yaml":
+		case "https://hub.crowdsec.net/test/preset.yaml":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("preview")), Header: make(http.Header)}, nil
-		case "http://test.example.com/test/preset.tgz":
+		case "https://hub.crowdsec.net/test/preset.tgz":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 		default:
 			return &http.Response{StatusCode: http.StatusNotFound, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -187,15 +187,15 @@ func TestApplyRepullsOnCacheExpired(t *testing.T) {
 	cache.nowFn = func() time.Time { return time.Now().Add(2 * time.Hour) }
 
 	hub := NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
 		switch req.URL.String() {
-		case "http://test.example.com/api/index.json":
+		case "https://hub.crowdsec.net/api/index.json":
 			body := `{"items":[{"name":"expired/preset","title":"Expired","etag":"e2"}]}`
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
-		case "http://test.example.com/expired/preset.yaml":
+		case "https://hub.crowdsec.net/expired/preset.yaml":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("preview new")), Header: make(http.Header)}, nil
-		case "http://test.example.com/expired/preset.tgz":
+		case "https://hub.crowdsec.net/expired/preset.tgz":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 		default:
 			return &http.Response{StatusCode: http.StatusNotFound, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -222,15 +222,15 @@ func TestPullAcceptsNamespacedIndexEntry(t *testing.T) {
 	archive := makeTestArchive(t, map[string]string{"config.yaml": "test: namespaced"})
 
 	hub := NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
 		switch req.URL.String() {
-		case "http://test.example.com/api/index.json":
+		case "https://hub.crowdsec.net/api/index.json":
 			body := `{"items":[{"name":"crowdsecurity/bot-mitigation-essentials","title":"Bot Mitigation Essentials","etag":"etag-bme"}]}`
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
-		case "http://test.example.com/crowdsecurity/bot-mitigation-essentials.yaml":
+		case "https://hub.crowdsec.net/crowdsecurity/bot-mitigation-essentials.yaml":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("namespaced preview")), Header: make(http.Header)}, nil
-		case "http://test.example.com/crowdsecurity/bot-mitigation-essentials.tgz":
+		case "https://hub.crowdsec.net/crowdsecurity/bot-mitigation-essentials.tgz":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 		default:
 			return &http.Response{StatusCode: http.StatusNotFound, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -254,22 +254,22 @@ func TestHubFallbackToMirrorOnForbidden(t *testing.T) {
 	archive := makeTestArchive(t, map[string]string{"config.yaml": "mirror"})
 
 	hub := NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://primary.example.com"
-	hub.MirrorBaseURL = "http://mirror.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
+	hub.MirrorBaseURL = "https://hub-data.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
 		switch req.URL.String() {
-		case "http://primary.example.com/api/index.json":
+		case "https://hub.crowdsec.net/api/index.json":
 			return &http.Response{StatusCode: http.StatusForbidden, Body: io.NopCloser(strings.NewReader("blocked")), Header: make(http.Header)}, nil
-		case "http://mirror.example.com/api/index.json":
+		case "https://hub-data.crowdsec.net/api/index.json":
 			body := `{"items":[{"name":"fallback/preset","title":"Fallback","etag":"etag-mirror"}]}`
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
-		case "http://primary.example.com/fallback/preset.yaml":
+		case "https://hub.crowdsec.net/fallback/preset.yaml":
 			return &http.Response{StatusCode: http.StatusForbidden, Body: io.NopCloser(strings.NewReader("blocked")), Header: make(http.Header)}, nil
-		case "http://mirror.example.com/fallback/preset.yaml":
+		case "https://hub-data.crowdsec.net/fallback/preset.yaml":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("mirror preview")), Header: make(http.Header)}, nil
-		case "http://primary.example.com/fallback/preset.tgz":
+		case "https://hub.crowdsec.net/fallback/preset.tgz":
 			return &http.Response{StatusCode: http.StatusForbidden, Body: io.NopCloser(strings.NewReader("blocked")), Header: make(http.Header)}, nil
-		case "http://mirror.example.com/fallback/preset.tgz":
+		case "https://hub-data.crowdsec.net/fallback/preset.tgz":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 		default:
 			return &http.Response{StatusCode: http.StatusNotFound, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -293,7 +293,7 @@ func TestApplyWithoutPullFails(t *testing.T) {
 
 	// Create hub service without cscli (nil executor) and empty cache
 	hub := NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
 		return &http.Response{StatusCode: http.StatusInternalServerError, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
 	})}
@@ -344,16 +344,16 @@ func TestCacheListAfterPull(t *testing.T) {
 	archive := makeTestArchive(t, map[string]string{"test.yaml": "content"})
 
 	hub := NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	hub.HTTPClient = &http.Client{
 		Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
 			switch req.URL.String() {
-			case "http://test.example.com/api/index.json":
+			case "https://hub.crowdsec.net/api/index.json":
 				body := `{"items":[{"name":"preset1","title":"Preset 1","etag":"e1"}]}`
 				return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader(body)), Header: make(http.Header)}, nil
-			case "http://test.example.com/preset1.yaml":
+			case "https://hub.crowdsec.net/preset1.yaml":
 				return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("preview1")), Header: make(http.Header)}, nil
-			case "http://test.example.com/preset1.tgz":
+			case "https://hub.crowdsec.net/preset1.tgz":
 				return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 			default:
 				return &http.Response{StatusCode: http.StatusNotFound, Body: io.NopCloser(strings.NewReader("")), Header: make(http.Header)}, nil
@@ -451,7 +451,7 @@ func TestApplyReadsArchiveBeforeBackup(t *testing.T) {
 
 	// Create hub service WITHOUT cscli (nil executor) to force cache fallback path
 	hub := NewHubService(nil, cache, dataDir)
-	hub.HubBaseURL = "http://test.example.com"
+	hub.HubBaseURL = "https://hub.crowdsec.net"
 	// HTTP client that fails everything - we don't want to hit network
 	hub.HTTPClient = &http.Client{
 		Transport: mockTransport(func(req *http.Request) (*http.Response, error) {
diff --git a/backend/internal/crowdsec/hub_sync.go b/backend/internal/crowdsec/hub_sync.go
index 8ef531538..7a320ff68 100644
--- a/backend/internal/crowdsec/hub_sync.go
+++ b/backend/internal/crowdsec/hub_sync.go
@@ -85,22 +85,18 @@ type HubService struct {
 	PullTimeout   time.Duration
 	ApplyTimeout  time.Duration
 
+	// validateURL overrides validateHubURL when non-nil. Test-only: production
+	// code never sets it, so every hub request goes through validateHubURL.
+	validateURL func(string) error
+
 	// mu serializes Apply and ApplyCurated so backup/rollback cycles never interleave.
 	mu sync.Mutex
 }
 
-// hubAllowLoopback is a test-only seam. It is always false in production and is
-// only toggled from _test.go files. Tests that toggle it must not call
-// t.Parallel(), as it is shared package state.
-var hubAllowLoopback bool
-
 // validateHubURL validates a hub URL for security (SSRF protection - HIGH-001).
 // This function prevents Server-Side Request Forgery by:
 //  1. Enforcing HTTPS for production hub URLs
 //  2. Allowlisting known CrowdSec hub domains
-//  3. Accepting localhost/test hostnames at this layer; the dial layer
-//     (network.NewSafeHTTPClient) still blocks loopback and private targets
-//     unless the test-only hubAllowLoopback seam is set
 //
 // Returns: error if URL is invalid or not allowlisted
 func validateHubURL(rawURL string) error {
@@ -109,7 +105,7 @@ func validateHubURL(rawURL string) error {
 		return fmt.Errorf("invalid URL format: %w", err)
 	}
 
-	// Only allow http/https schemes
+	// Only allow http/https schemes at parse level; https is enforced below
 	if parsed.Scheme != "http" && parsed.Scheme != "https" {
 		return fmt.Errorf("unsupported scheme: %s (only http and https are allowed)", parsed.Scheme)
 	}
@@ -119,16 +115,7 @@ func validateHubURL(rawURL string) error {
 		return fmt.Errorf("missing hostname in URL")
 	}
 
-	// Allow localhost and test domains for development/testing
-	// This is safe because tests control the mock servers
-	if host == "localhost" || host == "127.0.0.1" || host == "::1" ||
-		strings.HasSuffix(host, ".example.com") || strings.HasSuffix(host, ".example") ||
-		host == "example.com" || strings.HasSuffix(host, ".local") ||
-		host == "test.hub" { // Allow test.hub for integration tests
-		return nil
-	}
-
-	// For production URLs, must be HTTPS
+	// Hub URLs must be HTTPS
 	if parsed.Scheme != "https" {
 		return fmt.Errorf("hub URLs must use HTTPS (got: %s)", parsed.Scheme)
 	}
@@ -155,6 +142,15 @@ func validateHubURL(rawURL string) error {
 	return nil
 }
 
+// checkURL validates target with the test override when set, otherwise with
+// the production validateHubURL.
+func (s *HubService) checkURL(target string) error {
+	if s.validateURL != nil {
+		return s.validateURL(target)
+	}
+	return validateHubURL(target)
+}
+
 // NewHubService constructs a HubService with sane defaults.
 func NewHubService(exec CommandExecutor, cache *HubCache, dataDir string) *HubService {
 	pullTimeout := defaultPullTimeout
@@ -187,19 +183,11 @@ func NewHubService(exec CommandExecutor, cache *HubCache, dataDir string) *HubSe
 // Hub URLs are validated by validateHubURL() which:
 // - Enforces HTTPS for production
 // - Allowlists known CrowdSec domains (hub-data.crowdsec.net, hub.crowdsec.net, raw.githubusercontent.com)
-// - Blocks loopback unless the test-only hubAllowLoopback seam is set
+// - Blocks loopback and private targets at the dial layer
 // Using network.NewSafeHTTPClient provides defense-in-depth at the connection level.
 func newHubHTTPClient(timeout time.Duration) *http.Client {
 	opts := []network.Option{
 		network.WithTimeout(timeout),
-		network.WithAllowedDomains(
-			"hub-data.crowdsec.net",
-			"hub.crowdsec.net",
-			"raw.githubusercontent.com",
-		),
-	}
-	if hubAllowLoopback {
-		opts = append(opts, network.WithAllowLocalhost())
 	}
 	return network.NewSafeHTTPClient(opts...)
 }
@@ -450,7 +438,7 @@ func (h hubHTTPError) CanFallback() bool {
 
 func (s *HubService) fetchIndexHTTPFromURL(ctx context.Context, target string) (HubIndex, error) {
 	// CRITICAL FIX: Validate hub URL before making HTTP request (HIGH-001)
-	if err := validateHubURL(target); err != nil {
+	if err := s.checkURL(target); err != nil {
 		return HubIndex{}, fmt.Errorf("invalid hub URL: %w", err)
 	}
 
@@ -751,7 +739,7 @@ func (s *HubService) fetchWithFallback(ctx context.Context, urls []string) (data
 
 func (s *HubService) fetchWithLimitFromURL(ctx context.Context, url string) ([]byte, error) {
 	// CRITICAL FIX: Validate hub URL before making HTTP request (HIGH-001)
-	if err := validateHubURL(url); err != nil {
+	if err := s.checkURL(url); err != nil {
 		return nil, fmt.Errorf("invalid hub URL: %w", err)
 	}
 
@@ -943,7 +931,7 @@ func (s *HubService) extractTarGz(ctx context.Context, archive []byte, targetDir
 			continue
 		}
 		cleanName := filepath.Clean(hdr.Name)
-		if strings.HasPrefix(cleanName, "..") || strings.Contains(cleanName, ".."+string(os.PathSeparator)) || filepath.IsAbs(cleanName) {
+		if hasParentComponent(cleanName) || filepath.IsAbs(cleanName) {
 			return fmt.Errorf("unsafe path %s", hdr.Name)
 		}
 		if IsEngineOwnedPath(cleanName) {
@@ -960,7 +948,7 @@ func (s *HubService) extractTarGz(ctx context.Context, archive []byte, targetDir
 
 		if hdr.FileInfo().IsDir() {
 			if mkdirErr := os.MkdirAll(destPath, mode); mkdirErr != nil { //nolint:gosec // G703: destPath contained under targetDir by the filepath.Rel check above
-				return fmt.Errorf("mkdir %s: %w", destPath, mkdirErr)
+				return fmt.Errorf("mkdir %s: %w", cleanName, withoutPath(mkdirErr))
 			}
 			continue
 		}
@@ -975,15 +963,15 @@ func (s *HubService) extractTarGz(ctx context.Context, archive []byte, targetDir
 		written, err := io.Copy(f, limitedReader)
 		if err != nil {
 			_ = f.Close()
-			return fmt.Errorf("write %s: %w", destPath, err)
+			return fmt.Errorf("write %s: %w", cleanName, withoutPath(err))
 		}
 		// Verify we didn't hit the limit (potential attack)
 		if written >= maxDecompressedSize {
 			_ = f.Close()
-			return fmt.Errorf("file %s exceeded decompression limit (%d bytes), potential decompression bomb", destPath, maxDecompressedSize)
+			return fmt.Errorf("file %s exceeded decompression limit (%d bytes), potential decompression bomb", cleanName, maxDecompressedSize)
 		}
 		if err := f.Close(); err != nil {
-			return fmt.Errorf("close %s: %w", destPath, err)
+			return fmt.Errorf("close %s: %w", cleanName, withoutPath(err))
 		}
 	}
 	return nil
@@ -1037,3 +1025,14 @@ func isGzip(data []byte) bool {
 	}
 	return data[0] == 0x1f && data[1] == 0x8b
 }
+
+// hasParentComponent reports whether any path component equals "..".
+// Names that merely start with two dots (e.g. "..foo") are legitimate.
+func hasParentComponent(name string) bool {
+	for _, part := range strings.Split(filepath.ToSlash(name), "/") {
+		if part == ".." {
+			return true
+		}
+	}
+	return false
+}
diff --git a/backend/internal/crowdsec/hub_sync_raw_index_test.go b/backend/internal/crowdsec/hub_sync_raw_index_test.go
index 619b7f29d..b33a5f45f 100644
--- a/backend/internal/crowdsec/hub_sync_raw_index_test.go
+++ b/backend/internal/crowdsec/hub_sync_raw_index_test.go
@@ -10,7 +10,7 @@ import (
 
 func TestFetchIndexParsesRawIndexFormat(t *testing.T) {
 	svc := NewHubService(nil, nil, t.TempDir())
-	svc.HubBaseURL = "http://example.com"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 
 	// This JSON represents the "raw" index format (map of maps) which has no "items" field.
 	// json.Unmarshal into HubIndex will succeed but result in empty Items.
@@ -33,7 +33,7 @@ func TestFetchIndexParsesRawIndexFormat(t *testing.T) {
 	}`
 
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
-		if req.URL.String() == "http://example.com"+defaultHubIndexPath {
+		if req.URL.String() == "https://hub.crowdsec.net"+defaultHubIndexPath {
 			resp := newResponse(http.StatusOK, rawIndexBody)
 			resp.Header.Set("Content-Type", "application/json")
 			return resp, nil
diff --git a/backend/internal/crowdsec/hub_sync_test.go b/backend/internal/crowdsec/hub_sync_test.go
index c6c79e9d3..15858765c 100644
--- a/backend/internal/crowdsec/hub_sync_test.go
+++ b/backend/internal/crowdsec/hub_sync_test.go
@@ -114,6 +114,7 @@ func TestFetchIndexFallbackHTTP(t *testing.T) {
 	defer hubServer.Close()
 
 	svc.HubBaseURL = hubServer.URL
+	svc.validateURL = func(string) error { return nil } // local httptest server is not an allowlisted hub host
 	svc.HTTPClient = hubServer.Client()
 
 	idx, err := svc.FetchIndex(context.Background())
@@ -128,7 +129,7 @@ func TestFetchIndexHTTPRejectsRedirect(t *testing.T) {
 	}
 	t.Parallel()
 	svc := NewHubService(nil, nil, t.TempDir())
-	svc.HubBaseURL = "http://hub.example"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		resp := newResponse(http.StatusMovedPermanently, "")
 		resp.Header.Set("Location", "https://hub.crowdsec.net/")
@@ -229,14 +230,14 @@ func TestPullCachesPreview(t *testing.T) {
 	archiveBytes := makeTarGz(t, map[string]string{"config.yaml": "value: 1"})
 
 	svc := NewHubService(nil, cache, dataDir)
-	svc.HubBaseURL = "http://example.com"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		switch req.URL.String() {
-		case "http://example.com" + defaultHubIndexPath:
-			return newResponse(http.StatusOK, `{"items":[{"name":"crowdsecurity/demo","title":"Demo","description":"desc","type":"collection","etag":"etag1","download_url":"http://example.com/demo.tgz","preview_url":"http://example.com/demo.yaml"}]}`), nil
-		case "http://example.com/demo.yaml":
+		case "https://hub.crowdsec.net" + defaultHubIndexPath:
+			return newResponse(http.StatusOK, `{"items":[{"name":"crowdsecurity/demo","title":"Demo","description":"desc","type":"collection","etag":"etag1","download_url":"https://hub.crowdsec.net/demo.tgz","preview_url":"https://hub.crowdsec.net/demo.yaml"}]}`), nil
+		case "https://hub.crowdsec.net/demo.yaml":
 			return newResponse(http.StatusOK, "preview-body"), nil
-		case "http://example.com/demo.tgz":
+		case "https://hub.crowdsec.net/demo.tgz":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archiveBytes)), Header: make(http.Header)}, nil
 		default:
 			return newResponse(http.StatusNotFound, ""), nil
@@ -341,14 +342,14 @@ func TestPullEvictsExpiredCacheAndRefreshes(t *testing.T) {
 
 	cache.nowFn = func() time.Time { return fixed.Add(3 * time.Second) }
 	svc := NewHubService(nil, cache, t.TempDir())
-	svc.HubBaseURL = "http://example.com"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		switch req.URL.String() {
-		case "http://example.com" + defaultHubIndexPath:
-			return newResponse(http.StatusOK, `{"items":[{"name":"crowdsecurity/demo","title":"Demo","description":"desc","type":"collection","etag":"etag2","download_url":"http://example.com/demo.tgz","preview_url":"http://example.com/demo.yaml"}]}`), nil
-		case "http://example.com/demo.yaml":
+		case "https://hub.crowdsec.net" + defaultHubIndexPath:
+			return newResponse(http.StatusOK, `{"items":[{"name":"crowdsecurity/demo","title":"Demo","description":"desc","type":"collection","etag":"etag2","download_url":"https://hub.crowdsec.net/demo.tgz","preview_url":"https://hub.crowdsec.net/demo.yaml"}]}`), nil
+		case "https://hub.crowdsec.net/demo.yaml":
 			return newResponse(http.StatusOK, "fresh-preview"), nil
-		case "http://example.com/demo.tgz":
+		case "https://hub.crowdsec.net/demo.tgz":
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 		default:
 			return newResponse(http.StatusNotFound, ""), nil
@@ -368,15 +369,15 @@ func TestPullFallsBackToArchivePreview(t *testing.T) {
 	archive := makeTarGz(t, map[string]string{"scenarios/demo.yaml": "title: demo"})
 
 	svc := NewHubService(nil, cache, t.TempDir())
-	svc.HubBaseURL = "http://example.com"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
-		if req.URL.String() == "http://example.com"+defaultHubIndexPath {
-			return newResponse(http.StatusOK, `{"items":[{"name":"crowdsecurity/demo","title":"Demo","etag":"etag1","download_url":"http://example.com/demo.tgz","preview_url":"http://example.com/demo.yaml"}]}`), nil
+		if req.URL.String() == "https://hub.crowdsec.net"+defaultHubIndexPath {
+			return newResponse(http.StatusOK, `{"items":[{"name":"crowdsecurity/demo","title":"Demo","etag":"etag1","download_url":"https://hub.crowdsec.net/demo.tgz","preview_url":"https://hub.crowdsec.net/demo.yaml"}]}`), nil
 		}
-		if req.URL.String() == "http://example.com/demo.yaml" {
+		if req.URL.String() == "https://hub.crowdsec.net/demo.yaml" {
 			return newResponse(http.StatusInternalServerError, ""), nil
 		}
-		if req.URL.String() == "http://example.com/demo.tgz" {
+		if req.URL.String() == "https://hub.crowdsec.net/demo.tgz" {
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(archive)), Header: make(http.Header)}, nil
 		}
 		return newResponse(http.StatusNotFound, ""), nil
@@ -395,7 +396,7 @@ func TestPullFallsBackToMirrorArchiveOnForbidden(t *testing.T) {
 
 	archiveBytes := makeTarGz(t, map[string]string{"config.yml": "foo: bar"})
 	svc := NewHubService(nil, cache, dataDir)
-	svc.HubBaseURL = "https://primary.example"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.MirrorBaseURL = defaultHubMirrorBaseURL
 
 	calls := make([]string, 0)
@@ -403,13 +404,13 @@ func TestPullFallsBackToMirrorArchiveOnForbidden(t *testing.T) {
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		calls = append(calls, req.URL.String())
 		switch req.URL.String() {
-		case "https://primary.example/api/index.json":
+		case "https://hub.crowdsec.net/api/index.json":
 			resp := newResponse(http.StatusOK, indexBody)
 			resp.Header.Set("Content-Type", "application/json")
 			return resp, nil
-		case "https://primary.example/crowdsecurity/demo.tgz":
+		case "https://hub.crowdsec.net/crowdsecurity/demo.tgz":
 			return newResponse(http.StatusForbidden, ""), nil
-		case "https://primary.example/crowdsecurity/demo.yaml":
+		case "https://hub.crowdsec.net/crowdsecurity/demo.yaml":
 			return newResponse(http.StatusForbidden, ""), nil
 		case defaultHubMirrorBaseURL + "/.index.json":
 			resp := newResponse(http.StatusOK, indexBody)
@@ -441,7 +442,7 @@ func TestFetchWithLimitRejectsLargePayload(t *testing.T) {
 		return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(big)), Header: make(http.Header)}, nil
 	})}
 
-	_, err := svc.fetchWithLimitFromURL(context.Background(), "http://example.com/large.tgz")
+	_, err := svc.fetchWithLimitFromURL(context.Background(), "https://hub.crowdsec.net/large.tgz")
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "payload too large")
 }
@@ -511,7 +512,7 @@ func TestPullValidatesSlugAndMissingPreset(t *testing.T) {
 	cache, cacheErr := NewHubCache(t.TempDir(), time.Hour)
 	require.NoError(t, cacheErr)
 	svc.Cache = cache
-	svc.HubBaseURL = "http://hub.example"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		return newResponse(http.StatusOK, `{"items":[{"name":"crowdsecurity/other","title":"Other","description":"d","type":"collection"}]}`), nil
 	})}
@@ -531,7 +532,7 @@ func TestFetchWithLimitRequiresClient(t *testing.T) {
 	t.Parallel()
 	svc := NewHubService(nil, nil, t.TempDir())
 	svc.HTTPClient = nil
-	_, err := svc.fetchWithLimitFromURL(context.Background(), "http://example.com/demo.tgz")
+	_, err := svc.fetchWithLimitFromURL(context.Background(), "https://hub.crowdsec.net/demo.tgz")
 	require.Error(t, err)
 }
 
@@ -568,7 +569,7 @@ func TestFetchIndexCSCLIParseError(t *testing.T) {
 	t.Parallel()
 	exec := &recordingExec{outputs: map[string][]byte{"cscli hub list -o json": []byte("not-json")}}
 	svc := NewHubService(exec, nil, t.TempDir())
-	svc.HubBaseURL = "http://hub.example"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		return newResponse(http.StatusInternalServerError, ""), nil
 	})}
@@ -580,12 +581,12 @@ func TestFetchIndexCSCLIParseError(t *testing.T) {
 func TestFetchWithLimitStatusError(t *testing.T) {
 	t.Parallel()
 	svc := NewHubService(nil, nil, t.TempDir())
-	svc.HubBaseURL = "http://hub.example"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		return newResponse(http.StatusNotFound, ""), nil
 	})}
 
-	_, err := svc.fetchWithLimitFromURL(context.Background(), "http://hub.example/demo.tgz")
+	_, err := svc.fetchWithLimitFromURL(context.Background(), "https://hub.crowdsec.net/demo.tgz")
 	require.Error(t, err)
 }
 
@@ -839,9 +840,9 @@ func TestIndexURLCandidates_GitHubMirror(t *testing.T) {
 func TestBuildResourceURLs_DeduplicatesExplicitAndBases(t *testing.T) {
 	t.Parallel()
 
-	urls := buildResourceURLs("https://hub.example/preset.tgz", "crowdsecurity/demo", "/%s.tgz", []string{"https://hub.example", "https://hub.example"})
+	urls := buildResourceURLs("https://hub.crowdsec.net/preset.tgz", "crowdsecurity/demo", "/%s.tgz", []string{"https://hub.crowdsec.net", "https://hub.crowdsec.net"})
 	require.NotEmpty(t, urls)
-	require.Equal(t, "https://hub.example/preset.tgz", urls[0])
+	require.Equal(t, "https://hub.crowdsec.net/preset.tgz", urls[0])
 	require.Len(t, urls, 2)
 }
 
@@ -849,9 +850,9 @@ func TestHubHTTPErrorMethods(t *testing.T) {
 	t.Parallel()
 
 	inner := errors.New("inner")
-	err := hubHTTPError{url: "https://hub.example", statusCode: 404, inner: inner, fallback: true}
+	err := hubHTTPError{url: "https://hub.crowdsec.net", statusCode: 404, inner: inner, fallback: true}
 
-	require.Contains(t, err.Error(), "https://hub.example")
+	require.Contains(t, err.Error(), "https://hub.crowdsec.net")
 	require.ErrorIs(t, err, inner)
 	require.True(t, err.CanFallback())
 }
@@ -991,27 +992,43 @@ func TestValidateHubURL_InvalidSchemes(t *testing.T) {
 	}
 }
 
-func TestValidateHubURL_LocalhostExceptions(t *testing.T) {
+func TestValidateHubURL_RejectsNonProductionHosts(t *testing.T) {
 	t.Parallel()
-	localhostURLs := []string{
+	nonProductionURLs := []string{
 		"http://localhost:8080/index.json",
 		"http://127.0.0.1:8080/index.json",
 		"http://[::1]:8080/index.json",
-		"http://test.hub/api/index.json",
+		"https://localhost/index.json",
+		"https://127.0.0.1/index.json",
+		"https://[::1]/index.json",
+		"https://test.hub/api/index.json",
+		"https://example.com/api/index.json",
+		"https://test.example.com/api/index.json",
+		"https://server.local/api/index.json",
 		"http://example.com/api/index.json",
-		"http://test.example.com/api/index.json",
-		"http://server.local/api/index.json",
 	}
 
-	for _, url := range localhostURLs {
+	for _, url := range nonProductionURLs {
 		t.Run(url, func(t *testing.T) {
 			t.Parallel()
-			err := validateHubURL(url)
-			require.NoError(t, err, "Expected localhost/test domain to be allowed")
+			require.Error(t, validateHubURL(url), "Expected non-production host to be rejected")
 		})
 	}
 }
 
+func TestNewHubHTTPClient_RejectsLoopback(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	resp, err := newHubHTTPClient(2 * time.Second).Get(srv.URL)
+	if err == nil {
+		_ = resp.Body.Close()
+	}
+	require.Error(t, err, "hub client must reject loopback")
+}
+
 func TestValidateHubURL_UnknownDomainRejection(t *testing.T) {
 	t.Parallel()
 	unknownURLs := []string{
@@ -1101,7 +1118,7 @@ func TestParseRawIndex(t *testing.T) {
 			}
 		}`
 
-		idx, err := parseRawIndex([]byte(rawJSON), "https://hub.example.com/api/index.json")
+		idx, err := parseRawIndex([]byte(rawJSON), "https://hub.crowdsec.net/api/index.json")
 		require.NoError(t, err)
 		require.Len(t, idx.Items, 2)
 
@@ -1122,14 +1139,14 @@ func TestParseRawIndex(t *testing.T) {
 
 	t.Run("returns error on invalid JSON", func(t *testing.T) {
 		t.Parallel()
-		_, err := parseRawIndex([]byte("not json"), "https://hub.example.com")
+		_, err := parseRawIndex([]byte("not json"), "https://hub.crowdsec.net")
 		require.Error(t, err)
 		require.Contains(t, err.Error(), "parse raw index")
 	})
 
 	t.Run("returns error on empty index", func(t *testing.T) {
 		t.Parallel()
-		_, err := parseRawIndex([]byte("{}"), "https://hub.example.com")
+		_, err := parseRawIndex([]byte("{}"), "https://hub.crowdsec.net")
 		require.Error(t, err)
 		require.Contains(t, err.Error(), "empty raw index")
 	})
@@ -1154,7 +1171,7 @@ func TestFetchIndexHTTPFromURL_HTMLDetection(t *testing.T) {
 		return resp, nil
 	})}
 
-	_, err := svc.fetchIndexHTTPFromURL(context.Background(), "http://test.hub/index.json")
+	_, err := svc.fetchIndexHTTPFromURL(context.Background(), "https://hub.crowdsec.net/index.json")
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "HTML")
 }
@@ -1195,11 +1212,11 @@ func TestHubService_Apply_CacheRefresh(t *testing.T) {
 	// Reset time to trigger expiration
 	cache.nowFn = time.Now
 
-	indexBody := `{"items":[{"name":"test/preset","title":"Test","etag":"etag2","download_url":"http://test.hub/preset.tgz"}]}`
+	indexBody := `{"items":[{"name":"test/preset","title":"Test","etag":"etag2","download_url":"https://hub.crowdsec.net/preset.tgz"}]}`
 	newArchive := makeTarGz(t, map[string]string{"config.yml": "new"})
 
 	svc := NewHubService(nil, cache, dataDir)
-	svc.HubBaseURL = "http://test.hub"
+	svc.HubBaseURL = "https://hub.crowdsec.net"
 	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
 		if strings.Contains(req.URL.String(), "index.json") {
 			return newResponse(http.StatusOK, indexBody), nil
@@ -1443,14 +1460,14 @@ func TestHubHTTPErrorError(t *testing.T) {
 		t.Parallel()
 		inner := errors.New("connection refused")
 		err := hubHTTPError{
-			url:        "https://hub.example.com/index.json",
+			url:        "https://hub.crowdsec.net/index.json",
 			statusCode: 503,
 			inner:      inner,
 			fallback:   true,
 		}
 
 		msg := err.Error()
-		require.Contains(t, msg, "https://hub.example.com/index.json")
+		require.Contains(t, msg, "https://hub.crowdsec.net/index.json")
 		require.Contains(t, msg, "503")
 		require.Contains(t, msg, "connection refused")
 	})
@@ -1458,14 +1475,14 @@ func TestHubHTTPErrorError(t *testing.T) {
 	t.Run("error without inner error", func(t *testing.T) {
 		t.Parallel()
 		err := hubHTTPError{
-			url:        "https://hub.example.com/index.json",
+			url:        "https://hub.crowdsec.net/index.json",
 			statusCode: 404,
 			inner:      nil,
 			fallback:   false,
 		}
 
 		msg := err.Error()
-		require.Contains(t, msg, "https://hub.example.com/index.json")
+		require.Contains(t, msg, "https://hub.crowdsec.net/index.json")
 		require.Contains(t, msg, "404")
 		require.NotContains(t, msg, "nil")
 	})
@@ -1477,7 +1494,7 @@ func TestHubHTTPErrorUnwrap(t *testing.T) {
 		t.Parallel()
 		inner := errors.New("underlying error")
 		err := hubHTTPError{
-			url:        "https://hub.example.com",
+			url:        "https://hub.crowdsec.net",
 			statusCode: 500,
 			inner:      inner,
 		}
@@ -1489,7 +1506,7 @@ func TestHubHTTPErrorUnwrap(t *testing.T) {
 	t.Run("unwrap returns nil when no inner", func(t *testing.T) {
 		t.Parallel()
 		err := hubHTTPError{
-			url:        "https://hub.example.com",
+			url:        "https://hub.crowdsec.net",
 			statusCode: 500,
 			inner:      nil,
 		}
@@ -1502,7 +1519,7 @@ func TestHubHTTPErrorUnwrap(t *testing.T) {
 		t.Parallel()
 		inner := context.Canceled
 		err := hubHTTPError{
-			url:        "https://hub.example.com",
+			url:        "https://hub.crowdsec.net",
 			statusCode: 0,
 			inner:      inner,
 		}
@@ -1517,7 +1534,7 @@ func TestHubHTTPErrorCanFallback(t *testing.T) {
 	t.Run("returns true when fallback is true", func(t *testing.T) {
 		t.Parallel()
 		err := hubHTTPError{
-			url:        "https://hub.example.com",
+			url:        "https://hub.crowdsec.net",
 			statusCode: 503,
 			fallback:   true,
 		}
@@ -1528,7 +1545,7 @@ func TestHubHTTPErrorCanFallback(t *testing.T) {
 	t.Run("returns false when fallback is false", func(t *testing.T) {
 		t.Parallel()
 		err := hubHTTPError{
-			url:        "https://hub.example.com",
+			url:        "https://hub.crowdsec.net",
 			statusCode: 404,
 			fallback:   false,
 		}
@@ -1607,29 +1624,39 @@ func TestValidateHubURL_EdgeCases(t *testing.T) {
 			errorMsg:  "unsupported scheme",
 		},
 		{
-			name:      "Test domain allowed",
-			url:       "http://test.hub/api/index.json",
+			name:      "Allowlisted hosts over HTTPS accepted",
+			url:       "https://raw.githubusercontent.com/crowdsecurity/hub/master/.index.json",
 			wantError: false,
 		},
 		{
-			name:      "Example.com allowed for testing",
-			url:       "http://example.com/index.json",
-			wantError: false,
+			name:      "Test domain rejected",
+			url:       "https://test.hub/api/index.json",
+			wantError: true,
+			errorMsg:  "unknown hub domain",
 		},
 		{
-			name:      ".local domain allowed",
-			url:       "http://myserver.local/index.json",
-			wantError: false,
+			name:      "Example.com rejected",
+			url:       "https://example.com/index.json",
+			wantError: true,
+			errorMsg:  "unknown hub domain",
 		},
 		{
-			name:      "Subdomain of example.com allowed",
-			url:       "http://test.example.com/index.json",
-			wantError: false,
+			name:      ".local domain rejected",
+			url:       "https://myserver.local/index.json",
+			wantError: true,
+			errorMsg:  "unknown hub domain",
+		},
+		{
+			name:      "Plain HTTP loopback rejected",
+			url:       "http://localhost:8080/index.json",
+			wantError: true,
+			errorMsg:  "must use HTTPS",
 		},
 		{
-			name:      "IPv6 loopback allowed",
+			name:      "IPv6 loopback rejected",
 			url:       "http://[::1]:8080/index.json",
-			wantError: false,
+			wantError: true,
+			errorMsg:  "must use HTTPS",
 		},
 		{
 			name:      "Unknown production domain rejected",
@@ -1723,20 +1750,20 @@ func TestNewHubService_EnvVarTimeouts_Whitespace(t *testing.T) {
 
 func TestNewHubService_CustomHubBaseURL(t *testing.T) {
 	// Note: Cannot use t.Parallel() with t.Setenv()
-	t.Setenv("HUB_BASE_URL", "https://custom.hub.example.com")
+	t.Setenv("HUB_BASE_URL", "https://hub.crowdsec.net")
 
 	svc := NewHubService(nil, nil, t.TempDir())
 
-	require.Equal(t, "https://custom.hub.example.com", svc.HubBaseURL)
+	require.Equal(t, "https://hub.crowdsec.net", svc.HubBaseURL)
 }
 
 func TestNewHubService_CustomMirrorBaseURL(t *testing.T) {
 	// Note: Cannot use t.Parallel() with t.Setenv()
-	t.Setenv("HUB_MIRROR_BASE_URL", "https://mirror.example.com")
+	t.Setenv("HUB_MIRROR_BASE_URL", "https://hub-data.crowdsec.net")
 
 	svc := NewHubService(nil, nil, t.TempDir())
 
-	require.Equal(t, "https://mirror.example.com", svc.MirrorBaseURL)
+	require.Equal(t, "https://hub-data.crowdsec.net", svc.MirrorBaseURL)
 }
 
 // ============================================
@@ -1834,19 +1861,6 @@ func TestExtractTarGz_RejectsBareParentEntry(t *testing.T) {
 	require.Contains(t, err.Error(), "unsafe path")
 }
 
-func TestExtractTarGz_RejectsDotDotPrefixedName(t *testing.T) {
-	t.Parallel()
-	svc := NewHubService(nil, nil, t.TempDir())
-	targetDir := t.TempDir()
-
-	// Documents the existing name check: any cleaned name starting with ".." is rejected.
-	archive := buildSingleEntryTarGz(t, &tar.Header{Name: "..foo", Mode: 0o644, Size: 3}, "abc")
-	err := svc.extractTarGz(context.Background(), archive, targetDir)
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "unsafe path")
-	require.NoFileExists(t, filepath.Join(targetDir, "..foo"))
-}
-
 func TestExtractTarGz_MasksSpecialModeBits(t *testing.T) {
 	t.Parallel()
 	svc := NewHubService(nil, nil, t.TempDir())
@@ -2065,7 +2079,7 @@ func TestFetchIndexHTTPFromURL_ParseRawIndexFallback(t *testing.T) {
 		return resp, nil
 	})}
 
-	idx, err := svc.fetchIndexHTTPFromURL(context.Background(), "http://test.hub/.index.json")
+	idx, err := svc.fetchIndexHTTPFromURL(context.Background(), "https://hub.crowdsec.net/.index.json")
 	require.NoError(t, err)
 	require.Len(t, idx.Items, 1)
 	require.Equal(t, "crowdsecurity/nginx", idx.Items[0].Name)
@@ -2090,7 +2104,7 @@ func TestFetchIndexHTTPFromURL_EmptyJSONArray(t *testing.T) {
 	// Empty items array triggers raw index parsing (map[string]map[string]...), which succeeds
 	// but returns empty index. This is actually valid JSON but semantically empty.
 	// The code returns idx even if empty in this case (no error), so we should not expect an error.
-	idx, err := svc.fetchIndexHTTPFromURL(context.Background(), "http://test.hub/index.json")
+	idx, err := svc.fetchIndexHTTPFromURL(context.Background(), "https://hub.crowdsec.net/index.json")
 	require.NoError(t, err)
 	require.Empty(t, idx.Items, "should parse successfully but return empty items")
 }
@@ -2108,7 +2122,7 @@ func TestFetchIndexHTTPFromURL_InvalidJSON(t *testing.T) {
 		return resp, nil
 	})}
 
-	_, err := svc.fetchIndexHTTPFromURL(context.Background(), "http://test.hub/index.json")
+	_, err := svc.fetchIndexHTTPFromURL(context.Background(), "https://hub.crowdsec.net/index.json")
 	require.Error(t, err)
 }
 
@@ -2245,32 +2259,43 @@ func TestFindIndexEntry_EmptySlug(t *testing.T) {
 	require.False(t, found)
 }
 
-// setHubAllowLoopbackForTest toggles the package-level seam. Callers must not
-// use t.Parallel().
-func setHubAllowLoopbackForTest(t *testing.T, v bool) {
-	t.Helper()
-	prev := hubAllowLoopback
-	hubAllowLoopback = v
-	t.Cleanup(func() { hubAllowLoopback = prev })
-}
+func TestExtractTarGzDotDotNames(t *testing.T) {
+	t.Parallel()
+	svc := NewHubService(nil, nil, t.TempDir())
 
-// Must not run in parallel: relies on shared seam state.
-func TestNewHubHTTPClient_LoopbackSeam(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
+	for _, name := range []string{"..foo", "a/..b", "...", "a/..."} {
+		t.Run("accepts "+name, func(t *testing.T) {
+			t.Parallel()
+			targetDir := t.TempDir()
+			archive := makeTarGz(t, map[string]string{name: "ok"})
+			require.NoError(t, svc.extractTarGz(context.Background(), archive, targetDir))
+			require.FileExists(t, filepath.Join(targetDir, filepath.FromSlash(name)))
+		})
+	}
 
-	get := func() error {
-		resp, err := newHubHTTPClient(2 * time.Second).Get(srv.URL)
-		if err == nil {
-			_ = resp.Body.Close()
-		}
-		return err
+	for _, name := range []string{"../x", "a/../../x", "/abs", ".."} {
+		t.Run("rejects "+name, func(t *testing.T) {
+			t.Parallel()
+			parent := t.TempDir()
+			targetDir := filepath.Join(parent, "data")
+			archive := makeTarGz(t, map[string]string{name: "bad"})
+			err := svc.extractTarGz(context.Background(), archive, targetDir)
+			require.Error(t, err)
+			require.Contains(t, err.Error(), "unsafe path")
+			require.NoFileExists(t, filepath.Join(parent, "x"))
+		})
 	}
+}
 
-	require.Error(t, get(), "default client must reject loopback")
+func TestHubBaseCandidates_DistinctRolesKeepOrder(t *testing.T) {
+	t.Parallel()
+	svc := NewHubService(nil, nil, t.TempDir())
+	svc.HubBaseURL = "https://hub.crowdsec.net"
+	svc.MirrorBaseURL = defaultHubMirrorBaseURL
 
-	setHubAllowLoopbackForTest(t, true)
-	require.NoError(t, get(), "seam permits loopback in tests")
+	require.Equal(t, []string{
+		"https://hub.crowdsec.net",
+		defaultHubMirrorBaseURL,
+		defaultHubBaseURL,
+	}, svc.hubBaseCandidates())
 }
diff --git a/backend/internal/crowdsec/safe_create.go b/backend/internal/crowdsec/safe_create.go
index 01d68d19d..545f6d99d 100644
--- a/backend/internal/crowdsec/safe_create.go
+++ b/backend/internal/crowdsec/safe_create.go
@@ -19,7 +19,7 @@ func CreateFileNoSymlink(root, dest string, parentMode, fileMode os.FileMode) (*
 	root = filepath.Clean(root)
 	rel, err := filepath.Rel(root, filepath.Clean(dest))
 	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
-		return nil, fmt.Errorf("path escapes target: %s", dest)
+		return nil, fmt.Errorf("path escapes target: %s", rel)
 	}
 	cur := root
 	for _, part := range strings.Split(rel, string(os.PathSeparator)) {
@@ -29,18 +29,18 @@ func CreateFileNoSymlink(root, dest string, parentMode, fileMode os.FileMode) (*
 			break
 		}
 		if lerr != nil {
-			return nil, fmt.Errorf("inspect %s: %w", cur, lerr)
+			return nil, fmt.Errorf("inspect %s: %w", rel, withoutPath(lerr))
 		}
 		if info.Mode()&os.ModeSymlink != 0 {
-			return nil, fmt.Errorf("%w: %s", ErrSymlinkInPath, cur)
+			return nil, fmt.Errorf("%w: %s", ErrSymlinkInPath, rel)
 		}
 	}
 	if err = os.MkdirAll(filepath.Dir(dest), parentMode); err != nil { //nolint:gosec // G703: dest verified contained under root and symlink-free above
-		return nil, fmt.Errorf("mkdir parent: %w", err)
+		return nil, fmt.Errorf("mkdir parent: %w", withoutPath(err))
 	}
 	f, err := os.OpenFile(dest, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, fileMode) //nolint:gosec // G304,G703: dest verified contained under root and symlink-free above
 	if err != nil {
-		return nil, fmt.Errorf("open %s: %w", dest, err)
+		return nil, fmt.Errorf("open %s: %w", rel, withoutPath(err))
 	}
 	return f, nil
 }
diff --git a/backend/internal/network/safeclient.go b/backend/internal/network/safeclient.go
index 8c0059bd9..4c3f8d1d5 100644
--- a/backend/internal/network/safeclient.go
+++ b/backend/internal/network/safeclient.go
@@ -262,10 +262,6 @@ type ClientOptions struct {
 	// Use only for testing or when connecting to known-safe local services.
 	AllowLocalhost bool
 
-	// AllowedDomains restricts requests to specific domains (optional).
-	// If set, only these domains will be allowed (in addition to localhost if AllowLocalhost is true).
-	AllowedDomains []string
-
 	// MaxRedirects sets the maximum number of redirects to follow (default: 0)
 	// Set to 0 to disable redirects entirely.
 	MaxRedirects int
@@ -303,7 +299,6 @@ func defaultOptions() ClientOptions {
 	return ClientOptions{
 		Timeout:        10 * time.Second,
 		AllowLocalhost: false,
-		AllowedDomains: nil,
 		MaxRedirects:   0,
 		DialTimeout:    5 * time.Second,
 	}
@@ -324,14 +319,6 @@ func WithAllowLocalhost() Option {
 	}
 }
 
-// WithAllowedDomains restricts requests to specific domains.
-// When set, only requests to these domains will be permitted.
-func WithAllowedDomains(domains ...string) Option {
-	return func(opts *ClientOptions) {
-		opts.AllowedDomains = append(opts.AllowedDomains, domains...)
-	}
-}
-
 // WithMaxRedirects sets the maximum number of redirects to follow.
 // Default is 0 (no redirects). Each redirect target is validated against SSRF rules.
 func WithMaxRedirects(maxRedirects int) Option {
diff --git a/backend/internal/network/safeclient_test.go b/backend/internal/network/safeclient_test.go
index f78e7f895..d43d8afc0 100644
--- a/backend/internal/network/safeclient_test.go
+++ b/backend/internal/network/safeclient_test.go
@@ -150,33 +150,6 @@ func TestSafeDialer_AllowsLocalhost(t *testing.T) {
 	_ = conn.Close()
 }
 
-func TestSafeDialer_AllowedDomains(t *testing.T) {
-	t.Parallel()
-	opts := &ClientOptions{
-		AllowLocalhost: false,
-		AllowedDomains: []string{"app.crowdsec.net", "hub.crowdsec.net"},
-		DialTimeout:    time.Second,
-	}
-	dialer := safeDialer(opts)
-
-	// Test that allowed domain passes validation (we can't actually connect)
-	// This is a structural test - we're verifying the domain check passes
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-
-	// This will fail to connect (no server) but should NOT fail validation
-	_, err := dialer(ctx, "tcp", "app.crowdsec.net:443")
-	if err != nil {
-		// Check it's a connection error, not a validation error
-		if _, ok := err.(*net.OpError); !ok {
-			// Context deadline exceeded is also acceptable (DNS/connection timeout)
-			if err != context.DeadlineExceeded {
-				t.Logf("Got expected error type for allowed domain: %T: %v", err, err)
-			}
-		}
-	}
-}
-
 func TestNewSafeHTTPClient_DefaultOptions(t *testing.T) {
 	t.Parallel()
 	client := NewSafeHTTPClient()
@@ -288,21 +261,6 @@ func TestNewSafeHTTPClient_WithMaxRedirects(t *testing.T) {
 	}
 }
 
-func TestNewSafeHTTPClient_WithAllowedDomains(t *testing.T) {
-	t.Parallel()
-	client := NewSafeHTTPClient(
-		WithTimeout(2*time.Second),
-		WithAllowedDomains("example.com"),
-	)
-
-	if client == nil {
-		t.Fatal("NewSafeHTTPClient() returned nil")
-	}
-
-	// We can't actually connect, but we verify the client is created
-	// with the correct configuration
-}
-
 func TestClientOptions_Defaults(t *testing.T) {
 	t.Parallel()
 	opts := defaultOptions()
@@ -846,7 +804,6 @@ func TestClientOptions_AllFunctionalOptions(t *testing.T) {
 	client := NewSafeHTTPClient(
 		WithTimeout(15*time.Second),
 		WithAllowLocalhost(),
-		WithAllowedDomains("example.com", "api.example.com"),
 		WithMaxRedirects(5),
 		WithDialTimeout(3*time.Second),
 	)
diff --git a/docs/features.md b/docs/features.md
index 75d4777f3..04f830b25 100644
--- a/docs/features.md
+++ b/docs/features.md
@@ -105,6 +105,8 @@ Protect your applications using behavior-based threat detection powered by a glo
 
 Preset changes are backed up first and rolled back automatically if anything goes wrong, and CrowdSec's downloaded data now survives container recreation.
 
+The CrowdSec file editor no longer lists CrowdSec's account and connection credential files, and backups are shown by name.
+
 → [Learn More](features/crowdsec.md) • [Setup Guide](guides/crowdsec-setup.md)
 
 ---
diff --git a/docs/features/crowdsec.md b/docs/features/crowdsec.md
index 2b1c66e79..c83193053 100644
--- a/docs/features/crowdsec.md
+++ b/docs/features/crowdsec.md
@@ -65,6 +65,8 @@ Hub presets are applied on the server too, with the same safety net: before anyt
 - Charon keeps the 5 most recent full backups and the 10 most recent single-file backups, and quietly deletes older ones.
 - Only one change runs at a time, so two edits can't collide.
 - The config file editor only accepts common text and settings files (`.yaml`, `.yml`, `.json`, `.txt`, `.conf`) up to 1 MiB, and validates file type, size and YAML.
+- The config file editor does not list CrowdSec's account and connection credential files. They stay safely on disk; an operator can still reach them from the container shell if needed.
+- Backups are shown by name and are stored next to the CrowdSec data folder (for example `/app/data/`). Full snapshots are named `crowdsec.backup.<timestamp>`, single-file saves `crowdsec.filebackup.<timestamp>`. Saved acquisition settings are backed up as `acquis.yaml.backup.<timestamp>` right beside the acquisition file instead. To recover by hand, stop CrowdSec, copy the backup you want back into place, and start it again.
 
 ### Console Enrollment
 
diff --git a/docs/plans/archive/crowdsec_preset_apply_hardening_1525_spec.md b/docs/plans/archive/crowdsec_preset_apply_hardening_1525_spec.md
new file mode 100644
index 000000000..5be618358
--- /dev/null
+++ b/docs/plans/archive/crowdsec_preset_apply_hardening_1525_spec.md
@@ -0,0 +1,286 @@
+# Plan: CrowdSec preset-apply and data/hub persistence hardening (follow-ups of PR #1513)
+
+Type: ONE branch, ONE PR into `development`: `fix/crowdsec-preset-apply-hardening`. Medium/large fix (touches Go backend, React frontend, Dockerfile, entrypoint, E2E, docs), so per CLAUDE.md it gets a dedicated branch and PR, never a direct commit to `development`.
+Closes: #1514, #1515, #1516, #1517, #1518, #1523, #1524.
+Status: rev 2 (addresses Supervisor CHANGES REQUESTED: 7 blocking items), open questions Q1-Q5 resolved by the user.
+Predecessor: the #1513 plan (curated preset apply) that previously lived in this file; it merged as `3a76804b`.
+
+## 1. Introduction
+
+PR #1513 made curated CrowdSec presets server-authoritative. While verifying it in a rebuilt container, seven follow-ups were filed. They share one theme: **the CrowdSec preset/hub apply path and the persistent CrowdSec directory (`/app/data/crowdsec`) are not safe or durable**. Backups are taken by renaming the live directory, a generic file-write endpoint also renames the live directory, hub data files live on an ephemeral path, the bundled binary does not know its own version, and the tests that should guard this are tolerant skips.
+
+Goal: after this PR, applying/editing CrowdSec config can never destroy the live config, hub data files survive container recreation, `cscli version` is truthful, backups are bounded, and E2E/unit tests fail when any of this regresses.
+
+## 2. Research Findings (root cause per issue, CLAUDE.md "Context First")
+
+Key facts established from code (all paths verified in this repo):
+
+- `crowdsecDataDir = cfg.Security.CrowdSecConfigDir` (`backend/internal/api/routes/routes.go:1030`), set to `/app/data/crowdsec` by `Dockerfile:1142` (`CHARON_CROWDSEC_CONFIG_DIR`). The same directory is `CS_PERSIST_DIR` in `.docker/docker-entrypoint.sh`. It therefore contains the **whole persistent CrowdSec tree**: `config/` (the target of the runtime symlink `/etc/crowdsec -> /app/data/crowdsec/config`), `data/` (LAPI db), `hub_cache/`, `bouncer_key`.
+- That same path is `HubService.DataDir` and `CrowdsecHandler.DataDir` (`crowdsec_handler.go:374-397`). Every "backup the DataDir" in the code is a backup directory next to it, `/app/data/crowdsec.backup.<ts>`.
+
+### 2.1 #1514 applyPresetLocally writes unvalidated client content (root cause is wider than the issue says)
+
+- Entry: `frontend/src/pages/CrowdSecConfig.tsx:429` `applyPresetLocally`; reached only when apply returns HTTP 501 for a non-curated (hub) preset (line ~508). It writes `presetPreview` (text from the pull preview, held in client state) to `selectedPath ?? files[0]` through `writeCrowdsecFile` (`frontend/src/api/crowdsec.ts`).
+- Confirmed: the backend **never returns 501** for apply any more (grep of `crowdsec_handler.go` shows no `StatusNotImplemented`). The fallback is dead code in practice and can only be triggered by a proxy/misconfig, which makes removing it risk-free.
+- Transformation/persistence: `POST /admin/crowdsec/file` -> `CrowdsecHandler.WriteFile` (`crowdsec_handler.go:950`, registered under `managementAdmin`, so admin-only). Verified defects in the handler, independent of the frontend:
+  1. **Destructive backup.** It `os.Rename(h.DataDir, backupDir)` (moves the *entire* persistent CrowdSec tree away, config symlink target included), then `MkdirAll(filepath.Dir(p))` and writes just the one file. Everything else (config.yaml, hub, bouncer key, data) is left only in the backup dir. The live tree becomes a single file. There is no restore. This is the same defect class as #1515 and is a medium-severity data-loss bug, not just "unvalidated content".
+  2. **The file endpoints get a validation pass.** The fix is described at policy level in 3.2.
+- Exit: `{status:"written", backup}`; the UI toasts "File saved" / "Preset applied locally".
+- Severity/impact: low-medium, authenticated admin only (not an unauthenticated vulnerability). See section 4.
+
+### 2.2 #1515 HubService.Apply renames the whole data dir (CONFIRMED in code; end-to-end not executed)
+
+- Entry: `ApplyPreset` -> `Hub.Apply` for non-curated presets (`hub_sync.go:602`).
+- Transformation: `backupExisting` first tries `os.Rename(DataDir, <DataDir>.backup.<ts>)`; only if rename fails (EBUSY on a mount point, cross-device) does it fall back to `copyDir`. Then `runCSCLI` (`cscli hub update` + `cscli hub install <slug>`).
+- Why it is wrong, confirmed by reading the code and by the behavior seen in a throwaway container (below): after the rename `/etc/crowdsec -> /app/data/crowdsec/config` dangles, so `cscli` cannot read `config.yaml` (observed error: `open /etc/crowdsec/config.yaml: no such file or directory`). The cscli path therefore fails, the code falls to `extractTarGz` into a freshly created `DataDir`, and on success the live dir holds only the extracted archive while config, hub, `bouncer_key`, LAPI db and `hub_cache` sit in the backup. CrowdSec is running while its db directory is moved. Rollback (`rollback`) does `RemoveAll(DataDir)` then renames the backup back, so it is also only valid for that directory and cannot undo anything `cscli` wrote outside it.
+- Not confirmed: that a *real* hub-preset apply on a running container hits exactly this sequence (needs a hub preset pull + a running agent). The verification step is part of the gate in Commit 3. Whether the extract fallback ever "succeeds" with a usable tree is irrelevant; the rename itself is the defect.
+- Fix direction (matches the issue): reuse the copy-based, symlink-preserving, db-excluding `backupCopy`/`restoreCopy` added for `ApplyCurated`.
+
+### 2.3 #1516 backup directories accumulate (CONFIRMED)
+
+Creators of `<DataDir>.backup.*`: `HubService.Apply` (rename, second-resolution timestamp), `ApplyCurated` (copy, microsecond timestamp), `CrowdsecHandler.ImportConfig` (`crowdsec_handler.go:696`, rename), `WriteFile` (rename). Nothing ever deletes any of them. grep for prune/retention in `backend/internal/crowdsec` returns nothing. Because the curated backup is a full copy of the persistent tree (minus the db) and the legacy ones are the whole tree, growth is unbounded on a volume the user sizes for a home server.
+
+### 2.4 #1517 handler file size (CONFIRMED)
+
+`crowdsec_handler.go` is 2,906 lines. Preset handlers live at lines ~990-1325 (`ListPresets`, `PullPreset`, `ApplyPreset`, `applyCuratedPreset`, `curatedPresetPreview`, `recordPresetEvent`, `applyFailureBody`, `respondApplySuccess`, `GetCachedPreset` at ~1426). Pure move, same package.
+
+### 2.5 #1518 tolerant Playwright tests (CONFIRMED)
+
+`tests/security/crowdsec-config.spec.ts` "Preset Management" block (lines ~73-145) and "Configuration Files" block are `isVisible().catch(() => false)` guarded and annotate "feature may not be implemented"; they cannot fail on a regression. `tests/security/crowdsec-preset-apply.spec.ts` (from #1513) is the model: route-stubs `**/api/v1/admin/crowdsec/presets/apply` and the file-write route and asserts toasts and write counts. Missing deterministic coverage: hub (non-curated) preset apply success/failure surfaced, no client-side write on any apply failure, file editor save/failure, file-list error cases.
+
+### 2.6 #1523 hub data files missing after container recreation (ROOT CAUSE CONFIRMED by experiment)
+
+- Config: CrowdSec's default `config_paths.data_dir` is `/var/lib/crowdsec/data/` and `hub_dir` is `/etc/crowdsec/hub/` (upstream `config/config.yaml`). The entrypoint (`.docker/docker-entrypoint.sh:310-319`) redirects **only** `db_path` to the volume. `Dockerfile:1089` creates `/var/lib/crowdsec/data` inside the image, so on a recreated container it is an empty directory (confirmed: the issue shows only `trace/`). `/etc/crowdsec` is a symlink into the volume so the **hub items persist but their data files do not**.
+- `configs/crowdsec/install_hub_items.sh` skips items for which `cscli <type> inspect <name>` exits 0 ("already installed, skipping").
+- Experiment (throwaway `charon:local` container run with `--entrypoint sh`, no volumes, no live host touched):
+  - Install `crowdsecurity/http-backdoors-attempts` -> `backdoors.txt` appears in `data_dir`.
+  - Wipe `data_dir` (simulating recreate), keep the hub: `cscli scenarios install <name>` -> "Nothing to install or remove", data dir stays empty. `cscli scenarios install --force <name>` -> same, still empty. **`cscli hub upgrade` repopulates `backdoors.txt`, and so does `cscli hub upgrade --force`.** The issue's suggestion "`install --force` or `hub upgrade`" is therefore half right: only `hub upgrade` works.
+- **Additional defect found (CONFIRMED, not in the issue):** on a hub with an index but nothing installed, `cscli scenarios inspect crowdsecurity/http-backdoors-attempts` exits **0** and prints `installed:false` metadata. `install_if_missing` uses the exit code, so on a fresh volume it may print "already installed, skipping" and install nothing. (In the experiment inspect exited 1 when the item was installed but its data file was missing, so the exit code is not a reliable installed/absent signal in either direction.) #1513's `ApplyCurated` already uses the correct signal: `inspect -o json` -> top-level `installed`.
+- Not confirmed: whether the missing-install path is masked in real startups by something else (e.g. the collections installing their children). Needs the recreate test in Commit 6 on a clean volume.
+
+### 2.7 #1524 empty version (ROOT CAUSE CONFIRMED; the fix has a gotcha)
+
+- Confirmed: the injected symbol is wrong. In CrowdSec v1.8.1, `pkg/cwversion/version.go` declares only `Codename` and `Libre2` (and no `Version`); the version comes from `github.com/crowdsecurity/go-cs-lib/version` (`Version`, `BuildDate`, `Tag`, `System`), pinned at `go-cs-lib v0.0.25` by CrowdSec v1.8.1's `go.mod`. Upstream's own Makefile uses `-X 'github.com/crowdsecurity/go-cs-lib/version.Version=$(BUILD_VERSION)'` (plus `BuildDate`, `Tag`, and `cwversion.Codename`). `-X` on a nonexistent symbol is silently ignored, so both `Dockerfile:915` and `:923` are no-ops. Observed in the built image: `cscli version` prints empty `version:`, `Codename:`, `BuildDate:`, and `cscli` logs `Crowdsec version is not set, using hub branch 'master'`.
+- The existing app-stage sanity check (`Dockerfile` ~L1054) says "CrowdSec 1.8.x prints an empty `version:` field here regardless of the -X ldflag". That comment is wrong and hides the bug; it must be corrected.
+- **Gotcha, verified in `cmd/crowdsec-cli/core/require/branch.go` (v1.8.1):** with a real version cscli calls `https://version.crowdsec.net/latest` on every hub command and returns a hard error if it cannot reach it; if the running version equals latest it uses `master` (identical to today), if it is older than latest it uses the branch named after the version. `https://hub-cdn.crowdsec.net/v1.8.1/.index.json` returns **404** today (v1.8.0, v1.7.8 and master return 200). So a correct version could (a) make `cscli hub *` fail offline/air-gapped and (b) break hub updates once 1.8.1 is no longer the latest and the CDN has no `v1.8.1` branch. The issue's "hub items may be newer than the engine supports" claim is also overstated: while 1.8.1 is the latest release the behavior is already `master`. The fix therefore needs an explicit hub-branch decision (see D1) rather than a bare `-X` correction.
+- The toolchain delivery path: the default Dockerfile build consumes the prebuilt `ghcr.io/wikid82/charon-toolchain` image (content-hash tag `CHARON_TOOLCHAIN_TAG`, `Dockerfile:22`). Editing the `crowdsec-inline` stage changes the key, `.github/workflows/toolchain-image.yml` builds the new image and its bot commits the new TAG/DIGEST onto the PR head branch (workflow lines ~365-420) so `verify-toolchain-pin` goes green. Until that happens the app image still contains the old binary, so the app-side assertion cannot be added in the same commit as the ldflags change.
+
+### 2.8 Reproduction/evidence commands run for this plan (all foreground, repo-local or throwaway container)
+
+`gh issue view` for each issue, `gh pr view 1513`; code reads listed above; `curl` of upstream v1.8.1 source files and `hub-cdn.crowdsec.net/<branch>/.index.json`; shallow clone of upstream v1.8.1 into the session scratchpad; throwaway `docker run --rm --entrypoint sh charon:local` experiments (data-dir wipe, inspect exit codes, `hub upgrade`). Nothing on live hosts or volumes was touched.
+
+## 3. Technical Specifications
+
+### 3.1 Shared backup helper, Apply flow, ImportConfig (#1515, #1516)
+
+New file `backend/internal/crowdsec/backup.go` (move `backupCopy`, `restoreCopy`, `isLiveDBFile`, `emptyDirExcept` out of `curated_apply.go`; the move itself changes no behavior):
+
+- **Two namespaces, two caps, so they cannot evict each other (blocking item 3).**
+  - Full-tree snapshots: backup dirs next to `DataDir`: `<DataDir>.backup.<ts>`, `const DefaultBackupRetention = 5`.
+  - Single-file edit backups (from `WriteFile`, section 3.2): backup dirs next to `DataDir`: `<DataDir>.filebackup.<ts>/<rel>`, `const DefaultFileBackupRetention = 10`. The `<base>.backup.*` glob never matches `<base>.filebackup.*`.
+- **Snapshot exclusions (blocking item 4).** `snapshot` copies `DataDir` (symlinks preserved) but **excludes**: the live `crowdsec.db`, `-wal`, `-shm` (anywhere), and the top-level `data/` directory (LAPI db plus hub data files and the GeoLite2 mmdb, which after #1523 live there; hub data files are recoverable with the gated `cscli hub upgrade`, the db is owned by the running engine) and the top-level `hub_cache/` (regenerable download cache). `restore` empties `DataDir` except those same excluded entries and copies the snapshot back, so it never touches `data/` or `hub_cache/`. Only the *top-level* `data/` and `hub_cache/` are excluded; a nested directory with the same name inside `config/` is still backed up. Result: a snapshot is essentially `config/` plus `bouncer_key` (small), x5 retained.
+- `func (s *HubService) snapshot() (path string, err error)`: microsecond timestamp name, created `0o700` with exclusive `os.Mkdir`.
+- `func (s *HubService) restore(path string) error`.
+- `func PruneBackups(dataDir, kind string, keep int) (removed []string, err error)` where `kind` is `backup` or `filebackup`. Lists siblings matching `<base>.<kind>.*`, `Lstat`-checks each is a real directory (never follows or deletes symlinks or plain files), **parses the timestamp from the directory name** (both the legacy `20060102-150405` and the microsecond `20060102-150405.000000` layouts; names that do not parse are ignored, never deleted), sorts newest first, deletes everything past `keep`. `keep < 1` is clamped to 1 so the newest is always kept. Never touches `dataDir`. Single-removal errors are logged and aggregated, never failing the caller.
+- **Prune runs after every attempt, successful or failed**, always preserving the newest `keep` snapshots. A failed apply's own snapshot is the newest, so it is always retained for manual recovery.
+
+**`HubService.Apply` new control flow (blocking item 2).** Hold `HubService.mu` and the handler-level lock (section 6).
+1. Validate slug; load cache meta (non-fatal).
+2. `snapshot()`; any error -> return failure, nothing changed. `BackupPath` is set only after success. The old "read the archive into memory before the backup because the cache lives in `DataDir`" workaround is **removed**: nothing is moved any more, and `hub_cache/` is excluded from snapshots and from restore, so the archive stays valid for the whole call.
+3. If `cscli` is available: `cscli hub update` (non-fatal), `cscli hub install <slug>`. Success -> status `applied`, `UsedCSCLI=true`, reload, prune, return.
+4. **A cscli failure still falls back to the cached-archive extract** (this keeps the offline/hub-unreachable behavior that exists today). Before extracting, `restore(snapshot)` so the extract starts from a clean pre-apply tree and any partial files `cscli` wrote are removed (this closes the partial-overlay risk of overlaying an archive on a half-installed state).
+5. Extract `extractTarGz` onto `DataDir` (cache refresh from the hub if the cache is missing, as today). **Residual risk, documented:** extraction overlays archive files on top of the live tree rather than replacing it, so files in the archive replace same-named live files; mitigation is the snapshot. Any extract/refresh failure -> `restore(snapshot)` and return the error with `BackupPath`.
+6. Success -> status `applied`, `UsedCSCLI=false`, reload, prune.
+`backupExisting`, `rollback`, `emptyDir`, and `copyDir` (if now unused) are deleted.
+
+**`CrowdsecHandler.ImportConfig` (blocking item 6): converted to snapshot/restore semantics, never renaming `DataDir`.** Flow: handler lock -> `snapshot()` -> empty `DataDir` except the snapshot-excluded entries (so the live db, `data/`, `hub_cache/` survive the import) -> extract the uploaded archive, **skipping any archive entry that is a live db file (`isLiveDBFile`) or lies under the top-level `data/` or `hub_cache/`** so an upload can never overwrite engine-owned state -> on any failure `restore(snapshot)` and return the error -> prune. Net behavior difference: the live db and `data/` are no longer moved or lost by an import; everything else is replaced exactly as before. Existing `ImportConfig` tests are updated, plus the new tests listed in Commit 3.
+
+### 3.2 File endpoints hardening (#1514)
+
+Details of the validation defects and their fixes are intentionally not written here (see section 4). Public-safe design:
+
+- New file `backend/internal/api/handlers/crowdsec_files.go` with a single shared path-resolution helper used by `ReadFile`, `WriteFile` and `ListFiles`, so all three apply one policy ("harden file-endpoint path validation").
+- Write policy: bounded body size (1 MiB); allowed file types (Q3); YAML files must parse; protected files and trees (secrets, databases, caches, engine data) are never writable; `.yaml/.yml` parsing uses `gopkg.in/yaml.v3` if already a dependency (verify).
+- **Symlink policy (blocking item 7):** the editor never writes through or replaces a symlink (HTTP 400), so symlinked hub items are read-only from the editor. Reads stay confined to `DataDir`, and symlinked hub items that resolve inside it stay readable. Test in Commit 4.
+- **Two predicates, not one.** The viewer today lists and reads any file under `DataDir` (hub items, `config.yaml`, etc.), and filtering the list by the write predicate would hide files users can currently read. So: `isReadable(rel)` governs `ListFiles` and `ReadFile` (secrets and databases such as `bouncer_key`, `*.db*`, and the `hub_cache/` and `data/` trees are neither listed nor readable; everything else stays visible, including symlinked hub items), and the stricter `isWritable(rel)` governs `WriteFile`. A file that is readable but not writable (symlinked hub items, non-allowlisted types) stays viewable and its save returns the server's 400 message, which the existing `writeMutation` error path already shows; no frontend contract change. `ExportConfig` is unaffected. Commit 4 tests: `ReadFile` refuses `bouncer_key` and db files, reads a symlinked hub item that resolves inside `DataDir`, and refuses a symlink resolving outside it; `ListFiles` omits them but still lists a symlinked hub item and `config.yaml`; every file `WriteFile` accepts is also listed.
+- `WriteFile` algorithm: lock -> validate -> if the target exists, copy just that file to `<DataDir>.filebackup.<ts>/<rel>` -> atomic write (temp file in the same directory, `fsync`, `rename`, preserve mode, default `0o600`) -> `PruneBackups(kind=filebackup, 10)` -> 200 `{status:"written", backup}`. `DataDir` is never renamed.
+- Error contract (JSON `{"error": ...}`): 400 invalid request / path / type / YAML / symlink, 413 too large, 500 write failure.
+- No new endpoints, no schema changes, no frontend contract changes.
+
+### 3.3 Frontend (#1514)
+
+`frontend/src/pages/CrowdSecConfig.tsx`: delete `applyPresetLocally`, the `501` branch in `handleApplyPreset`, the `applied-locally` apply-info status, and anything left unused (`backupMutation` if only used there, imports, `presetPreview` write path). Non-2xx apply for hub presets is surfaced like curated: server error text, backup path if present, no write. The generic file editor (`writeMutation`) is unchanged but now shows server 400/413 messages. Update Vitest files: `CrowdSecConfig.test.tsx`, `.coverage.test.tsx`, `.spec.tsx`, `.curatedApply.test.tsx` (remove tests that assert the local fallback; add "501 for a hub preset shows an error and performs no file write").
+
+### 3.4 Persistent CrowdSec data dir and hub data (#1523)
+
+`.docker/docker-entrypoint.sh` (next to the existing `db_path` redirect, ~L310-320):
+
+- `sed` `data_dir: /var/lib/crowdsec/data/` -> `data_dir: ${CS_DATA_DIR}/` in `$CS_CONFIG_DIR/config.yaml` (idempotent; works for both fresh and already-initialized volumes), with the same verify/echo pattern as the db redirect. `CS_DATA_DIR` is `/app/data/crowdsec/data` and is already `mkdir`ed and chowned.
+- **Gated, never unconditional (blocking item 5).** After `install_hub_items.sh`, the entrypoint runs `cscli hub upgrade` **only if** at least one installed item's data files are missing. Detection: for each installed item (`cscli <type> list -o json`), check that every file the item declares is present under `data_dir`; the exact JSON field for declared data files is confirmed by the implementer against `cscli <type> inspect <name> -o json` before coding (open implementation detail, verified in the Commit 6 gate). Fallback if the field is not exposed: treat an empty `data_dir` (ignoring `trace/` and the db) with at least one installed item as "missing". The call is bounded (`timeout 120s`), failure is a logged warning and never fatal, and it never uses `--force`. A normal restart with intact data files performs no upgrade, so items are never silently upgraded on a healthy start. Note `hub upgrade` upgrades every installed item; this is acceptable only in the recovery case it is gated on, and the log line must say so.
+- It is skipped in the same condition as the rest of hub init (`CHARON_SECURITY_TESTS_ENABLED=false`).
+
+`configs/crowdsec/install_hub_items.sh`: change `install_if_missing` to decide on `cscli <type> inspect <name> -o json` reporting `"installed": true`, matching `ApplyCurated.verifyItem`. **Verified:** `jq` is not in the `charon:local` image, so use `grep -q '"installed": *true'` (not jq). **Verified:** `inspect -o json` still prints full JSON and exits 0 when an item is installed but its data file is missing, so the JSON signal is reliable in exactly the recreate scenario (the plain-text `inspect` exit code was not). Keep the "failed to install" warnings non-fatal.
+
+`Dockerfile`: keep creating `/var/lib/crowdsec/data` (a stale `data_dir` on an un-migrated config must still exist); no other change.
+`.docker/compose/docker-compose.playwright-ci.yml:137` currently mounts a volume at `/var/lib/crowdsec/data`; repoint or remove it so E2E exercises the same persistent path as production. `docs/security.md` hardened-deployment text that tmpfs-mounts `/var/lib/crowdsec` stays valid (the db and data now live under `/app/data/crowdsec`) but its description must be updated.
+`scripts/diagnose-crowdsec.sh` default `DATA_DIR` updated to the new location.
+
+Optional passive health signal (Q4 resolved: log line only, no UI): log a startup summary line listing installed-but-missing data files. No banner or badge (Passive UI, no nudges).
+
+### 3.5 Version injection (#1524)
+
+`Dockerfile` `crowdsec-inline` stage (both `xx-go build` commands, ~L915 and ~L923): replace the ldflags with `-s -w -X github.com/crowdsecurity/go-cs-lib/version.Version=v${CROWDSEC_VERSION} -X github.com/crowdsecurity/go-cs-lib/version.BuildDate=<reproducible date or empty>`. Do not set `Tag` (empty `Tag` leaves `version.String()` equal to `Version`). Do not add `BuildDate` from the wall clock: that would break the content-addressed, reproducible toolchain key; prefer the release date derived from the pinned tag or omit it.
+
+App-side assertion (second commit, after the toolchain bot has pushed the new TAG/DIGEST to the PR branch): in the existing N5 `RUN` block (~L1054) replace the wrong comment and add `grep -q "^version: v${CROWDSEC_VERSION}\$"` against `cscli version`. The final stage must redeclare `ARG CROWDSEC_VERSION` (currently declared only globally at L41 and in the caddy/crowdsec-inline stages; a global ARG is not visible inside a later stage without redeclaring). The build fails if the symbol ever silently no-ops again.
+
+Hub branch (decision D1, recommended): set `cscli.hub_branch` explicitly in the entrypoint-managed `config.yaml` so behavior is deterministic and does not depend on `version.crowdsec.net` reachability or on `hub-cdn` having a `v1.8.1` branch. Verified in upstream v1.8.1 `chooseBranch`: a non-empty `cscli.hub_branch` is returned immediately, before the `version.crowdsec.net/latest` lookup, so setting it removes both the network dependency and the CDN-404 risk. The online/offline test result is recorded in the PR description (Commit 8 gate).
+
+### 3.6 Handler split (#1517)
+
+Move to `backend/internal/api/handlers/crowdsec_preset_handler.go` (same package, no behavior change, no export changes): `ListPresets`, `PullPreset`, `ApplyPreset`, `applyCuratedPreset`, `curatedPresetPreview`, `recordPresetEvent`, `applyFailureBody`, `respondApplySuccess`, `GetCachedPreset`, and preset-only helpers. Move the matching unit tests into `crowdsec_preset_handler_test.go` files where they are clearly preset-only (leave shared fixtures where they are). `RegisterRoutes` stays in `crowdsec_handler.go`. The new file must be < 700 lines.
+
+## 4. Priorities & Ordering (CLAUDE.md "Findings Triage")
+
+None of the seven issues is user-submitted (all filed by the maintainer from PR #1513). Rules applied: bug fixes before new implementation (there is no `feat` here); critical/high ships as its own PR first; medium/low is scheduled after.
+
+Severity after root-causing (some differ from the issue labels):
+
+| Rank | Issue | Severity | Why |
+|------|-------|----------|-----|
+| 1 | #1523 data files missing after recreate | **medium** (issue says medium) | Silent degraded detection and no GeoIP on every recreated container; install guard defect makes fresh volumes suspect. Highest user impact. |
+| 2 | #1514 + `WriteFile` destructive rename | **medium** (raised from low-medium) | Admin action can wipe the live CrowdSec tree; weak input validation. Security-sensitive (below). |
+| 3 | #1515 `HubService.Apply` rename | **low-medium, confirmed** | Same defect class and same helper as #1514/#1516; fixed together. |
+| 4 | #1524 empty version / hub branch | **low-medium** | Fix is easy but changes runtime hub behavior (offline failure, CDN 404 risk); needs the D1 decision and the toolchain bot. Scheduled after the fixes it must not destabilize. |
+| 5 | #1516 backup accumulation | low | Piggybacks on the shared helper. |
+| 6 | #1518 tolerant E2E | low | Test hardening; first in commit order (as `fixme` specs) and enabled last. |
+| 7 | #1517 handler split | low | `refactor`, no behavior change; sequenced first in the *commit* order (mechanical, makes later diffs reviewable) but lowest in *priority*. |
+
+No finding is critical or high, so none must ship as its own PR ahead of this work. Priority above governs attention and what to cut first under contingency; commit order in section 5 is dependency-driven.
+
+**Security handling (#1514).** It is admin-only and already public as an issue. Assessment: low severity (authenticated admin only; the endpoint grants nothing beyond what an admin already has). **Q2 resolved by the user: #1514 is already public, so no private advisory is opened unless root-causing shows real impact beyond what an admin already has; it does not, so the default is NO advisory.** Handling:
+- The existing public issue #1514 stays as is. Keep PR text, commit bodies and code comments free of exploit specifics anyway (no value in handing detail to un-upgraded installs).
+- Exactly one commit in the PR carries the `(security)` scope, and its subject must stay in the vague category-only form: `fix(security): harden CrowdSec configuration file handling`. Keep the subject category-only, and Commit 4's body and the PR description stay equally vague (for example "tighten validation in the CrowdSec configuration file endpoints"). Every commit subject in a feature PR merge-commit appears verbatim in the public changelog, so the other commits use plain scopes (`fix:`, `refactor:`, `test:`, `docs:`, `chore:`) and describe user-visible behavior only. The destructive-rename data-loss fix is a plain `fix:` (it is a reliability bug, not an exploit).
+
+**Out-of-scope findings discovered while planning:** none left open. Items found beyond the issue text are folded in (install guard, wrong N5 comment, `ImportConfig` conversion, playwright-ci compose mount). If implementation finds anything else, file it per the triage rule at that time.
+
+## 5. Branch/PR Decision and Commit Slicing Strategy
+
+### 5.1 Branch/PR decision: ONE branch, ONE PR
+
+Single branch `fix/crowdsec-preset-apply-hardening` -> PR into `development`, titled e.g. `fix: harden CrowdSec preset apply and keep hub data across container recreation`.
+
+Why one PR (cohesion): all seven issues are one defect family, "the CrowdSec persistent tree is mutated unsafely and its hub/data state is not durable", and they share code: #1514, #1515 and #1516 all consume the same new `backup.go` helper (a single fix for rename-based backups, the file endpoint, and pruning); #1517 is the file those changes land in; #1518 is the test net for #1514/#1515; #1523 and #1524 are the same persistent-dir/hub-state story at the container layer and are both verified by the same rebuilt-container gate. Splitting would leave the helper without its callers, the E2E net without the behavior, or a half-fixed persistence story.
+
+Considered splits and why rejected:
+- Docker/entrypoint (#1523, #1524) vs Go/frontend: they can build independently, but they do not conflict, share a single verification environment (rebuilt `charon:local`), and splitting would double the merge-soak the maintainer applies before `main`. The #1524 toolchain bot is explicitly designed to push the pin bump onto the PR head branch, so it works inside this PR.
+- `(security)` fix alone: not required; severity is low (authenticated admin), and the rule "own PR" applies to critical/high only.
+
+**Contingency without splitting:** if Commits 7-8 (#1524) cannot be validated (hub-branch decision unresolved, toolchain build blocked), drop those commits from the PR and leave #1524 open rather than opening a second PR for it; the remaining six issues still form a complete, coherent PR. Rollback of the PR as a whole is a revert of the merge commit; a revert leaves a valid `data_dir` in `config.yaml` (the old image still creates the default directory), so nothing breaks.
+
+### 5.2 Ordered commits (all on the one branch)
+
+Every command run by implementers is foreground/blocking per CLAUDE.md. Each commit must build and pass its gate; the PR as a whole passes the full Definition of Done (section 8).
+
+**Commit 1 - `test: add deterministic E2E specs for CrowdSec preset and file flows (fixme)`** (#1518, step 1 of the suggested sequence)
+- Files: new `tests/security/crowdsec-hub-preset-apply.spec.ts`, new `tests/security/crowdsec-file-editor.spec.ts`.
+- Content, all stubbed with `page.route` like `crowdsec-preset-apply.spec.ts`, marked `test.fixme` until their feature commits: hub preset apply success shows success only when body `status==='applied'`; hub preset apply 500/503/504 shows an error and **zero** `POST /admin/crowdsec/file` calls; hub preset apply 501 shows an error and zero writes; file editor save success posts exactly one write for exactly the selected path; file editor shows the server message for 400 (disallowed type / invalid YAML) and 413.
+- Depends on: none. Gate: `npx playwright test tests/security/crowdsec-hub-preset-apply.spec.ts tests/security/crowdsec-file-editor.spec.ts --project=security-tests` runs and reports the tests as fixme/skipped with no failures; lint/type-check clean.
+
+**Commit 2 - `refactor: move CrowdSec preset handlers into their own file`** (#1517)
+- Files: new `backend/internal/api/handlers/crowdsec_preset_handler.go`; edit `crowdsec_handler.go`; move/split preset-only tests into `crowdsec_preset_handler_test.go`.
+- Pure move: no signature, route, or behavior changes. Depends on: none.
+- Gate: `cd backend && go build ./... && go test ./internal/api/handlers/... -race` all green with the same test count; `git diff --stat -M` shows moves, not rewrites; `make lint-fast`.
+
+**Commit 3 - `fix: keep CrowdSec backups bounded and copy-based for preset apply`** (#1515, #1516)
+- Files: new `backend/internal/crowdsec/backup.go` + `backup_test.go`; edit `hub_sync.go` (`Apply` per the flow in 3.1; remove `backupExisting`/`rollback`/`emptyDir`/dead `copyDir`), `curated_apply.go` (move helpers, add prune call), `crowdsec_handler.go` `ImportConfig` (snapshot/restore conversion, handler lock), `hub_pull_apply_test.go`, `device_busy_test.go` (the rename/EBUSY tests are obsolete and are replaced by copy-path tests).
+- Depends on: Commit 2 (preset code already in its own file; `ImportConfig` stays in the main handler).
+- Unit tests (new, all with `t.TempDir()`): snapshot excludes live db files, top-level `data/` and `hub_cache/`, preserves symlinks, and still copies a nested directory named `data` under `config/`; **size test:** a large file under `data/` and under `hub_cache/` is not copied while a small `config/` file is (assert snapshot size); restore leaves live db, `data/` and `hub_cache/` untouched; `PruneBackups` orders by the timestamp parsed from the name (not mtime; touching an old dir does not save it), handles both name layouts, ignores unparsable names, non-matching names, symlinks and plain files, never deletes `dataDir`, clamps `keep<1` to 1, always keeps the newest, handles a missing parent, and `backup` and `filebackup` namespaces never evict each other; `HubService.Apply` flows: (a) cscli success leaves `DataDir` in place (inode unchanged) and prunes; (b) **cscli failure -> snapshot restored -> cached-archive extract succeeds -> `applied`, `UsedCSCLI=false`, no cscli leftovers**; (c) cscli failure and extract failure -> snapshot restored, error returned with `BackupPath`; (d) cscli failure with cache miss and hub refresh failure -> restored; (e) prune also runs after a failed apply and keeps the failed apply's snapshot; `ImportConfig`: success replaces config but preserves live db/`data/`/`hub_cache/` and never renames `DataDir`; extract failure restores the previous config; prune runs; concurrent `ImportConfig` + apply serialize on the handler lock; an uploaded archive containing `crowdsec.db`, `data/x` and `hub_cache/y` entries extracts none of them.
+- Gate: `go test ./internal/crowdsec/... ./internal/api/handlers/... -race`; package coverage not below the current level; **rebuilt-container verification of #1515**: pull + apply one hub preset against a running agent, confirm `/app/data/crowdsec` is never renamed (inode unchanged), the apply result is correct, and at most 5 full-snapshot dirs remain after 7 applies (this also settles the "not confirmed" item in 2.2).
+
+**Commit 4 - `fix(security): harden CrowdSec configuration file handling`** (#1514 backend; subject intentionally vague, see section 4)
+- Files: new `backend/internal/api/handlers/crowdsec_files.go` + `crowdsec_files_test.go`; edit `crowdsec_handler.go` (`ListFiles`, `ReadFile`, `WriteFile` delegate to the shared helper); update existing `TestCrowdsec_WriteFile_*` tests in `crowdsec_handler_coverage_test.go`.
+- Depends on: Commit 3 (per-file backups use the `filebackup` namespace and handler lock). Commit body and PR text stay vague (section 4).
+- Unit tests (categories only here): path validation rejection cases, symlink policy (write through or replacement of a symlink is refused, a regular file under `DataDir` is written), type/content/size validation (disallowed type, invalid YAML, oversize -> 413, protected files), atomic write leaves no temp file on failure, `DataDir` and unrelated files untouched after a write (regression test for the destructive rename), `filebackup` contains only the previous version of the target and is capped independently of full snapshots, the read/list predicate and the stricter write predicate behave as in 3.2, `ReadFile` shares the validation.
+- Gate: `go test ./internal/api/handlers/... -race`, `make lint-fast`; GORM scan not required (no models); the Playwright file-editor spec enabled in Commit 9 depends on this behavior.
+
+**Commit 5 - `fix: remove the dead local-write fallback from CrowdSec preset apply`** (#1514 frontend)
+- Files: `frontend/src/pages/CrowdSecConfig.tsx`, its four test files under `frontend/src/pages/__tests__/`, `frontend/src/api/crowdsec.ts` only if a now-unused export remains.
+- Depends on: none technically (the backend never returns 501); ordered after Commit 4 so the whole #1514 story is reviewable in sequence.
+- Gate: `cd frontend && npm run type-check && npx vitest run src/pages/__tests__/CrowdSecConfig*` green; no unused-export/lint findings; `npm run build`.
+
+**Commit 6 - `fix: persist CrowdSec hub data files across container recreation`** (#1523)
+- Files: `.docker/docker-entrypoint.sh`, `configs/crowdsec/install_hub_items.sh`, `.docker/compose/docker-compose.playwright-ci.yml`, `scripts/diagnose-crowdsec.sh`, `docs/security.md` (wording), new integration test `scripts/crowdsec_data_persistence_test.sh` (follows the pattern of `scripts/crowdsec_startup_test.sh`).
+- Depends on: none (independent of the Go commits; ordered after so a failing container gate does not block the Go work from being reviewed).
+- Tests: shell-level test (start container with a named volume, wait for hub init, assert data files and `GeoLite2-City.mmdb` exist under `/app/data/crowdsec/data`, `docker rm` and recreate with the same volume, assert files are present and `crowdsec.log` has no `unable to init data for file` / `unable to initialize GeoIP` lines after enabling CrowdSec; also run it on a volume initialized by the old image to prove the sed migration). Add `shellcheck` cleanliness for changed scripts.
+- Gate: rebuild `charon:local` (skill `docker-rebuild-e2e` / `.github/skills/scripts/skill-runner.sh docker-rebuild-e2e`), run `scripts/crowdsec_data_persistence_test.sh` and `scripts/crowdsec_startup_test.sh`; the fresh-volume case must show the install guard now really installing.
+- Additional tests: the gate must prove `hub upgrade` is **not** run on a restart with intact data files (log assertion) and **is** run (once, bounded) when data files are missing; `shellcheck` is a required gate for every changed or new shell script (`.docker/docker-entrypoint.sh`, `install_hub_items.sh`, the new test script).
+- CI wiring and ignore files: wire `scripts/crowdsec_data_persistence_test.sh` into the existing CrowdSec integration job via a skill wrapper like `.github/skills/integration-test-crowdsec-startup-scripts` and the `integration-tests.yml` workflow (rather than a new workflow). Check `.dockerignore` (it already excludes `scripts/tests/` and the toolchain scripts; the new script must be excluded from the image the same way if it lives under `scripts/`), `.gitignore`, and `.codecov.yml` (shell scripts are not coverage-measured; confirm no new exclusion needed).
+- Snapshot interaction (item 4 sequencing): Commit 3's snapshot already excludes top-level `data/` and `hub_cache/`, so Commit 6's relocation of `data_dir` into `/app/data/crowdsec/data` does not enlarge any backup; the Commit 3 size test is the regression guard.
+
+**Commit 7 - `fix: report the real CrowdSec version in the bundled binaries`** (#1524, step A: ldflags)
+- Files: `Dockerfile` (`crowdsec-inline`, both `xx-go build` lines). Bot-authored follow-up commit on the branch updates `CHARON_TOOLCHAIN_TAG` / `CHARON_TOOLCHAIN_DIGEST` (do not hand-edit those lines; the workflow owns them).
+- Depends on: none. **Wait here until the toolchain-image workflow has built and pushed the pin bump to the PR branch** (this is the only asynchronous step in the plan).
+- Gate: `toolchain-image.yml` green on the PR (build + Trivy gate), `verify-toolchain-pin` green, and a local `make build-offline`-style build (`--build-arg CROWDSEC_BUILDER_SRC=crowdsec-inline`) shows `cscli version` -> `version: v1.8.1`.
+- Expected CI state: after this commit `verify-toolchain-pin` (and any check that compares TAG/DIGEST to the recipe key) is **red until the bot pushes the new pin**. Implementers must `git pull` the bot's commit before starting Commit 8 and must not hand-edit the two ARG lines.
+
+**Commit 8 - `fix: fail the image build if CrowdSec reports no version and make the hub branch deterministic`** (#1524, step B)
+- Files: `Dockerfile` (N5 block: correct the comment, add the version assertion, add `ARG CROWDSEC_VERSION` to the final stage), `.docker/docker-entrypoint.sh` (hub branch setting per D1).
+- Depends on: Commit 7 and the bot pin bump.
+- Tests / build-time assertion: the Dockerfile `RUN` fails with a clear message if `cscli version` does not print `version: v${CROWDSEC_VERSION}`. Prove it fails by temporarily building with a mismatched `--build-arg CROWDSEC_VERSION` against the pinned toolchain (expected hard failure), then with the correct value (pass). Runtime check in the rebuilt container: `cscli version` truthful; `cscli hub update` succeeds online; with the network blocked (`--network none`) hub commands behave as the D1 decision specifies (no hard failure when `hub_branch` is set).
+- Gate: image builds; `scripts/crowdsec_startup_test.sh` green; both stderr lines `Crowdsec version is not set` and `unable to retrieve latest crowdsec version` absent from `docker logs` in the online and offline runs.
+- Record in the PR description: `cscli.hub_branch` is honoured by v1.8.1 and skips the `version.crowdsec.net` lookup (source-verified in `chooseBranch`), plus the measured online and offline (`--network none`) results.
+
+**Commit 9 - `test: enable CrowdSec preset and file-editor E2E specs and drop tolerant ones`** (#1518, final step)
+- Files: the two specs from Commit 1 (remove `fixme`), `tests/security/crowdsec-config.spec.ts` (delete the tolerant "Preset Management" assertions that are now covered by deterministic specs, or convert each remaining case to a deterministic stub; no `isVisible().catch(() => false)` guards, no "feature may not be implemented" annotations remain in `tests/security/crowdsec-*.spec.ts`).
+- Depends on: Commits 4 and 5.
+- Gate: `npx playwright test tests/security/crowdsec-hub-preset-apply.spec.ts tests/security/crowdsec-file-editor.spec.ts tests/security/crowdsec-preset-apply.spec.ts tests/security/crowdsec-config.spec.ts --project=security-tests` green. Mutation check: temporarily re-add the local-write fallback (or revert the success-status check) and confirm at least one of the new specs fails, then undo. Full-suite and cross-browser runs are CI-only.
+
+**Commit 10 - `docs: document CrowdSec preset apply safety and data persistence`**
+- Files: `ARCHITECTURE.md`, `docs/features/crowdsec.md`, `docs/troubleshooting/` entry if appropriate (see 7).
+- Depends on: all. Gate: markdown lint/pre-commit; `docs-site` manifest unchanged (new content goes into already-manifested `docs/features/` / `docs/troubleshooting/`).
+
+## 6. Decisions and Edge Cases
+
+- **D1 hub branch (Q1 resolved: option A).** Options: (A, recommended) set `cscli.hub_branch: master` explicitly: identical to today's effective behavior while 1.8.1 is the latest, no dependency on `version.crowdsec.net`, no 404 risk, truthful `cscli version`. (B) Leave auto-selection with the fixed version: matches upstream's intent but can hard-fail hub commands offline and break hub updates when 1.8.1 stops being latest and the CDN has no `v1.8.1` branch (404 today). (C) Pin to the version branch: broken today (404). Commit 8 gate must run the empirical online/offline test either way.
+- **Locking (one mechanism).** A single handler-level `sync.Mutex` on `CrowdsecHandler` (e.g. `dataMu`) is held for the whole of `ApplyPreset` (both curated and hub paths), `ImportConfig` and `WriteFile`. `HubService.mu` remains as an inner guard for direct service callers; lock order is always handler mutex first, then `HubService.mu`, so no deadlock. No other lock is introduced.
+- Edge cases to cover in tests: snapshot dir name collisions (microsecond timestamp plus exclusive `os.Mkdir`), parent dir not writable, `DataDir` being a mount point (the copy path must work where rename used to fall back), symlinks inside `DataDir` never followed by restore/prune/write, concurrent apply/import/file write serialized by the handler mutex (held for the full `ApplyTimeout`, so file saves block during a long apply; `ReadFile` and `ListFiles` stay lock-free), CrowdSec stopped, existing volumes whose `config.yaml` still points at `/var/lib/crowdsec/data` (sed migration, then the gated `hub upgrade` repopulates), tmpfs `/var/lib/crowdsec` deployments (no longer relevant for data after migration).
+- Reload behavior from #1513 (SIGHUP via `reloadCrowdSec`) is unchanged and should also be triggered, best-effort, after the entrypoint-independent hub changes that happen at runtime only (not applicable to startup).
+
+## 7. Docs Impact
+
+- `ARCHITECTURE.md`: update the Layer 2 CrowdSec section (~L868-890): CrowdSec `data_dir` and LAPI db live under `/app/data/crowdsec/data` (persistent), hub data files are re-synced when missing via a gated `cscli hub upgrade`, preset applies and config edits are copy-based/atomic with bounded backup retention, `cscli version` reports the pinned version and the hub branch is explicit. The file layout table around L288-294 gets the data subdirectory note.
+- `docs/features/crowdsec.md`: extend "Curated Presets" (L57-59) / Hub Presets with the backup retention (last N kept), that hub presets are also applied on the server with a rollback, and that the config editor only accepts specific file types with validation. Add a short troubleshooting entry for the `unable to init data for file` log line (what it meant, that it self-heals on restart after this release). Keep it novice-friendly.
+- `docs/features.md`: no new capability; no change expected (confirm during Commit 10).
+- `docs/security.md`: tmpfs `/var/lib/crowdsec` guidance wording (Commit 6).
+- Changelog is generated from commit subjects; subjects in section 5.2 are written for that.
+
+## 8. Test Plan Summary and Definition of Done
+
+- **Backend unit:** new tests in Commits 3 and 4 (list above). Coverage: package and patch coverage must not drop; overall >= 85% (`scripts/go-test-coverage.sh`); `bash scripts/local-patch-report.sh` produces `test-results/local-patch-report.md/.json`.
+- **Frontend unit:** updated Vitest in Commit 5; `scripts/frontend-test-coverage.sh` >= 85%; `npm run type-check`; `npm run build`.
+- **Playwright (#1518):** deterministic stubbed specs per Commit 1/9, role-based locators, no `waitForTimeout`, no visibility-guard skips. Locally only the targeted spec files with `--project=security-tests` (security specs are excluded from the browser projects; other specs use `--project=firefox`); CI runs the full matrix.
+- **Build-time assertion (#1524):** Dockerfile `RUN` check in Commit 8 with the negative (mismatched version) and positive proof recorded in the PR description.
+- **Container integration:** `scripts/crowdsec_data_persistence_test.sh` and `scripts/crowdsec_startup_test.sh` (Commit 6/8).
+- **Security scans:** this is a `fix:` with no new endpoints; CodeQL/Trivy are deferred to CI per CLAUDE.md, except that Commit 7's toolchain Trivy gate runs in CI by design. GORM scan not required (no model changes); run it only if a model is touched.
+- **Full DoD checklist before merge (in order):** targeted Playwright (firefox) -> patch coverage preflight -> `lefthook run pre-commit` -> staticcheck (`make lint-fast`) -> backend/frontend coverage -> type-check -> `go build ./...` and `npm run build` -> clean-up (no debug prints, dead code, unused imports). Any failing test, even pre-existing, is fixed in this PR.
+- **Pipeline after the plan:** Supervisor plan review -> user approval -> implement commit by commit (`backend-dev` for 2-4, `frontend-dev` for 5, `devops` for 6-8, `playwright-dev` for 1 and 9, `docs-writer` for 10) -> Supervisor implementation review -> `qa-security` last -> `docs-writer` pass.
+- **Dispatch instructions (every subagent prompt must include these, verbatim in spirit):** run all tests, builds, coverage scripts, Playwright, linters, Docker builds and `lefthook` as **foreground, blocking** calls with the maximum timeout; never use `run_in_background`, `&`, `nohup` or end the turn waiting for a notification; if a call auto-backgrounds, immediately re-attach and poll until a real result; no worktrees; stay inside the repo (no live hosts); do not commit unless the orchestrator says so; Commit 4's text (body, comments, PR text) must stay vague per section 4; and the Commit 7 to Commit 8 hand-off requires pulling the toolchain bot's commit first.
+
+## 9. Acceptance Criteria
+
+1. Applying a hub preset or editing a CrowdSec file never renames, empties or removes `/app/data/crowdsec`; the live tree is intact after success and after any failure (tests prove it).
+2. Full-tree snapshot dirs (`<DataDir>.backup.*`) are bounded to 5 and single-file edit backups (`<DataDir>.filebackup.*`) to 10, independently, after any apply/import/write attempt; snapshots exclude `data/` and `hub_cache/` so they stay small.
+3. `POST /admin/crowdsec/file` validates paths, file types, YAML and size, refuses symlink writes, never renames `DataDir`, and `ReadFile`/`ListFiles` share the same validation; the frontend has no local-write fallback.
+4. After `docker rm` + recreate with the same volume, the 12 listed hub data files and `GeoLite2-City.mmdb` exist and `crowdsec.log` has no `unable to init data` / GeoIP lines; fresh volumes actually install the items in `install_hub_items.sh`.
+5. `cscli version` and `crowdsec -version` print `v1.8.1`; the image build fails if they do not; hub commands work online and offline per D1.
+6. `crowdsec_handler.go` no longer contains the preset handlers; no behavior change from the move.
+7. No tolerant "may not be implemented" Playwright tests remain for CrowdSec presets, and the mutation check in Commit 9 shows the new specs fail on regression.
+8. Only one commit uses the `(security)` scope and its subject is the vague form above.
+
+## 10. Resolved Questions (all decided by the user)
+
+- Q1 (D1): RESOLVED: explicit `cscli.hub_branch: master`.
+- Q2: RESOLVED by the user: no private advisory (issue is public; severity low, admin-only). Revisit only if implementation finds impact beyond admin privileges.
+- Q3: RESOLVED: write allowlist, protected-file list, 1 MiB cap and the refuse-symlinks rule as specced in 3.2, with a separate looser read/list predicate.
+- Q4: RESOLVED: startup log line only (no diagnostics field, no UI).
+- Q5: RESOLVED: constants (5 full snapshots, 10 file backups), not configurable.
diff --git a/docs/plans/current_spec.md b/docs/plans/current_spec.md
index 5be618358..ef4d3446b 100644
--- a/docs/plans/current_spec.md
+++ b/docs/plans/current_spec.md
@@ -1,286 +1,189 @@
-# Plan: CrowdSec preset-apply and data/hub persistence hardening (follow-ups of PR #1513)
+# CrowdSec Follow-ups Batch: #1479, #1481, #1526, #1528
 
-Type: ONE branch, ONE PR into `development`: `fix/crowdsec-preset-apply-hardening`. Medium/large fix (touches Go backend, React frontend, Dockerfile, entrypoint, E2E, docs), so per CLAUDE.md it gets a dedicated branch and PR, never a direct commit to `development`.
-Closes: #1514, #1515, #1516, #1517, #1518, #1523, #1524.
-Status: rev 2 (addresses Supervisor CHANGES REQUESTED: 7 blocking items), open questions Q1-Q5 resolved by the user.
-Predecessor: the #1513 plan (curated preset apply) that previously lived in this file; it merged as `3a76804b`.
+Status: DRAFT rev 2 (supervisor changes applied) for re-review. Uncommitted. Separate from `docs/plans/current_spec.md`.
+Base: `origin/development`, which already includes #1525 (113f646c). All line numbers below were re-verified against it; re-verify again immediately before implementation.
 
 ## 1. Introduction
 
-PR #1513 made curated CrowdSec presets server-authoritative. While verifying it in a rebuilt container, seven follow-ups were filed. They share one theme: **the CrowdSec preset/hub apply path and the persistent CrowdSec directory (`/app/data/crowdsec`) are not safe or durable**. Backups are taken by renaming the live directory, a generic file-write endpoint also renames the live directory, hub data files live on an ephemeral path, the bundled binary does not know its own version, and the tests that should guard this are tolerant skips.
+Four open issues, all authored by the maintainer (none is user-submitted), all low severity:
+
+| Issue | Type | Area | Summary |
+|---|---|---|---|
+| #1528 | fix / product decision | backend (+ small frontend) | F1 archive entry check too broad, F3 absolute server paths in CrowdSec responses, F5 credentials YAML files still listed/readable in the editor |
+| #1479 | hardening | backend `network` pkg | `WithAllowedDomains` option stores a list nothing reads |
+| #1481 | cleanup | backend `crowdsec` pkg | production hub URL validator carries test-only host allowances |
+| #1526 | test | Playwright | tolerant CrowdSec specs can pass without asserting the feature works |
 
-Goal: after this PR, applying/editing CrowdSec config can never destroy the live config, hub data files survive container recreation, `cscli version` is truthful, backups are bounded, and E2E/unit tests fail when any of this regresses.
+### Is #1479 CrowdSec-specific?
+No. The option lives in the generic `backend/internal/network/safeclient.go` (`ClientOptions.AllowedDomains`, `WithAllowedDomains`). The `crowdsec` label is there only because its single production caller is `newHubHTTPClient` in `backend/internal/crowdsec/hub_sync.go`. It is included because it was found in the same investigation as #1481 (#1476) and the right fix for #1481 (one validator, no test allowances in production) determines the right fix for #1479 (remove the unused option so `validateHubURL` is the only allowlist).
 
-## 2. Research Findings (root cause per issue, CLAUDE.md "Context First")
+## 2. Research Findings
 
-Key facts established from code (all paths verified in this repo):
+### 2.1 #1479 `WithAllowedDomains`
+- Stored in `ClientOptions.AllowedDomains`; `safeDialer` and `validateRedirectTarget` never read it. Its doc comment ("only these domains will be allowed") is false: a latent footgun.
+- Only production caller: `newHubHTTPClient` (hub_sync.go). That client uses default `MaxRedirects` 0, so redirect enforcement is moot. `validateHubURL` already holds its own copy of the same three hosts, so two lists exist and neither is authoritative.
+- **Three test references** in `backend/internal/network/safeclient_test.go` must change, otherwise compilation breaks when the field is removed:
+  1. `TestSafeDialer_AllowedDomains` (~L153-175): sets `AllowedDomains` on options and asserts nothing about them. Dead test. **Delete.**
+  2. `TestNewSafeHTTPClient_WithAllowedDomains` (~L291): **Delete.**
+  3. ~L849 (`WithAllowedDomains("example.com", "api.example.com")` inside a larger test): **Edit** to drop the option only; keep the rest of the test.
+- Redirect/option parity (the issue's second ask): `safeDialer` and `validateRedirectTarget` both go through `opts.policy()` / `AddressPolicy.Blocked`, so `AllowLocalhost`/`AllowRFC1918`/`AllowCGNAT` already behave identically. Pin that with one table test running the same host/option matrix through both rather than changing behavior.
+
+### 2.2 #1481 test-only allowances
+- `validateHubURL` (hub_sync.go ~L106-160) accepts at any scheme (http included): `localhost`, `127.0.0.1`, `::1`, `*.example.com`, `*.example`, `example.com`, `*.local`, `test.hub`, before the HTTPS + three-host allowlist check (`hub-data.crowdsec.net`, `hub.crowdsec.net`, `raw.githubusercontent.com`).
+- Production impact (for a docs/changelog note): an operator-set `HUB_BASE_URL`/`HUB_MIRROR_BASE_URL` using http, localhost or `.local` already fails at the dial layer (`network.NewSafeHTTPClient` blocks loopback/private), so tightening the validator changes the error text and where it is raised, not what works. No supported configuration breaks. Mention in release notes in one sentence.
+- Existing seam: package var `hubAllowLoopback` (~L95), toggled by `setHubAllowLoopbackForTest` (hub_sync_test.go ~L2252) and exercised by `TestNewHubHTTPClient_LoopbackSeam` (~L2258).
+- **Only 2 `httptest.NewServer` uses** exist in the crowdsec package tests: `hub_sync_test.go` ~L106 and ~L2259 (the latter is inside `TestNewHubHTTPClient_LoopbackSeam`). Everything else uses a stub `RoundTripper` with fake hostnames.
+- Test reference sizing: roughly 100-110 hits of `test.hub`/`example.com`/`.local`/`hub.example` across `hub_pull_apply_test.go`, `hub_sync_test.go`, `hub_sync_raw_index_test.go`, and the handler package (`crowdsec_preset_handler_test.go`, `crowdsec_pull_apply_integration_test.go`); re-grep before starting and do not rely on exact figures. Handler tests are in `package handlers`, cannot reach an unexported field, and embed hosts in index JSON fixtures such as `download_url`/`preview_url`.
+- `hubBaseCandidates()` (~L215) builds `[HubBaseURL, MirrorBaseURL, defaultHubMirrorBaseURL, defaultHubBaseURL]` and de-duplicates with `uniqueStrings`. The defaults are `https://hub-data.crowdsec.net` and `https://raw.githubusercontent.com/crowdsecurity/hub/master`. If migrated tests reuse those same hosts for the primary/mirror roles, candidates collapse via `uniqueStrings` and fallback-order tests silently change meaning.
+
+### 2.3 #1528
+- **F1**: `extractTarGz` (hub_sync.go ~L946) uses `strings.HasPrefix(cleanName, "..")`, which also rejects legitimate names like `..hidden.yaml`. The containment check below it (`filepath.Rel`, ~L955) already uses `".."+separator`, so the first check is redundant-but-stricter.
+- **F5**: `isReadable` (crowdsec_files.go ~L79) hides `bouncer_key`, `*.db*` and engine-owned trees, but `local_api_credentials.yaml` and `online_api_credentials.yaml` are only in `protectedWriteNames` (write-protected; still listed and readable). Real error messages today: reads of a hidden path return `invalid path` (`resolveReadable` first check ~L128, and the resolved-path re-check ~L149); writes of a hidden path return `file cannot be edited` (`resolveWritable` ~L167-169, `errFileCannotBeEdited`). Mixed-case names: `isReadable` lowercases the base only for the `bouncer_key` and `*.db*` checks, so once the credentials names are added to its deny rules (using the same lowercase comparison) mixed-case variants become hidden too, a deliberate tightening. Nothing in `frontend/src` or the Playwright specs references the credentials files; `docs/troubleshooting/crowdsec.md` (~L644) stays valid.
+- **F5 scope limit: `ExportConfig` is not covered.** `ExportConfig` (crowdsec_handler.go ~L810-880) walks the whole `DataDir` and tars it with no `isReadable` filter (it only skips symlinks), so credentials files and `bouncer_key` remain downloadable by an authenticated admin through the export endpoint. The "consistent with `bouncer_key`" argument therefore applies to the editor list/read surface only, not to export.
+- **F3 leak sites** (all admin-authenticated; absolute server paths or archive entry names reach the client):
+  1. File write `backup` field: `crowdsec_files.go` ~L415 (from `crowdsec.BackupFile`, kind `filebackup`, a directory).
+  2. Import `backup` field: `crowdsec_handler.go` ~L727 (from `Snapshot`, kind `backup`, a directory).
+  3. Preset apply: `crowdsec_preset_handler.go` ~L353 and ~L365 (`res.BackupPath`).
+  4. Acquisition update: `crowdsec_handler.go` ~L2030 (`backupPath`, a **file** named `acquis.yaml.backup.<ts>`, not a directory).
+  5. `rollbackFailure` (crowdsec/backup.go ~L291-293): message `"... (rollback failed: %v; backup retained at %s)"` flows via `err.Error()` into the preset-apply and curated-apply JSON error responses.
+  6. `extractTarGz` errors (hub_sync.go ~L947, ~L956 and the mkdir/`destPath` errors in the loop): reach the client through import's `extraction failed: %v` (crowdsec_handler.go ~L715).
+  7. `ExportConfig` error path: `gin.H{"error": err.Error()}` (~L877) can carry filesystem paths from the walk.
+  8. Frontend print sites in `frontend/src/pages/CrowdSecConfig.tsx`: ~L474 (`Backup stored at ...`), ~L493 (`Backup created at ...`), ~L1116 (`t('crowdsecConfig.presets.backup'): {applyInfo.backup}`). Existing vitest `frontend/src/pages/__tests__/CrowdSecConfig.curatedApply.test.tsx` (~L130 stubs `/tmp/backup.tar.gz`, ~L170 asserts the absolute path) must change.
+  9. Playwright stub fixtures carrying absolute paths: `tests/security/crowdsec-hub-preset-apply.spec.ts` ~L110, `tests/security/crowdsec-file-editor.spec.ts` ~L89, and `tests/security/crowdsec-preset-apply.spec.ts` (`/app/data/backups/...`).
+  Backup directory kinds are `<DataDir>.backup.<ts>` (Snapshot) and `<DataDir>.filebackup.<ts>` (single-file edits); the acquisition backup is a plain file next to `acquis.yaml`. No client uses the value programmatically.
+- Docs: `docs/api` has no mention of the `backup` field (checked); `ARCHITECTURE.md` mentions CrowdSec only as directory layout, so it needs no change (confirm no-op at implementation). Locale files carry `crowdsecConfig.presets.backup` ("Backup") in each language under `frontend/src/locales/*/translation.json`; any new UI string needs all locale files updated (en plus the existing languages).
+
+### 2.4 #1526 tolerant specs
+Files under `tests/security/`: `crowdsec-dashboard.spec.ts`, `crowdsec-decisions.spec.ts`, `crowdsec-diagnostics.spec.ts`, `crowdsec-console-enrollment.spec.ts`, `crowdsec-import.spec.ts`, and the non-preset cases of `crowdsec-config.spec.ts` (back navigation, config file list/content, export, console enrollment, status indicators).
+Counts depend on the pattern; for exactness use two named patterns on `origin/development`: (a) `catch(() => false)` only: dashboard 10, decisions 15, diagnostics 3, console-enrollment 9, import 0, config 11; (b) the broader "tolerance" pattern (adds "may not be", "not implemented", annotation pushes) gave higher numbers in my first pass and 13/15/18/17/1/12 in the supervisor's pass. Do not rely on either number; the gate in section 6 (Bz) defines the final, exact pattern set.
+Two styles:
+1. UI specs (`dashboard`, `decisions`, `config`, parts of `console-enrollment`) that `goto('/security/crowdsec')` against the real backend and guard on visibility. Convert to stubbed-API specs following `crowdsec-preset-apply.spec.ts` (`page.route` + `route.fulfill({ json })`, `loginUser`, `waitForLoadingComplete`).
+2. API-contract specs (`diagnostics`, most of `import`, parts of `console-enrollment`) that call `request.get/post('/api/v1/admin/crowdsec/...')` against the live backend and accept multiple statuses because cscli/LAPI are absent in the E2E container (`crowdsec-import` hides this behind a multi-status `expect([...]).toContain(status)` assertion). Convert to (a) strict assertions on a status the E2E container deterministically produces, or (b) stubbed UI tests plus Go handler tests for the real status mapping.
+Strict assertions may expose real bugs (see section 8).
+
+## 3. Decisions
+
+### 3.1 F5: recommendation (needs user confirmation)
+**Hide `local_api_credentials.yaml` and `online_api_credentials.yaml` from editor list and read** by adding them to the `isReadable` deny rules next to `bouncer_key` (same lowercase comparison), then delete `protectedWriteNames` and its branch in `isWritable` (redundant: `isWritable` is a subset of `isReadable`).
+
+Behavior change to state in docs: previously readable but write-protected, now hidden entirely (list omits them; read returns `invalid path`; write returns `file cannot be edited`, because `resolveWritable` checks `isReadable` first; new tests must assert these two real messages, not one generic message). Mixed-case names are now hidden too.
+
+Rationale (reworded; this is information-level hardening, not a closed exposure): the editor is a browser surface where plaintext secrets leak through screen shares, screenshots/support captures and the client-side query cache; novices have no need to read or edit these generated files; advanced operators still have disk access. Scope limit, stated plainly: this protects the editor surface only. Admin config export still includes these files and `bouncer_key` (section 2.3), so F5 does not remove the secrets from anything an admin can download. See Open Question on export.
+
+Alternative rejected: list but mask values (extra UI/parser complexity and a new leak path if masking misses a field).
+
+### 3.2 F3: recommendation
+Return a **backup name**, not a path: a single helper `backupID(path string) string` (in `backend/internal/crowdsec/backup.go`) returning `filepath.Base`, used at every site in 2.3 items 1-4. It is a name, not an opaque token: the three kinds are `*.backup.*` (directory), `*.filebackup.*` (directory) and `acquis.yaml.backup.*` (file). The absolute path stays in server logs only (already `SanitizeForLog`ged).
+- Errors: `rollbackFailure` keeps the cause but replaces the path with the backup name plus the hint "see server logs for the backup location"; `extractTarGz`/import errors become fixed messages (for example `archive contains an unsafe path`, `archive extraction failed`) with the entry name/dest path logged sanitized; `ExportConfig` returns a fixed `failed to export configuration` and logs the error.
+- UI keeps manual recovery possible: text such as "Backup created: <name> (next to the CrowdSec data directory)" in the three print sites, via a new i18n key (all locales) rather than hard-coded English; docs pointer in `docs/troubleshooting/crowdsec.md` explains where backups live.
+- Field name `backup` is kept. Acceptance criterion: **no absolute path appears in any CrowdSec API response, including error text** (asserted by handler tests with a regex over response bodies for a leading `/` path or the data-dir prefix).
+
+### 3.3 F1
+Reject an archive entry only if any path component equals `..` or the path is absolute; keep the `Rel`-based containment check as backstop. Tests: allowed `..hidden.yaml`, `a/..b/c.yaml`, `foo..bar`; rejected `../x`, `a/../../x`, `/etc/x`, NUL. No exploit detail in public text.
+
+### 3.4 #1479: remove vs enforce
+Remove `WithAllowedDomains`, `ClientOptions.AllowedDomains` (and its default), the caller in `newHubHTTPClient`, and the three test references in 2.1. Rationale: the only caller has a better-fitting validator, redirects are disabled for that client, and a second list would drift.
+
+### 3.5 #1481: seam design and migration
+- Production `validateHubURL`: https only, host in the three-host allowlist.
+- Test seam: unexported `validateURL func(string) error` on `HubService` (nil means `validateHubURL`), both call sites (`fetchIndexHTTPFromURL` ~L453, `fetchWithLimitFromURL` ~L754) go through one `s.checkURL(target)`.
+- Only the `hub_sync_test.go` ~L106 `httptest.NewServer` test needs the `validateURL` seam (permissive validator) plus a `network.WithAllowLocalhost()` `HTTPClient`. The ~L2259 server lives inside `TestNewHubHTTPClient_LoopbackSeam`, which is deleted together with the var.
+- **`hubAllowLoopback` and `setHubAllowLoopbackForTest` are deleted. `TestNewHubHTTPClient_LoopbackSeam` is deleted** (it only tests the removed var); replace with a small test that `newHubHTTPClient` rejects loopback (the first half of the old test, `require.Error`).
+- `validateHubURL` tests flip to assert rejection: `localhostURLs` loop (~L996-1010), the other table tests in the range ~L969-1044, and the table at ~L1645; add acceptance cases for the three https hosts and rejection for http on an allowlisted host.
+- Stub-transport migration: the roughly 100-110 hits above (including `download_url`/`preview_url` inside index JSON fixtures in `crowdsec_pull_apply_integration_test.go`, ~L40-50, and `crowdsec_preset_handler_test.go`) become allowlisted https hosts. Use one distinct allowlisted host per role so `uniqueStrings` in `hubBaseCandidates()` does not collapse candidates: primary `https://hub-data.crowdsec.net` (default), mirror `https://raw.githubusercontent.com/crowdsecurity/hub/master` (default), and `https://hub.crowdsec.net` for tests that need an extra distinct base. Tests that previously set `HubBaseURL = "http://test.hub"` use `https://hub.crowdsec.net`; tests whose assertions depend on candidate ordering get an explicit check.
+- Estimated effort: mechanical host mapping across roughly 100-110 hits (re-grep first) plus one seam-using test; a single commit. Re-grep all line numbers in this spec right before implementation starts.
+
+## 4. Priorities & Ordering
+
+Classification: all four are the maintainer's own findings (not user-submitted), none critical or high, no `feat` in the batch. Order:
+1. **#1528**: decide F5 first (as the issue says), then F5, F3, F1 (user-visible and information-exposure items first).
+2. **#1479**, then **#1481** (latent hardening of the hub URL policy; no active bypass).
+3. **#1526** last: largest and open-ended; it should assert the final contracts from 1 and 2.
+
+Findings rules: a critical/high finding discovered in #1526 ships first as its own PR. **Medium/low findings from #1526 are filed as GitHub issues by default**; they are fixed in-PR only when needed to make a converted test pass or to unblock CI (CLAUDE.md DoD). Security-sensitive findings go to a private advisory per SECURITY.md.
+
+Advisory screening: no private advisory needed for any of the four. #1479/#1481 are public, low, latent, no demonstrated bypass; F3/F5 are admin-authenticated information-level hardening with no known exploit chain; the export limitation is recorded as a known limitation, not a vulnerability (admin already has full control). If any item proves reachable by a lower-privileged actor, stop and convert to a private advisory before further public wording. All public wording (issue comments, commit subjects, PR bodies, docs) stays vague.
+
+## 5. Branch / PR Slicing Decision
+
+**Default: one PR with ordered commits** (PR A commits first, then PR B commits). This respects "one feature = one PR" and the user's dislike of PR slicing.
+
+**Exception, only with the user's approval before work starts: two PRs.** PR A (`fix/crowdsec-followups-hardening`: #1528, #1479, #1481) and PR B (`test/crowdsec-deterministic-e2e`: #1526, branched from `development` after A merges, no stacking). Justification if approved: (1) B is about 2,000 lines of test rewrite with an open-ended findings tail and would hold the small hardening work hostage; (2) a secrets-visibility change cannot be meaningfully reviewed beside that churn; (3) B must assert A's final contracts. Cost of the default: larger review and A blocked on B. This is flagged as an open question; no slicing beyond commits happens unless approved.
+
+## 6. Commit Slicing Strategy
+
+Conventional commits; no session ID/link anywhere. All subagent dispatch prompts must state explicitly: run every test, build, E2E and lint command in the foreground and block until it finishes (no background/detached runs, per CLAUDE.md). Playwright security specs run only with `--project=security-tests` (single project, targeted files only, never the full suite). Backend lint must use the full config (`cd backend && golangci-lint run --config .golangci.yml ./...` or `make lint-backend`), not only the fast hook. GORM scan: N/A (no model/query changes; state this at the gate).
+
+### Part A (hardening)
+
+| # | Commit | Scope | Files | Depends on | Validation gate |
+|---|---|---|---|---|---|
+| A0 | `test(e2e): add fixme specs for editor secrets and response paths` | `test.fixme` specs for F5 (credentials not listed; read rejected) and F3 (`backup` and error bodies contain no absolute path); update fixture stubs to name-only values | `tests/security/crowdsec-file-editor.spec.ts` (~L89 stub + new cases), `tests/security/crowdsec-hub-preset-apply.spec.ts` (~L110), `tests/security/crowdsec-preset-apply.spec.ts` | none | `npx playwright test tests/security/crowdsec-file-editor.spec.ts tests/security/crowdsec-preset-apply.spec.ts tests/security/crowdsec-hub-preset-apply.spec.ts --project=security-tests` |
+| A1 | `fix(security): harden CrowdSec editor access` | F5 per 3.1; tests assert real messages: list omits both names, read -> `invalid path`, write -> `file cannot be edited`, mixed-case and symlink-to-credentials cases (symlink caught by the resolved-path re-check ~L149) | `backend/internal/api/handlers/crowdsec_files.go`, `crowdsec_files_test.go` | A0 | `cd backend && go test ./internal/api/handlers/... ./internal/crowdsec/...` |
+| A2 | `fix: stop returning server paths in CrowdSec responses` (see Q5 on whether this deserves `(security)`; if the user says yes use `fix(security): harden CrowdSec API responses`) | F3 per 3.2 across all nine items in 2.3 (`backupID` helper, `rollbackFailure`, extract/export/import error text, three UI print sites + i18n key in all locales, vitest and Playwright fixtures) | `backend/internal/crowdsec/backup.go` (+test), `hub_sync.go`, `crowdsec_files.go`, `crowdsec_handler.go`, `crowdsec_preset_handler.go`, `frontend/src/pages/CrowdSecConfig.tsx`, `frontend/src/locales/*/translation.json`, `frontend/src/pages/__tests__/CrowdSecConfig.curatedApply.test.tsx` and any other test asserting the old value, `docs/troubleshooting/crowdsec.md` | A1 | backend `go test` for touched packages; `cd frontend && npm run type-check && npx vitest run src/pages/__tests__/CrowdSecConfig*`; response-body regex test shows no absolute path |
+| A3 | `fix: accept archive entries that merely start with two dots` | F1 | `hub_sync.go` (~L946), `hub_sync_test.go` | none | `go test ./internal/crowdsec/...` |
+| A4 | `refactor: remove the unenforced allowed-domains client option` | #1479 incl. the three test references and option-parity table test | `backend/internal/network/safeclient.go`, `safeclient_test.go`, `hub_sync.go` | none | `go test ./internal/network/... ./internal/crowdsec/...` |
+| A5 | `refactor: restrict the hub URL check to production hosts` | #1481 per 3.5 | `hub_sync.go`, `hub_sync_test.go`, `hub_pull_apply_test.go`, `hub_sync_raw_index_test.go`, `backend/internal/api/handlers/crowdsec_pull_apply_integration_test.go`, `crowdsec_preset_handler_test.go` | A4 | `go test ./internal/crowdsec/... ./internal/api/handlers/...`; grep shows no `test.hub`/`example.com`/`hubAllowLoopback`/`AllowedDomains` outside intentional places |
+| A6 | `docs/test: enable e2e specs and document the changes` | un-fixme A0; docs: credentials not shown in editor, backup names, one-line production note for #1481; confirm ARCHITECTURE.md and docs/api need no change | `tests/security/*.spec.ts`, `docs/features.md`, `docs/troubleshooting/crowdsec.md` (authored under `docs/`, never `docs-site/docs/`) | A1-A5 | targeted `npx playwright test tests/security/crowdsec-file-editor.spec.ts tests/security/crowdsec-preset-apply.spec.ts tests/security/crowdsec-hub-preset-apply.spec.ts --project=security-tests` |
+
+### Part B (#1526), after A
+
+| # | Commit | Scope | Files | Validation gate |
+|---|---|---|---|---|
+| B1 | `test(e2e): shared CrowdSec stub helpers` | extract repeated route stubs and fixtures (status, decisions, enrollment, file list/content, diagnostics) | new helper under `tests/utils/` or `tests/fixtures/` | one spec run |
+| B2 | `test(e2e): deterministic crowdsec-config non-preset cases` | back nav, file list/content, export, enrollment, status indicators | `crowdsec-config.spec.ts` | `npx playwright test tests/security/crowdsec-config.spec.ts --project=security-tests` |
+| B3 | `test(e2e): deterministic crowdsec dashboard and decisions` | | `crowdsec-dashboard.spec.ts`, `crowdsec-decisions.spec.ts` | same per file |
+| B4 | `test(e2e): deterministic crowdsec console enrollment` | stubbed states: not enrolled / pending / enrolled / failed / heartbeat | `crowdsec-console-enrollment.spec.ts` | same |
+| B5 | `test(e2e): deterministic crowdsec diagnostics and import` | strict deterministic statuses or stubbed UI + Go handler tests for status mapping | `crowdsec-diagnostics.spec.ts`, `crowdsec-import.spec.ts` (+ Go tests if gaps) | same |
+| B6 | `fix: ...` only when required | in-PR fix only if needed to make a converted test pass or to unblock CI, with a regression test; every other medium/low finding is filed as an issue instead (section 4); high/critical goes to its own PR | as needed | the relevant spec + unit tests |
+| Bz | `test(e2e): enforce no tolerant patterns in CrowdSec specs` | gate commit: no tolerance residue in the six files | none (verification only; optionally a lint script) | the command in the code block below (must return nothing, except reviewed legitimate `test.skip` hits); also review by hand for `console.log`-only branches and annotation pushes |
+
+Bz gate command (plain `|` alternation; ripgrep treats `\|` as a literal pipe). `test\.skip` hits need manual review because conditional skips can be legitimate:
+
+```bash
+rg -n "catch\(\(\) => false\)|catch\(\(\) => \{\}\)|may not be|not implemented|test\.skip|expect\(\[[0-9, ]+\]\)\.toContain" \
+  tests/security/crowdsec-config.spec.ts tests/security/crowdsec-dashboard.spec.ts \
+  tests/security/crowdsec-decisions.spec.ts tests/security/crowdsec-diagnostics.spec.ts \
+  tests/security/crowdsec-console-enrollment.spec.ts tests/security/crowdsec-import.spec.ts
+```
 
-- `crowdsecDataDir = cfg.Security.CrowdSecConfigDir` (`backend/internal/api/routes/routes.go:1030`), set to `/app/data/crowdsec` by `Dockerfile:1142` (`CHARON_CROWDSEC_CONFIG_DIR`). The same directory is `CS_PERSIST_DIR` in `.docker/docker-entrypoint.sh`. It therefore contains the **whole persistent CrowdSec tree**: `config/` (the target of the runtime symlink `/etc/crowdsec -> /app/data/crowdsec/config`), `data/` (LAPI db), `hub_cache/`, `bouncer_key`.
-- That same path is `HubService.DataDir` and `CrowdsecHandler.DataDir` (`crowdsec_handler.go:374-397`). Every "backup the DataDir" in the code is a backup directory next to it, `/app/data/crowdsec.backup.<ts>`.
+Full Definition of Done for the PR(s): targeted Playwright as above; full-config backend lint; `scripts/go-test-coverage.sh` >= 85%; `scripts/frontend-test-coverage.sh`; `bash scripts/local-patch-report.sh`; `npm run type-check` and `npm run build` in `frontend/`; `go build ./...`; `lefthook run pre-commit`. CodeQL/Trivy are CI-deferred (fix/refactor, no new surface); a local CodeQL Go run is optional for A1/A2.
 
-### 2.1 #1514 applyPresetLocally writes unvalidated client content (root cause is wider than the issue says)
+## 7. Test Plan
 
-- Entry: `frontend/src/pages/CrowdSecConfig.tsx:429` `applyPresetLocally`; reached only when apply returns HTTP 501 for a non-curated (hub) preset (line ~508). It writes `presetPreview` (text from the pull preview, held in client state) to `selectedPath ?? files[0]` through `writeCrowdsecFile` (`frontend/src/api/crowdsec.ts`).
-- Confirmed: the backend **never returns 501** for apply any more (grep of `crowdsec_handler.go` shows no `StatusNotImplemented`). The fallback is dead code in practice and can only be triggered by a proxy/misconfig, which makes removing it risk-free.
-- Transformation/persistence: `POST /admin/crowdsec/file` -> `CrowdsecHandler.WriteFile` (`crowdsec_handler.go:950`, registered under `managementAdmin`, so admin-only). Verified defects in the handler, independent of the frontend:
-  1. **Destructive backup.** It `os.Rename(h.DataDir, backupDir)` (moves the *entire* persistent CrowdSec tree away, config symlink target included), then `MkdirAll(filepath.Dir(p))` and writes just the one file. Everything else (config.yaml, hub, bouncer key, data) is left only in the backup dir. The live tree becomes a single file. There is no restore. This is the same defect class as #1515 and is a medium-severity data-loss bug, not just "unvalidated content".
-  2. **The file endpoints get a validation pass.** The fix is described at policy level in 3.2.
-- Exit: `{status:"written", backup}`; the UI toasts "File saved" / "Preset applied locally".
-- Severity/impact: low-medium, authenticated admin only (not an unauthenticated vulnerability). See section 4.
+- Backend: `isReadable`/`isWritable`/`resolveReadable`/`resolveWritable` table tests asserting real messages (`invalid path` for reads, `file cannot be edited` for writes) for both credentials names, mixed case, nested, symlink target; `backupID` table; handler tests with a response-body regex for absolute paths on success and error paths (file write, import including extraction failure, preset apply, curated apply with a forced rollback failure, acquisition update, export error); `validateHubURL` rejection/acceptance tables; safeclient dialer-vs-redirect parity table; tar entry-name table.
+- Frontend: update `CrowdSecConfig.curatedApply.test.tsx` and add tests for the three print sites and the new i18n key.
+- E2E: per commit tables.
+- Grep gates: no `WithAllowedDomains`/`AllowedDomains`/`hubAllowLoopback` remnants; no test hosts in non-test code.
 
-### 2.2 #1515 HubService.Apply renames the whole data dir (CONFIRMED in code; end-to-end not executed)
+## 8. Risks and Mitigations
 
-- Entry: `ApplyPreset` -> `Hub.Apply` for non-curated presets (`hub_sync.go:602`).
-- Transformation: `backupExisting` first tries `os.Rename(DataDir, <DataDir>.backup.<ts>)`; only if rename fails (EBUSY on a mount point, cross-device) does it fall back to `copyDir`. Then `runCSCLI` (`cscli hub update` + `cscli hub install <slug>`).
-- Why it is wrong, confirmed by reading the code and by the behavior seen in a throwaway container (below): after the rename `/etc/crowdsec -> /app/data/crowdsec/config` dangles, so `cscli` cannot read `config.yaml` (observed error: `open /etc/crowdsec/config.yaml: no such file or directory`). The cscli path therefore fails, the code falls to `extractTarGz` into a freshly created `DataDir`, and on success the live dir holds only the extracted archive while config, hub, `bouncer_key`, LAPI db and `hub_cache` sit in the backup. CrowdSec is running while its db directory is moved. Rollback (`rollback`) does `RemoveAll(DataDir)` then renames the backup back, so it is also only valid for that directory and cannot undo anything `cscli` wrote outside it.
-- Not confirmed: that a *real* hub-preset apply on a running container hits exactly this sequence (needs a hub preset pull + a running agent). The verification step is part of the gate in Commit 3. Whether the extract fallback ever "succeeds" with a usable tree is irrelevant; the rename itself is the defect.
-- Fix direction (matches the issue): reuse the copy-based, symlink-preserving, db-excluding `backupCopy`/`restoreCopy` added for `ApplyCurated`.
+| Risk | Mitigation |
+|---|---|
+| ~100-110-hit test migration (A5) breaks many tests | Single commit, package-by-package runs, mechanical mapping with distinct hosts per role (3.5) |
+| Migration weakens tests via `uniqueStrings` collapse | Distinct hosts per role; ordering assertions where relevant |
+| F5 hides a file someone relies on viewing | Documented as a behavior change; disk access unchanged; masked read-only view is the fallback |
+| F5 gives false assurance because export still includes secrets | Stated as known limitation; export question below |
+| F3 breaks manual-recovery UX | Name plus location hint in UI, docs pointer, server log keeps full path |
+| #1526 exposes real bugs | Stop rule: if more than N=6 real bugs surface, stop and re-plan with the user; medium/low are filed as issues by default (section 4) |
+| Live-backend E2E flake | Prefer stubs; where live, assert only deterministic states |
+| Specs silently not run without `--project=security-tests` | Every gate names the project; confirm test count in output |
 
-### 2.3 #1516 backup directories accumulate (CONFIRMED)
-
-Creators of `<DataDir>.backup.*`: `HubService.Apply` (rename, second-resolution timestamp), `ApplyCurated` (copy, microsecond timestamp), `CrowdsecHandler.ImportConfig` (`crowdsec_handler.go:696`, rename), `WriteFile` (rename). Nothing ever deletes any of them. grep for prune/retention in `backend/internal/crowdsec` returns nothing. Because the curated backup is a full copy of the persistent tree (minus the db) and the legacy ones are the whole tree, growth is unbounded on a volume the user sizes for a home server.
-
-### 2.4 #1517 handler file size (CONFIRMED)
-
-`crowdsec_handler.go` is 2,906 lines. Preset handlers live at lines ~990-1325 (`ListPresets`, `PullPreset`, `ApplyPreset`, `applyCuratedPreset`, `curatedPresetPreview`, `recordPresetEvent`, `applyFailureBody`, `respondApplySuccess`, `GetCachedPreset` at ~1426). Pure move, same package.
-
-### 2.5 #1518 tolerant Playwright tests (CONFIRMED)
-
-`tests/security/crowdsec-config.spec.ts` "Preset Management" block (lines ~73-145) and "Configuration Files" block are `isVisible().catch(() => false)` guarded and annotate "feature may not be implemented"; they cannot fail on a regression. `tests/security/crowdsec-preset-apply.spec.ts` (from #1513) is the model: route-stubs `**/api/v1/admin/crowdsec/presets/apply` and the file-write route and asserts toasts and write counts. Missing deterministic coverage: hub (non-curated) preset apply success/failure surfaced, no client-side write on any apply failure, file editor save/failure, file-list error cases.
-
-### 2.6 #1523 hub data files missing after container recreation (ROOT CAUSE CONFIRMED by experiment)
-
-- Config: CrowdSec's default `config_paths.data_dir` is `/var/lib/crowdsec/data/` and `hub_dir` is `/etc/crowdsec/hub/` (upstream `config/config.yaml`). The entrypoint (`.docker/docker-entrypoint.sh:310-319`) redirects **only** `db_path` to the volume. `Dockerfile:1089` creates `/var/lib/crowdsec/data` inside the image, so on a recreated container it is an empty directory (confirmed: the issue shows only `trace/`). `/etc/crowdsec` is a symlink into the volume so the **hub items persist but their data files do not**.
-- `configs/crowdsec/install_hub_items.sh` skips items for which `cscli <type> inspect <name>` exits 0 ("already installed, skipping").
-- Experiment (throwaway `charon:local` container run with `--entrypoint sh`, no volumes, no live host touched):
-  - Install `crowdsecurity/http-backdoors-attempts` -> `backdoors.txt` appears in `data_dir`.
-  - Wipe `data_dir` (simulating recreate), keep the hub: `cscli scenarios install <name>` -> "Nothing to install or remove", data dir stays empty. `cscli scenarios install --force <name>` -> same, still empty. **`cscli hub upgrade` repopulates `backdoors.txt`, and so does `cscli hub upgrade --force`.** The issue's suggestion "`install --force` or `hub upgrade`" is therefore half right: only `hub upgrade` works.
-- **Additional defect found (CONFIRMED, not in the issue):** on a hub with an index but nothing installed, `cscli scenarios inspect crowdsecurity/http-backdoors-attempts` exits **0** and prints `installed:false` metadata. `install_if_missing` uses the exit code, so on a fresh volume it may print "already installed, skipping" and install nothing. (In the experiment inspect exited 1 when the item was installed but its data file was missing, so the exit code is not a reliable installed/absent signal in either direction.) #1513's `ApplyCurated` already uses the correct signal: `inspect -o json` -> top-level `installed`.
-- Not confirmed: whether the missing-install path is masked in real startups by something else (e.g. the collections installing their children). Needs the recreate test in Commit 6 on a clean volume.
-
-### 2.7 #1524 empty version (ROOT CAUSE CONFIRMED; the fix has a gotcha)
-
-- Confirmed: the injected symbol is wrong. In CrowdSec v1.8.1, `pkg/cwversion/version.go` declares only `Codename` and `Libre2` (and no `Version`); the version comes from `github.com/crowdsecurity/go-cs-lib/version` (`Version`, `BuildDate`, `Tag`, `System`), pinned at `go-cs-lib v0.0.25` by CrowdSec v1.8.1's `go.mod`. Upstream's own Makefile uses `-X 'github.com/crowdsecurity/go-cs-lib/version.Version=$(BUILD_VERSION)'` (plus `BuildDate`, `Tag`, and `cwversion.Codename`). `-X` on a nonexistent symbol is silently ignored, so both `Dockerfile:915` and `:923` are no-ops. Observed in the built image: `cscli version` prints empty `version:`, `Codename:`, `BuildDate:`, and `cscli` logs `Crowdsec version is not set, using hub branch 'master'`.
-- The existing app-stage sanity check (`Dockerfile` ~L1054) says "CrowdSec 1.8.x prints an empty `version:` field here regardless of the -X ldflag". That comment is wrong and hides the bug; it must be corrected.
-- **Gotcha, verified in `cmd/crowdsec-cli/core/require/branch.go` (v1.8.1):** with a real version cscli calls `https://version.crowdsec.net/latest` on every hub command and returns a hard error if it cannot reach it; if the running version equals latest it uses `master` (identical to today), if it is older than latest it uses the branch named after the version. `https://hub-cdn.crowdsec.net/v1.8.1/.index.json` returns **404** today (v1.8.0, v1.7.8 and master return 200). So a correct version could (a) make `cscli hub *` fail offline/air-gapped and (b) break hub updates once 1.8.1 is no longer the latest and the CDN has no `v1.8.1` branch. The issue's "hub items may be newer than the engine supports" claim is also overstated: while 1.8.1 is the latest release the behavior is already `master`. The fix therefore needs an explicit hub-branch decision (see D1) rather than a bare `-X` correction.
-- The toolchain delivery path: the default Dockerfile build consumes the prebuilt `ghcr.io/wikid82/charon-toolchain` image (content-hash tag `CHARON_TOOLCHAIN_TAG`, `Dockerfile:22`). Editing the `crowdsec-inline` stage changes the key, `.github/workflows/toolchain-image.yml` builds the new image and its bot commits the new TAG/DIGEST onto the PR head branch (workflow lines ~365-420) so `verify-toolchain-pin` goes green. Until that happens the app image still contains the old binary, so the app-side assertion cannot be added in the same commit as the ldflags change.
-
-### 2.8 Reproduction/evidence commands run for this plan (all foreground, repo-local or throwaway container)
-
-`gh issue view` for each issue, `gh pr view 1513`; code reads listed above; `curl` of upstream v1.8.1 source files and `hub-cdn.crowdsec.net/<branch>/.index.json`; shallow clone of upstream v1.8.1 into the session scratchpad; throwaway `docker run --rm --entrypoint sh charon:local` experiments (data-dir wipe, inspect exit codes, `hub upgrade`). Nothing on live hosts or volumes was touched.
-
-## 3. Technical Specifications
-
-### 3.1 Shared backup helper, Apply flow, ImportConfig (#1515, #1516)
-
-New file `backend/internal/crowdsec/backup.go` (move `backupCopy`, `restoreCopy`, `isLiveDBFile`, `emptyDirExcept` out of `curated_apply.go`; the move itself changes no behavior):
-
-- **Two namespaces, two caps, so they cannot evict each other (blocking item 3).**
-  - Full-tree snapshots: backup dirs next to `DataDir`: `<DataDir>.backup.<ts>`, `const DefaultBackupRetention = 5`.
-  - Single-file edit backups (from `WriteFile`, section 3.2): backup dirs next to `DataDir`: `<DataDir>.filebackup.<ts>/<rel>`, `const DefaultFileBackupRetention = 10`. The `<base>.backup.*` glob never matches `<base>.filebackup.*`.
-- **Snapshot exclusions (blocking item 4).** `snapshot` copies `DataDir` (symlinks preserved) but **excludes**: the live `crowdsec.db`, `-wal`, `-shm` (anywhere), and the top-level `data/` directory (LAPI db plus hub data files and the GeoLite2 mmdb, which after #1523 live there; hub data files are recoverable with the gated `cscli hub upgrade`, the db is owned by the running engine) and the top-level `hub_cache/` (regenerable download cache). `restore` empties `DataDir` except those same excluded entries and copies the snapshot back, so it never touches `data/` or `hub_cache/`. Only the *top-level* `data/` and `hub_cache/` are excluded; a nested directory with the same name inside `config/` is still backed up. Result: a snapshot is essentially `config/` plus `bouncer_key` (small), x5 retained.
-- `func (s *HubService) snapshot() (path string, err error)`: microsecond timestamp name, created `0o700` with exclusive `os.Mkdir`.
-- `func (s *HubService) restore(path string) error`.
-- `func PruneBackups(dataDir, kind string, keep int) (removed []string, err error)` where `kind` is `backup` or `filebackup`. Lists siblings matching `<base>.<kind>.*`, `Lstat`-checks each is a real directory (never follows or deletes symlinks or plain files), **parses the timestamp from the directory name** (both the legacy `20060102-150405` and the microsecond `20060102-150405.000000` layouts; names that do not parse are ignored, never deleted), sorts newest first, deletes everything past `keep`. `keep < 1` is clamped to 1 so the newest is always kept. Never touches `dataDir`. Single-removal errors are logged and aggregated, never failing the caller.
-- **Prune runs after every attempt, successful or failed**, always preserving the newest `keep` snapshots. A failed apply's own snapshot is the newest, so it is always retained for manual recovery.
-
-**`HubService.Apply` new control flow (blocking item 2).** Hold `HubService.mu` and the handler-level lock (section 6).
-1. Validate slug; load cache meta (non-fatal).
-2. `snapshot()`; any error -> return failure, nothing changed. `BackupPath` is set only after success. The old "read the archive into memory before the backup because the cache lives in `DataDir`" workaround is **removed**: nothing is moved any more, and `hub_cache/` is excluded from snapshots and from restore, so the archive stays valid for the whole call.
-3. If `cscli` is available: `cscli hub update` (non-fatal), `cscli hub install <slug>`. Success -> status `applied`, `UsedCSCLI=true`, reload, prune, return.
-4. **A cscli failure still falls back to the cached-archive extract** (this keeps the offline/hub-unreachable behavior that exists today). Before extracting, `restore(snapshot)` so the extract starts from a clean pre-apply tree and any partial files `cscli` wrote are removed (this closes the partial-overlay risk of overlaying an archive on a half-installed state).
-5. Extract `extractTarGz` onto `DataDir` (cache refresh from the hub if the cache is missing, as today). **Residual risk, documented:** extraction overlays archive files on top of the live tree rather than replacing it, so files in the archive replace same-named live files; mitigation is the snapshot. Any extract/refresh failure -> `restore(snapshot)` and return the error with `BackupPath`.
-6. Success -> status `applied`, `UsedCSCLI=false`, reload, prune.
-`backupExisting`, `rollback`, `emptyDir`, and `copyDir` (if now unused) are deleted.
-
-**`CrowdsecHandler.ImportConfig` (blocking item 6): converted to snapshot/restore semantics, never renaming `DataDir`.** Flow: handler lock -> `snapshot()` -> empty `DataDir` except the snapshot-excluded entries (so the live db, `data/`, `hub_cache/` survive the import) -> extract the uploaded archive, **skipping any archive entry that is a live db file (`isLiveDBFile`) or lies under the top-level `data/` or `hub_cache/`** so an upload can never overwrite engine-owned state -> on any failure `restore(snapshot)` and return the error -> prune. Net behavior difference: the live db and `data/` are no longer moved or lost by an import; everything else is replaced exactly as before. Existing `ImportConfig` tests are updated, plus the new tests listed in Commit 3.
-
-### 3.2 File endpoints hardening (#1514)
-
-Details of the validation defects and their fixes are intentionally not written here (see section 4). Public-safe design:
-
-- New file `backend/internal/api/handlers/crowdsec_files.go` with a single shared path-resolution helper used by `ReadFile`, `WriteFile` and `ListFiles`, so all three apply one policy ("harden file-endpoint path validation").
-- Write policy: bounded body size (1 MiB); allowed file types (Q3); YAML files must parse; protected files and trees (secrets, databases, caches, engine data) are never writable; `.yaml/.yml` parsing uses `gopkg.in/yaml.v3` if already a dependency (verify).
-- **Symlink policy (blocking item 7):** the editor never writes through or replaces a symlink (HTTP 400), so symlinked hub items are read-only from the editor. Reads stay confined to `DataDir`, and symlinked hub items that resolve inside it stay readable. Test in Commit 4.
-- **Two predicates, not one.** The viewer today lists and reads any file under `DataDir` (hub items, `config.yaml`, etc.), and filtering the list by the write predicate would hide files users can currently read. So: `isReadable(rel)` governs `ListFiles` and `ReadFile` (secrets and databases such as `bouncer_key`, `*.db*`, and the `hub_cache/` and `data/` trees are neither listed nor readable; everything else stays visible, including symlinked hub items), and the stricter `isWritable(rel)` governs `WriteFile`. A file that is readable but not writable (symlinked hub items, non-allowlisted types) stays viewable and its save returns the server's 400 message, which the existing `writeMutation` error path already shows; no frontend contract change. `ExportConfig` is unaffected. Commit 4 tests: `ReadFile` refuses `bouncer_key` and db files, reads a symlinked hub item that resolves inside `DataDir`, and refuses a symlink resolving outside it; `ListFiles` omits them but still lists a symlinked hub item and `config.yaml`; every file `WriteFile` accepts is also listed.
-- `WriteFile` algorithm: lock -> validate -> if the target exists, copy just that file to `<DataDir>.filebackup.<ts>/<rel>` -> atomic write (temp file in the same directory, `fsync`, `rename`, preserve mode, default `0o600`) -> `PruneBackups(kind=filebackup, 10)` -> 200 `{status:"written", backup}`. `DataDir` is never renamed.
-- Error contract (JSON `{"error": ...}`): 400 invalid request / path / type / YAML / symlink, 413 too large, 500 write failure.
-- No new endpoints, no schema changes, no frontend contract changes.
-
-### 3.3 Frontend (#1514)
-
-`frontend/src/pages/CrowdSecConfig.tsx`: delete `applyPresetLocally`, the `501` branch in `handleApplyPreset`, the `applied-locally` apply-info status, and anything left unused (`backupMutation` if only used there, imports, `presetPreview` write path). Non-2xx apply for hub presets is surfaced like curated: server error text, backup path if present, no write. The generic file editor (`writeMutation`) is unchanged but now shows server 400/413 messages. Update Vitest files: `CrowdSecConfig.test.tsx`, `.coverage.test.tsx`, `.spec.tsx`, `.curatedApply.test.tsx` (remove tests that assert the local fallback; add "501 for a hub preset shows an error and performs no file write").
-
-### 3.4 Persistent CrowdSec data dir and hub data (#1523)
-
-`.docker/docker-entrypoint.sh` (next to the existing `db_path` redirect, ~L310-320):
-
-- `sed` `data_dir: /var/lib/crowdsec/data/` -> `data_dir: ${CS_DATA_DIR}/` in `$CS_CONFIG_DIR/config.yaml` (idempotent; works for both fresh and already-initialized volumes), with the same verify/echo pattern as the db redirect. `CS_DATA_DIR` is `/app/data/crowdsec/data` and is already `mkdir`ed and chowned.
-- **Gated, never unconditional (blocking item 5).** After `install_hub_items.sh`, the entrypoint runs `cscli hub upgrade` **only if** at least one installed item's data files are missing. Detection: for each installed item (`cscli <type> list -o json`), check that every file the item declares is present under `data_dir`; the exact JSON field for declared data files is confirmed by the implementer against `cscli <type> inspect <name> -o json` before coding (open implementation detail, verified in the Commit 6 gate). Fallback if the field is not exposed: treat an empty `data_dir` (ignoring `trace/` and the db) with at least one installed item as "missing". The call is bounded (`timeout 120s`), failure is a logged warning and never fatal, and it never uses `--force`. A normal restart with intact data files performs no upgrade, so items are never silently upgraded on a healthy start. Note `hub upgrade` upgrades every installed item; this is acceptable only in the recovery case it is gated on, and the log line must say so.
-- It is skipped in the same condition as the rest of hub init (`CHARON_SECURITY_TESTS_ENABLED=false`).
-
-`configs/crowdsec/install_hub_items.sh`: change `install_if_missing` to decide on `cscli <type> inspect <name> -o json` reporting `"installed": true`, matching `ApplyCurated.verifyItem`. **Verified:** `jq` is not in the `charon:local` image, so use `grep -q '"installed": *true'` (not jq). **Verified:** `inspect -o json` still prints full JSON and exits 0 when an item is installed but its data file is missing, so the JSON signal is reliable in exactly the recreate scenario (the plain-text `inspect` exit code was not). Keep the "failed to install" warnings non-fatal.
-
-`Dockerfile`: keep creating `/var/lib/crowdsec/data` (a stale `data_dir` on an un-migrated config must still exist); no other change.
-`.docker/compose/docker-compose.playwright-ci.yml:137` currently mounts a volume at `/var/lib/crowdsec/data`; repoint or remove it so E2E exercises the same persistent path as production. `docs/security.md` hardened-deployment text that tmpfs-mounts `/var/lib/crowdsec` stays valid (the db and data now live under `/app/data/crowdsec`) but its description must be updated.
-`scripts/diagnose-crowdsec.sh` default `DATA_DIR` updated to the new location.
-
-Optional passive health signal (Q4 resolved: log line only, no UI): log a startup summary line listing installed-but-missing data files. No banner or badge (Passive UI, no nudges).
-
-### 3.5 Version injection (#1524)
-
-`Dockerfile` `crowdsec-inline` stage (both `xx-go build` commands, ~L915 and ~L923): replace the ldflags with `-s -w -X github.com/crowdsecurity/go-cs-lib/version.Version=v${CROWDSEC_VERSION} -X github.com/crowdsecurity/go-cs-lib/version.BuildDate=<reproducible date or empty>`. Do not set `Tag` (empty `Tag` leaves `version.String()` equal to `Version`). Do not add `BuildDate` from the wall clock: that would break the content-addressed, reproducible toolchain key; prefer the release date derived from the pinned tag or omit it.
-
-App-side assertion (second commit, after the toolchain bot has pushed the new TAG/DIGEST to the PR branch): in the existing N5 `RUN` block (~L1054) replace the wrong comment and add `grep -q "^version: v${CROWDSEC_VERSION}\$"` against `cscli version`. The final stage must redeclare `ARG CROWDSEC_VERSION` (currently declared only globally at L41 and in the caddy/crowdsec-inline stages; a global ARG is not visible inside a later stage without redeclaring). The build fails if the symbol ever silently no-ops again.
-
-Hub branch (decision D1, recommended): set `cscli.hub_branch` explicitly in the entrypoint-managed `config.yaml` so behavior is deterministic and does not depend on `version.crowdsec.net` reachability or on `hub-cdn` having a `v1.8.1` branch. Verified in upstream v1.8.1 `chooseBranch`: a non-empty `cscli.hub_branch` is returned immediately, before the `version.crowdsec.net/latest` lookup, so setting it removes both the network dependency and the CDN-404 risk. The online/offline test result is recorded in the PR description (Commit 8 gate).
-
-### 3.6 Handler split (#1517)
-
-Move to `backend/internal/api/handlers/crowdsec_preset_handler.go` (same package, no behavior change, no export changes): `ListPresets`, `PullPreset`, `ApplyPreset`, `applyCuratedPreset`, `curatedPresetPreview`, `recordPresetEvent`, `applyFailureBody`, `respondApplySuccess`, `GetCachedPreset`, and preset-only helpers. Move the matching unit tests into `crowdsec_preset_handler_test.go` files where they are clearly preset-only (leave shared fixtures where they are). `RegisterRoutes` stays in `crowdsec_handler.go`. The new file must be < 700 lines.
-
-## 4. Priorities & Ordering (CLAUDE.md "Findings Triage")
-
-None of the seven issues is user-submitted (all filed by the maintainer from PR #1513). Rules applied: bug fixes before new implementation (there is no `feat` here); critical/high ships as its own PR first; medium/low is scheduled after.
-
-Severity after root-causing (some differ from the issue labels):
-
-| Rank | Issue | Severity | Why |
-|------|-------|----------|-----|
-| 1 | #1523 data files missing after recreate | **medium** (issue says medium) | Silent degraded detection and no GeoIP on every recreated container; install guard defect makes fresh volumes suspect. Highest user impact. |
-| 2 | #1514 + `WriteFile` destructive rename | **medium** (raised from low-medium) | Admin action can wipe the live CrowdSec tree; weak input validation. Security-sensitive (below). |
-| 3 | #1515 `HubService.Apply` rename | **low-medium, confirmed** | Same defect class and same helper as #1514/#1516; fixed together. |
-| 4 | #1524 empty version / hub branch | **low-medium** | Fix is easy but changes runtime hub behavior (offline failure, CDN 404 risk); needs the D1 decision and the toolchain bot. Scheduled after the fixes it must not destabilize. |
-| 5 | #1516 backup accumulation | low | Piggybacks on the shared helper. |
-| 6 | #1518 tolerant E2E | low | Test hardening; first in commit order (as `fixme` specs) and enabled last. |
-| 7 | #1517 handler split | low | `refactor`, no behavior change; sequenced first in the *commit* order (mechanical, makes later diffs reviewable) but lowest in *priority*. |
-
-No finding is critical or high, so none must ship as its own PR ahead of this work. Priority above governs attention and what to cut first under contingency; commit order in section 5 is dependency-driven.
-
-**Security handling (#1514).** It is admin-only and already public as an issue. Assessment: low severity (authenticated admin only; the endpoint grants nothing beyond what an admin already has). **Q2 resolved by the user: #1514 is already public, so no private advisory is opened unless root-causing shows real impact beyond what an admin already has; it does not, so the default is NO advisory.** Handling:
-- The existing public issue #1514 stays as is. Keep PR text, commit bodies and code comments free of exploit specifics anyway (no value in handing detail to un-upgraded installs).
-- Exactly one commit in the PR carries the `(security)` scope, and its subject must stay in the vague category-only form: `fix(security): harden CrowdSec configuration file handling`. Keep the subject category-only, and Commit 4's body and the PR description stay equally vague (for example "tighten validation in the CrowdSec configuration file endpoints"). Every commit subject in a feature PR merge-commit appears verbatim in the public changelog, so the other commits use plain scopes (`fix:`, `refactor:`, `test:`, `docs:`, `chore:`) and describe user-visible behavior only. The destructive-rename data-loss fix is a plain `fix:` (it is a reliability bug, not an exploit).
-
-**Out-of-scope findings discovered while planning:** none left open. Items found beyond the issue text are folded in (install guard, wrong N5 comment, `ImportConfig` conversion, playwright-ci compose mount). If implementation finds anything else, file it per the triage rule at that time.
-
-## 5. Branch/PR Decision and Commit Slicing Strategy
-
-### 5.1 Branch/PR decision: ONE branch, ONE PR
-
-Single branch `fix/crowdsec-preset-apply-hardening` -> PR into `development`, titled e.g. `fix: harden CrowdSec preset apply and keep hub data across container recreation`.
-
-Why one PR (cohesion): all seven issues are one defect family, "the CrowdSec persistent tree is mutated unsafely and its hub/data state is not durable", and they share code: #1514, #1515 and #1516 all consume the same new `backup.go` helper (a single fix for rename-based backups, the file endpoint, and pruning); #1517 is the file those changes land in; #1518 is the test net for #1514/#1515; #1523 and #1524 are the same persistent-dir/hub-state story at the container layer and are both verified by the same rebuilt-container gate. Splitting would leave the helper without its callers, the E2E net without the behavior, or a half-fixed persistence story.
-
-Considered splits and why rejected:
-- Docker/entrypoint (#1523, #1524) vs Go/frontend: they can build independently, but they do not conflict, share a single verification environment (rebuilt `charon:local`), and splitting would double the merge-soak the maintainer applies before `main`. The #1524 toolchain bot is explicitly designed to push the pin bump onto the PR head branch, so it works inside this PR.
-- `(security)` fix alone: not required; severity is low (authenticated admin), and the rule "own PR" applies to critical/high only.
-
-**Contingency without splitting:** if Commits 7-8 (#1524) cannot be validated (hub-branch decision unresolved, toolchain build blocked), drop those commits from the PR and leave #1524 open rather than opening a second PR for it; the remaining six issues still form a complete, coherent PR. Rollback of the PR as a whole is a revert of the merge commit; a revert leaves a valid `data_dir` in `config.yaml` (the old image still creates the default directory), so nothing breaks.
-
-### 5.2 Ordered commits (all on the one branch)
-
-Every command run by implementers is foreground/blocking per CLAUDE.md. Each commit must build and pass its gate; the PR as a whole passes the full Definition of Done (section 8).
-
-**Commit 1 - `test: add deterministic E2E specs for CrowdSec preset and file flows (fixme)`** (#1518, step 1 of the suggested sequence)
-- Files: new `tests/security/crowdsec-hub-preset-apply.spec.ts`, new `tests/security/crowdsec-file-editor.spec.ts`.
-- Content, all stubbed with `page.route` like `crowdsec-preset-apply.spec.ts`, marked `test.fixme` until their feature commits: hub preset apply success shows success only when body `status==='applied'`; hub preset apply 500/503/504 shows an error and **zero** `POST /admin/crowdsec/file` calls; hub preset apply 501 shows an error and zero writes; file editor save success posts exactly one write for exactly the selected path; file editor shows the server message for 400 (disallowed type / invalid YAML) and 413.
-- Depends on: none. Gate: `npx playwright test tests/security/crowdsec-hub-preset-apply.spec.ts tests/security/crowdsec-file-editor.spec.ts --project=security-tests` runs and reports the tests as fixme/skipped with no failures; lint/type-check clean.
-
-**Commit 2 - `refactor: move CrowdSec preset handlers into their own file`** (#1517)
-- Files: new `backend/internal/api/handlers/crowdsec_preset_handler.go`; edit `crowdsec_handler.go`; move/split preset-only tests into `crowdsec_preset_handler_test.go`.
-- Pure move: no signature, route, or behavior changes. Depends on: none.
-- Gate: `cd backend && go build ./... && go test ./internal/api/handlers/... -race` all green with the same test count; `git diff --stat -M` shows moves, not rewrites; `make lint-fast`.
-
-**Commit 3 - `fix: keep CrowdSec backups bounded and copy-based for preset apply`** (#1515, #1516)
-- Files: new `backend/internal/crowdsec/backup.go` + `backup_test.go`; edit `hub_sync.go` (`Apply` per the flow in 3.1; remove `backupExisting`/`rollback`/`emptyDir`/dead `copyDir`), `curated_apply.go` (move helpers, add prune call), `crowdsec_handler.go` `ImportConfig` (snapshot/restore conversion, handler lock), `hub_pull_apply_test.go`, `device_busy_test.go` (the rename/EBUSY tests are obsolete and are replaced by copy-path tests).
-- Depends on: Commit 2 (preset code already in its own file; `ImportConfig` stays in the main handler).
-- Unit tests (new, all with `t.TempDir()`): snapshot excludes live db files, top-level `data/` and `hub_cache/`, preserves symlinks, and still copies a nested directory named `data` under `config/`; **size test:** a large file under `data/` and under `hub_cache/` is not copied while a small `config/` file is (assert snapshot size); restore leaves live db, `data/` and `hub_cache/` untouched; `PruneBackups` orders by the timestamp parsed from the name (not mtime; touching an old dir does not save it), handles both name layouts, ignores unparsable names, non-matching names, symlinks and plain files, never deletes `dataDir`, clamps `keep<1` to 1, always keeps the newest, handles a missing parent, and `backup` and `filebackup` namespaces never evict each other; `HubService.Apply` flows: (a) cscli success leaves `DataDir` in place (inode unchanged) and prunes; (b) **cscli failure -> snapshot restored -> cached-archive extract succeeds -> `applied`, `UsedCSCLI=false`, no cscli leftovers**; (c) cscli failure and extract failure -> snapshot restored, error returned with `BackupPath`; (d) cscli failure with cache miss and hub refresh failure -> restored; (e) prune also runs after a failed apply and keeps the failed apply's snapshot; `ImportConfig`: success replaces config but preserves live db/`data/`/`hub_cache/` and never renames `DataDir`; extract failure restores the previous config; prune runs; concurrent `ImportConfig` + apply serialize on the handler lock; an uploaded archive containing `crowdsec.db`, `data/x` and `hub_cache/y` entries extracts none of them.
-- Gate: `go test ./internal/crowdsec/... ./internal/api/handlers/... -race`; package coverage not below the current level; **rebuilt-container verification of #1515**: pull + apply one hub preset against a running agent, confirm `/app/data/crowdsec` is never renamed (inode unchanged), the apply result is correct, and at most 5 full-snapshot dirs remain after 7 applies (this also settles the "not confirmed" item in 2.2).
-
-**Commit 4 - `fix(security): harden CrowdSec configuration file handling`** (#1514 backend; subject intentionally vague, see section 4)
-- Files: new `backend/internal/api/handlers/crowdsec_files.go` + `crowdsec_files_test.go`; edit `crowdsec_handler.go` (`ListFiles`, `ReadFile`, `WriteFile` delegate to the shared helper); update existing `TestCrowdsec_WriteFile_*` tests in `crowdsec_handler_coverage_test.go`.
-- Depends on: Commit 3 (per-file backups use the `filebackup` namespace and handler lock). Commit body and PR text stay vague (section 4).
-- Unit tests (categories only here): path validation rejection cases, symlink policy (write through or replacement of a symlink is refused, a regular file under `DataDir` is written), type/content/size validation (disallowed type, invalid YAML, oversize -> 413, protected files), atomic write leaves no temp file on failure, `DataDir` and unrelated files untouched after a write (regression test for the destructive rename), `filebackup` contains only the previous version of the target and is capped independently of full snapshots, the read/list predicate and the stricter write predicate behave as in 3.2, `ReadFile` shares the validation.
-- Gate: `go test ./internal/api/handlers/... -race`, `make lint-fast`; GORM scan not required (no models); the Playwright file-editor spec enabled in Commit 9 depends on this behavior.
-
-**Commit 5 - `fix: remove the dead local-write fallback from CrowdSec preset apply`** (#1514 frontend)
-- Files: `frontend/src/pages/CrowdSecConfig.tsx`, its four test files under `frontend/src/pages/__tests__/`, `frontend/src/api/crowdsec.ts` only if a now-unused export remains.
-- Depends on: none technically (the backend never returns 501); ordered after Commit 4 so the whole #1514 story is reviewable in sequence.
-- Gate: `cd frontend && npm run type-check && npx vitest run src/pages/__tests__/CrowdSecConfig*` green; no unused-export/lint findings; `npm run build`.
-
-**Commit 6 - `fix: persist CrowdSec hub data files across container recreation`** (#1523)
-- Files: `.docker/docker-entrypoint.sh`, `configs/crowdsec/install_hub_items.sh`, `.docker/compose/docker-compose.playwright-ci.yml`, `scripts/diagnose-crowdsec.sh`, `docs/security.md` (wording), new integration test `scripts/crowdsec_data_persistence_test.sh` (follows the pattern of `scripts/crowdsec_startup_test.sh`).
-- Depends on: none (independent of the Go commits; ordered after so a failing container gate does not block the Go work from being reviewed).
-- Tests: shell-level test (start container with a named volume, wait for hub init, assert data files and `GeoLite2-City.mmdb` exist under `/app/data/crowdsec/data`, `docker rm` and recreate with the same volume, assert files are present and `crowdsec.log` has no `unable to init data for file` / `unable to initialize GeoIP` lines after enabling CrowdSec; also run it on a volume initialized by the old image to prove the sed migration). Add `shellcheck` cleanliness for changed scripts.
-- Gate: rebuild `charon:local` (skill `docker-rebuild-e2e` / `.github/skills/scripts/skill-runner.sh docker-rebuild-e2e`), run `scripts/crowdsec_data_persistence_test.sh` and `scripts/crowdsec_startup_test.sh`; the fresh-volume case must show the install guard now really installing.
-- Additional tests: the gate must prove `hub upgrade` is **not** run on a restart with intact data files (log assertion) and **is** run (once, bounded) when data files are missing; `shellcheck` is a required gate for every changed or new shell script (`.docker/docker-entrypoint.sh`, `install_hub_items.sh`, the new test script).
-- CI wiring and ignore files: wire `scripts/crowdsec_data_persistence_test.sh` into the existing CrowdSec integration job via a skill wrapper like `.github/skills/integration-test-crowdsec-startup-scripts` and the `integration-tests.yml` workflow (rather than a new workflow). Check `.dockerignore` (it already excludes `scripts/tests/` and the toolchain scripts; the new script must be excluded from the image the same way if it lives under `scripts/`), `.gitignore`, and `.codecov.yml` (shell scripts are not coverage-measured; confirm no new exclusion needed).
-- Snapshot interaction (item 4 sequencing): Commit 3's snapshot already excludes top-level `data/` and `hub_cache/`, so Commit 6's relocation of `data_dir` into `/app/data/crowdsec/data` does not enlarge any backup; the Commit 3 size test is the regression guard.
-
-**Commit 7 - `fix: report the real CrowdSec version in the bundled binaries`** (#1524, step A: ldflags)
-- Files: `Dockerfile` (`crowdsec-inline`, both `xx-go build` lines). Bot-authored follow-up commit on the branch updates `CHARON_TOOLCHAIN_TAG` / `CHARON_TOOLCHAIN_DIGEST` (do not hand-edit those lines; the workflow owns them).
-- Depends on: none. **Wait here until the toolchain-image workflow has built and pushed the pin bump to the PR branch** (this is the only asynchronous step in the plan).
-- Gate: `toolchain-image.yml` green on the PR (build + Trivy gate), `verify-toolchain-pin` green, and a local `make build-offline`-style build (`--build-arg CROWDSEC_BUILDER_SRC=crowdsec-inline`) shows `cscli version` -> `version: v1.8.1`.
-- Expected CI state: after this commit `verify-toolchain-pin` (and any check that compares TAG/DIGEST to the recipe key) is **red until the bot pushes the new pin**. Implementers must `git pull` the bot's commit before starting Commit 8 and must not hand-edit the two ARG lines.
-
-**Commit 8 - `fix: fail the image build if CrowdSec reports no version and make the hub branch deterministic`** (#1524, step B)
-- Files: `Dockerfile` (N5 block: correct the comment, add the version assertion, add `ARG CROWDSEC_VERSION` to the final stage), `.docker/docker-entrypoint.sh` (hub branch setting per D1).
-- Depends on: Commit 7 and the bot pin bump.
-- Tests / build-time assertion: the Dockerfile `RUN` fails with a clear message if `cscli version` does not print `version: v${CROWDSEC_VERSION}`. Prove it fails by temporarily building with a mismatched `--build-arg CROWDSEC_VERSION` against the pinned toolchain (expected hard failure), then with the correct value (pass). Runtime check in the rebuilt container: `cscli version` truthful; `cscli hub update` succeeds online; with the network blocked (`--network none`) hub commands behave as the D1 decision specifies (no hard failure when `hub_branch` is set).
-- Gate: image builds; `scripts/crowdsec_startup_test.sh` green; both stderr lines `Crowdsec version is not set` and `unable to retrieve latest crowdsec version` absent from `docker logs` in the online and offline runs.
-- Record in the PR description: `cscli.hub_branch` is honoured by v1.8.1 and skips the `version.crowdsec.net` lookup (source-verified in `chooseBranch`), plus the measured online and offline (`--network none`) results.
-
-**Commit 9 - `test: enable CrowdSec preset and file-editor E2E specs and drop tolerant ones`** (#1518, final step)
-- Files: the two specs from Commit 1 (remove `fixme`), `tests/security/crowdsec-config.spec.ts` (delete the tolerant "Preset Management" assertions that are now covered by deterministic specs, or convert each remaining case to a deterministic stub; no `isVisible().catch(() => false)` guards, no "feature may not be implemented" annotations remain in `tests/security/crowdsec-*.spec.ts`).
-- Depends on: Commits 4 and 5.
-- Gate: `npx playwright test tests/security/crowdsec-hub-preset-apply.spec.ts tests/security/crowdsec-file-editor.spec.ts tests/security/crowdsec-preset-apply.spec.ts tests/security/crowdsec-config.spec.ts --project=security-tests` green. Mutation check: temporarily re-add the local-write fallback (or revert the success-status check) and confirm at least one of the new specs fails, then undo. Full-suite and cross-browser runs are CI-only.
-
-**Commit 10 - `docs: document CrowdSec preset apply safety and data persistence`**
-- Files: `ARCHITECTURE.md`, `docs/features/crowdsec.md`, `docs/troubleshooting/` entry if appropriate (see 7).
-- Depends on: all. Gate: markdown lint/pre-commit; `docs-site` manifest unchanged (new content goes into already-manifested `docs/features/` / `docs/troubleshooting/`).
-
-## 6. Decisions and Edge Cases
+## 9. Acceptance Criteria
 
-- **D1 hub branch (Q1 resolved: option A).** Options: (A, recommended) set `cscli.hub_branch: master` explicitly: identical to today's effective behavior while 1.8.1 is the latest, no dependency on `version.crowdsec.net`, no 404 risk, truthful `cscli version`. (B) Leave auto-selection with the fixed version: matches upstream's intent but can hard-fail hub commands offline and break hub updates when 1.8.1 stops being latest and the CDN has no `v1.8.1` branch (404 today). (C) Pin to the version branch: broken today (404). Commit 8 gate must run the empirical online/offline test either way.
-- **Locking (one mechanism).** A single handler-level `sync.Mutex` on `CrowdsecHandler` (e.g. `dataMu`) is held for the whole of `ApplyPreset` (both curated and hub paths), `ImportConfig` and `WriteFile`. `HubService.mu` remains as an inner guard for direct service callers; lock order is always handler mutex first, then `HubService.mu`, so no deadlock. No other lock is introduced.
-- Edge cases to cover in tests: snapshot dir name collisions (microsecond timestamp plus exclusive `os.Mkdir`), parent dir not writable, `DataDir` being a mount point (the copy path must work where rename used to fall back), symlinks inside `DataDir` never followed by restore/prune/write, concurrent apply/import/file write serialized by the handler mutex (held for the full `ApplyTimeout`, so file saves block during a long apply; `ReadFile` and `ListFiles` stay lock-free), CrowdSec stopped, existing volumes whose `config.yaml` still points at `/var/lib/crowdsec/data` (sed migration, then the gated `hub upgrade` repopulates), tmpfs `/var/lib/crowdsec` deployments (no longer relevant for data after migration).
-- Reload behavior from #1513 (SIGHUP via `reloadCrowdSec`) is unchanged and should also be triggered, best-effort, after the entrypoint-independent hub changes that happen at runtime only (not applicable to startup).
-
-## 7. Docs Impact
-
-- `ARCHITECTURE.md`: update the Layer 2 CrowdSec section (~L868-890): CrowdSec `data_dir` and LAPI db live under `/app/data/crowdsec/data` (persistent), hub data files are re-synced when missing via a gated `cscli hub upgrade`, preset applies and config edits are copy-based/atomic with bounded backup retention, `cscli version` reports the pinned version and the hub branch is explicit. The file layout table around L288-294 gets the data subdirectory note.
-- `docs/features/crowdsec.md`: extend "Curated Presets" (L57-59) / Hub Presets with the backup retention (last N kept), that hub presets are also applied on the server with a rollback, and that the config editor only accepts specific file types with validation. Add a short troubleshooting entry for the `unable to init data for file` log line (what it meant, that it self-heals on restart after this release). Keep it novice-friendly.
-- `docs/features.md`: no new capability; no change expected (confirm during Commit 10).
-- `docs/security.md`: tmpfs `/var/lib/crowdsec` guidance wording (Commit 6).
-- Changelog is generated from commit subjects; subjects in section 5.2 are written for that.
+Part A: credentials files absent from editor list and unreadable/unwritable with the correct messages; no absolute path in any CrowdSec API response, including error text, and UI still names the backup and where it is; `..`-prefixed legitimate names accepted, parent components rejected; `WithAllowedDomains` and `hubAllowLoopback` gone and all three safeclient test references handled; `validateHubURL` accepts only https allowlisted hosts; DoD passes. Part B: the six files pass the Bz grep gate; every converted test fails when the feature it names is removed (mutation spot-check per file); findings handled per section 4; targeted Playwright green.
 
-## 8. Test Plan Summary and Definition of Done
+## 10. Rollback and Contingency
 
-- **Backend unit:** new tests in Commits 3 and 4 (list above). Coverage: package and patch coverage must not drop; overall >= 85% (`scripts/go-test-coverage.sh`); `bash scripts/local-patch-report.sh` produces `test-results/local-patch-report.md/.json`.
-- **Frontend unit:** updated Vitest in Commit 5; `scripts/frontend-test-coverage.sh` >= 85%; `npm run type-check`; `npm run build`.
-- **Playwright (#1518):** deterministic stubbed specs per Commit 1/9, role-based locators, no `waitForTimeout`, no visibility-guard skips. Locally only the targeted spec files with `--project=security-tests` (security specs are excluded from the browser projects; other specs use `--project=firefox`); CI runs the full matrix.
-- **Build-time assertion (#1524):** Dockerfile `RUN` check in Commit 8 with the negative (mismatched version) and positive proof recorded in the PR description.
-- **Container integration:** `scripts/crowdsec_data_persistence_test.sh` and `scripts/crowdsec_startup_test.sh` (Commit 6/8).
-- **Security scans:** this is a `fix:` with no new endpoints; CodeQL/Trivy are deferred to CI per CLAUDE.md, except that Commit 7's toolchain Trivy gate runs in CI by design. GORM scan not required (no model changes); run it only if a model is touched.
-- **Full DoD checklist before merge (in order):** targeted Playwright (firefox) -> patch coverage preflight -> `lefthook run pre-commit` -> staticcheck (`make lint-fast`) -> backend/frontend coverage -> type-check -> `go build ./...` and `npm run build` -> clean-up (no debug prints, dead code, unused imports). Any failing test, even pre-existing, is fixed in this PR.
-- **Pipeline after the plan:** Supervisor plan review -> user approval -> implement commit by commit (`backend-dev` for 2-4, `frontend-dev` for 5, `devops` for 6-8, `playwright-dev` for 1 and 9, `docs-writer` for 10) -> Supervisor implementation review -> `qa-security` last -> `docs-writer` pass.
-- **Dispatch instructions (every subagent prompt must include these, verbatim in spirit):** run all tests, builds, coverage scripts, Playwright, linters, Docker builds and `lefthook` as **foreground, blocking** calls with the maximum timeout; never use `run_in_background`, `&`, `nohup` or end the turn waiting for a notification; if a call auto-backgrounds, immediately re-attach and poll until a real result; no worktrees; stay inside the repo (no live hosts); do not commit unless the orchestrator says so; Commit 4's text (body, comments, PR text) must stay vague per section 4; and the Commit 7 to Commit 8 hand-off requires pulling the toolchain bot's commit first.
+Commits are independent except A2 after A1 (shared fixtures) and A5 after A4. If A5 proves too large, ship A1-A4 and keep A5 as a follow-up rather than a half-migrated seam. If B surfaces a high/critical bug, split it out per section 4.
 
-## 9. Acceptance Criteria
+## 11. Open Questions (need the user's decision)
 
-1. Applying a hub preset or editing a CrowdSec file never renames, empties or removes `/app/data/crowdsec`; the live tree is intact after success and after any failure (tests prove it).
-2. Full-tree snapshot dirs (`<DataDir>.backup.*`) are bounded to 5 and single-file edit backups (`<DataDir>.filebackup.*`) to 10, independently, after any apply/import/write attempt; snapshots exclude `data/` and `hub_cache/` so they stay small.
-3. `POST /admin/crowdsec/file` validates paths, file types, YAML and size, refuses symlink writes, never renames `DataDir`, and `ReadFile`/`ListFiles` share the same validation; the frontend has no local-write fallback.
-4. After `docker rm` + recreate with the same volume, the 12 listed hub data files and `GeoLite2-City.mmdb` exist and `crowdsec.log` has no `unable to init data` / GeoIP lines; fresh volumes actually install the items in `install_hub_items.sh`.
-5. `cscli version` and `crowdsec -version` print `v1.8.1`; the image build fails if they do not; hub commands work online and offline per D1.
-6. `crowdsec_handler.go` no longer contains the preset handlers; no behavior change from the move.
-7. No tolerant "may not be implemented" Playwright tests remain for CrowdSec presets, and the mutation check in Commit 9 shows the new specs fail on regression.
-8. Only one commit uses the `(security)` scope and its subject is the vague form above.
-
-## 10. Resolved Questions (all decided by the user)
-
-- Q1 (D1): RESOLVED: explicit `cscli.hub_branch: master`.
-- Q2: RESOLVED by the user: no private advisory (issue is public; severity low, admin-only). Revisit only if implementation finds impact beyond admin privileges.
-- Q3: RESOLVED: write allowlist, protected-file list, 1 MiB cap and the refuse-symlinks rule as specced in 3.2, with a separate looser read/list predicate.
-- Q4: RESOLVED: startup log line only (no diagnostics field, no UI).
-- Q5: RESOLVED: constants (5 full snapshots, 10 file backups), not configurable.
+1. **F5**: approve hiding the two credentials files from editor list and read (recommended), or masked values, or leave as is?
+2. **Admin export**: `ExportConfig` currently includes credentials files and `bouncer_key`. Exclude secrets from the export (behavior change: an export-then-import round trip would no longer carry credentials; machine re-registers) or leave as is and document the limitation? Recommendation: leave for this batch, document it, and file a separate issue for the export decision.
+3. **Slicing**: default is one PR with commit slicing; approve the two-PR exception (A then B)?
+4. **F3 shape**: base name of the backup (recommended) plus UI location hint, versus a random id with a server-side map (not recommended).
+5. **`(security)` scope**: A1 as `fix(security): harden CrowdSec editor access` (recommended). A2 as plain `fix:` (recommended; admin-only low information exposure, and every `(security)` subject goes to the public changelog) or `fix(security): harden CrowdSec API responses`?
+6. **#1479**: remove (recommended) versus enforce in the dialer.
+7. **Include the acquisition-update `backup` field and the non-listed leak sites** (rollback text, extract/export errors) in F3 (recommended; the acceptance criterion requires it).
+8. **PR B stop rule**: N=6 real bugs then re-plan with you (recommended)?
diff --git a/docs/reports/qa_report.md b/docs/reports/qa_report.md
index 53cca0df6..cf657b559 100644
--- a/docs/reports/qa_report.md
+++ b/docs/reports/qa_report.md
@@ -1,11 +1,11 @@
-# QA and Security Report: fix/crowdsec-preset-apply-hardening (PR #1525)
+# QA and Security Report: fix/crowdsec-hub-url-and-editor-hardening
 
-Date: 2026-10-09
-Scope: full diff `origin/development...HEAD` (HEAD 513440f5), spec `docs/plans/current_spec.md` (issues #1514-#1518, #1523, #1524).
+Date: 2026-10-10
+Scope: full diff `origin/development...HEAD` (HEAD 5bb1889d, 24 commits, 57 files), spec `docs/plans/current_spec.md` and `docs/plans/crowdsec_preset_apply_hardening_1525_spec.md`. Parts: (A) CrowdSec editor access hardening, backup names instead of paths, archive-name fix, removal of the unenforced `WithAllowedDomains` option, strict hub URL allowlist; (B) #1526 Playwright rewrite of six CrowdSec specs; (C) fixes found by it (i18n keys, `sanitizeSecret`, enrollment form, export gzip).
 
 ## Verdict: PASS (no blocking findings)
 
-No critical or high findings. Two low-severity security hardening candidates are flagged for the maintainer, plus a few low/medium non-security items. None block the PR.
+No critical or high findings. One medium-low gap against the spec's own acceptance criterion ("no absolute path in any CrowdSec API response") is flagged as F1; it is admin-authenticated information exposure, so it is a maintainer decision whether to close it in this PR or file it. All Definition of Done gates pass.
 
 ## Definition of Done evidence
 
@@ -17,51 +17,55 @@ No critical or high findings. Two low-severity security hardening candidates are
 | golangci-lint, agent | `cd agent && golangci-lint run --config ../backend/.golangci.yml ./...` | 0 issues |
 | Frontend type-check | `npm run type-check` | pass |
 | Frontend build | `npm run build` | pass |
-| GORM scan | not run | no `backend/internal/models/**`, migration or GORM query files changed |
-| Lefthook | `lefthook run pre-commit --all-files` (plain run skips every hook with nothing staged) | all 17 hooks pass, including semgrep (0 findings, 367 rules), shellcheck, actionlint, dockerfile-check, golangci-lint-fast, frontend-lint |
-| govulncheck | skill `security-scan-go-vuln` | 0 affected. 1 module-level advisory, GO-2026-5932 (x/crypto/openpgp, no fix), not called by Charon code |
-| Trivy | `trivy fs --scanners vuln,misconfig --severity HIGH,CRITICAL` on go.mod/go.sum (backend, agent), package-lock.json and Dockerfile | no HIGH/CRITICAL output. The snap-confined trivy cannot read `/projects`, so the manifests were copied under `$HOME` for the scan. No container image scan was done. CI runs the full Trivy/CodeQL. |
-| CodeQL | not run locally | change is `fix:`-scoped with no new feature surface, so deferred to CI per CLAUDE.md |
-| E2E | `docker-rebuild-e2e` skill, then `npx playwright test tests/security/crowdsec-hub-preset-apply.spec.ts tests/security/crowdsec-file-editor.spec.ts tests/security/crowdsec-config.spec.ts --project=security-tests` | 27 passed, 0 failed (image rebuilt first because the Dockerfile and merge commits were newer than the running container) |
-| Coverage (given, not rerun) | prior runs | backend 90.9% stmt, frontend 91.4% lines, patch 93.9% |
-
-The `go-test-coverage` and `local-patch-report` scripts were not rerun, as instructed. The working tree stayed clean until this report was written.
-
-## Security review
-
-Reviewed against SECURITY.md. No exploit detail is given here.
-
-- `backend/internal/crowdsec/backup.go`: snapshots and restores copy rather than rename. Symlinks are preserved literally and never followed when copying. Clearing the config removes symlinks themselves, because `DirEntry.IsDir` is false for links. Directories are created 0700. Engine-owned state (live db and WAL/SHM at any depth, top-level `data/` and `hub_cache/`) is excluded from snapshot, restore, clear and import. Prune sorts by the timestamp in the directory name, uses `Lstat` and skips non-directories, so a symlinked "backup" is ignored. No issue.
-- `backend/internal/api/handlers/crowdsec_files.go`: relative-path checks use `filepath.IsLocal`, so NUL, absolute and `..` paths are rejected. Read resolves symlinks, checks containment, re-applies the deny-list to the resolved path and requires a regular file. Write refuses any symlink along the path and any non-regular target. It also enforces the extension allowlist, the credential-file deny-list, the temp-prefix deny-list, `hub/` and `config/hub/` exclusion, a 1 MiB content cap and an 8 MiB body cap (`MaxBytesReader`). Writes go through a temp file, fsync and rename, and the original mode is preserved. A single-file backup is taken before the write. Operations serialize on `dataMu`. Logged errors go through `sanitizeForLog`. Adequate. Minor items are F2 to F4 below.
-- `crowdsec_handler.go` `ImportConfig`: takes `dataMu`, then snapshots, clears, extracts and validates. It rolls back in place on failure and then prunes. The extractor blocks traversal and skips engine-owned entries, and symlink and hardlink entries are not materialized. Lock order is documented (`dataMu` before `HubService.mu`). See F3.
-- `hub_sync.go` and `curated_apply.go`: apply is now snapshot, then cscli or extract, then restore on failure, with prune afterwards. The extractor rejects symlink entries, traversal and absolute paths, strips setuid and setgid bits, caps decompressed size at 100 MB and skips engine-owned paths. See F1.
-- `.docker/docker-entrypoint.sh`: the new `data_dir` redirect, `hub_branch` pin and missing-data recovery are idempotent and non-fatal. `hub upgrade` is bounded by `timeout 120s`. Values read from hub YAML (`dest_file`) are only used in `[ -e ]` tests and echoes, never executed or written. All variables are quoted. shellcheck passes.
-- `configs/crowdsec/install_hub_items.sh`: the `is_installed` helper greps the JSON "installed" flag. No injection surface (arguments are static).
-- `Dockerfile`: the XMOD pin is parameterized and registered in `scripts/toolchain-key.sh` and the toolchain key. The x/net and x/crypto re-pin and the post-build `go version -m` guards are correct (`sort -V` floor check, fails the build). The ldflags target `go-cs-lib/version.Version`, and a new cscli `version: v${CROWDSEC_VERSION}` assertion guards against a silent no-op `-X`. The toolchain tag and digest were synced. No weakening.
-- Frontend `CrowdSecConfig.tsx`: the client-side preset fallback write is removed, so the server is authoritative. Server error text is rendered via toast text (React-escaped), so there is no XSS. Mutation errors now surface.
-- CI: the new `notify-codecov` job uses a SHA-pinned action, `persist-credentials: false` and a minimal `if` guard. The persistence integration step is wired with cleanup.
+| GORM scan | not run | no `backend/internal/models/**`, migration or GORM query files changed (0 matches in the diff) |
+| Lefthook | `lefthook run pre-commit --all-files` | all 17 hooks pass, including semgrep (0 findings, 367 rules; it logged timeout warnings on three large test files, which are scan-coverage notes, not findings), shellcheck, actionlint, golangci-lint-fast, frontend-lint. Working tree stayed clean. |
+| govulncheck | skill `security-scan-go-vuln` | 0 affected; 1 module-level advisory in a required module that Charon code does not call |
+| Trivy | `trivy fs --scanners vuln,misconfig --severity HIGH,CRITICAL` on go.mod/go.sum (backend, agent), package-lock.json and Dockerfile | no HIGH/CRITICAL. The snap trivy cannot read `/projects`, so the manifests were copied under `$HOME` and removed afterwards. No container-image scan locally. |
+| CodeQL | not run locally | `fix:`/`test:` scope, no new feature surface, deferred to CI per CLAUDE.md |
+| E2E | `npx playwright test <nine crowdsec specs> --project=security-tests` | 179 passed, 0 failed (8.4 min). The E2E container (built at 841955af) is valid for HEAD: `git diff 841955af..HEAD` touches only `_test.go`, vitest and Playwright files. |
+| Coverage (given, not rerun) | prior runs | backend 91.0% stmt / 90.1% line, frontend 91.46% lines, patch 98.9% |
+
+## Check-by-check results
+
+1. **No absolute path in responses.** All nine leak sites from spec section 2.3 are closed: `backup` fields now go through `crowdsec.BackupID` (file write, import, preset apply success and failure, curated apply, acquisition update); `rollbackFailure`, extractor, `CreateFileNoSymlink` and import/export errors no longer embed paths; preset pull/apply, import validation errors pass through `RedactPaths`. Backed by `crowdsec_response_paths_test.go` and the live E2E checks. Residual gaps are listed as F1 and F2.
+2. **`sanitizeSecret`.** Still masks anything alphanumeric 10-64 chars that mixes letters and digits, and letters-only runs of 32+. A letters-only token of 10-31 chars, or one split by `-`/`_`, is not masked client-side (previously every 10-64 char run was masked). Real enrollment keys are random alphanumeric, so the chance of a digit-free 25-char key is negligible, and the backend already redacts the exact token (`redactSecret`, `console_enroll.go:421`) before any message reaches the client. Acceptable as defense in depth; see F3.
+3. **Hub URL check.** `validateHubURL` now accepts only https plus the three allowlisted hosts. Previously `localhost`, `127.0.0.1`, `::1`, `*.example.com`, `*.example`, `*.local` and `test.hub` passed this layer, but the dial layer (`NewSafeHTTPClient`) already blocked loopback and private targets in production, and unknown public hosts were already rejected by the allowlist. So no production behavior changes for `HUB_BASE_URL` or `HUB_MIRROR_BASE_URL`; the docs note (`docs/troubleshooting/crowdsec.md`) is accurate. Redirects: the hub client uses default `MaxRedirects` 0 (`CheckRedirect` returns `ErrUseLastResponse`), so a redirect cannot reach an unvalidated host. `WithAllowedDomains` was never read anywhere (`AllowedDomains` had no consumers), so its removal is behavior-neutral and the SSRF protection actually relied on the dial layer plus `validateHubURL`. The test seam `HubService.validateURL` is an unexported field set in exactly one test (`hub_sync_test.go:117`, a local httptest server); production never sets it and nothing outside the package can. The other tests use allowlisted hostnames with mock transports, or unreachable `127.0.0.1:1` URLs that only assert failure (`backup_test.go:598-663`), so none depends on a real non-production host.
+4. **gzip exclusion.** gin-contrib/gzip v1.2.8 matches `strings.HasPrefix(requestURI, path)`. The only registered route with the prefix `/api/v1/admin/crowdsec/export` is `GET /admin/crowdsec/export`; `/admin/crowdsec/decisions/export` does not start with it. No other route is excluded. Caveat in F5.
+5. **E2E tolerance.** The Bz command from the spec over the six files returns nothing (exit 1). An extra scan of the six specs and both helpers for `console.log`, `annotations.push`, `test.fixme` and `.skip(` also returns nothing. `tests/` is in `.dockerignore`, not copied by the Dockerfile, and `crowdsec-stubs.ts` / `archive-helpers.ts` are not imported from `frontend/` or `backend/`, so no test helper ships in a production bundle.
+6. **Commit subjects.** Reviewed with `git log origin/development..HEAD --format=%s`. The only `(security)` subject, `fix(security): harden CrowdSec editor access`, is vague. See F4 for two non-scoped subjects that are slightly specific.
+7. **Security-sensitive items.** See F1 and F6; no exploit detail is given.
 
 ## Findings
 
 No critical or high findings.
 
-### Security-sensitive (do not file publicly; maintainer to decide on advisory or hardening commit)
+### Security-sensitive (do not file publicly; maintainer to decide)
 
-**S1: low.** `backend/internal/crowdsec/hub_sync.go:951-971` (`extractTarGz` file open). The old flow emptied the target before extracting; the new documented overlay design does not. File creation uses `O_CREATE|O_TRUNC` without a symlink check on the destination, so it follows any pre-existing link in the live tree. The archive is hub-sourced and cached, and symlink entries in the archive are already rejected, so exploitation needs a hostile hub archive plus an existing link. The spec's "residual risk" note covers overlaying but not this write-through. Suggested hardening: `Lstat` the destination (and ideally its parents) and refuse symlinks, or open with `O_NOFOLLOW`.
+**F1: low-medium (information exposure, admin-authenticated).** Absolute server paths can still reach CrowdSec API responses at sites that the spec did not enumerate, contradicting its acceptance criterion "no absolute path in any CrowdSec API response, including error text":
+- `backend/internal/api/handlers/crowdsec_handler.go:1977` and `:1986`: `GET /admin/crowdsec/acquisition` returns `path` (the acquisition file location) on both 404 and 200. The frontend does not read it.
+- `crowdsec_handler.go` diagnostics config (`~2136-2230`): `validation["config_path"]` and `validation["acquis_path"]` return absolute paths. The frontend does not read them.
+- `crowdsec_handler.go:522` (Start), `:596` (Stop), `:624` (Status), `:978` (ClearEnrollment), `:2250` (console status), and `crowdsec_preset_handler.go:395` (preview) return raw `err.Error()`. The executor errors wrap filesystem errors (`crowdsec_exec.go:71` "failed to write pid file: %w", `:92` "pid file read: %w"), which embed the pid-file path.
+Suggested remediation: drop the `path` fields (or return a fixed label), and either pass those errors through `crowdsec.RedactPaths` or return fixed messages and log the detail. Add the sites to `crowdsec_response_paths_test.go`.
 
-**S2: low.** `backend/internal/api/handlers/crowdsec_handler.go:793` (`extractArchive`). Same pattern: `OpenFile` without `O_EXCL` or `O_TRUNC`, which can leave stale trailing bytes when an archive repeats a name. The tree is cleared first, so impact is limited to duplicate entries. Fix: `O_CREATE|O_WRONLY|O_TRUNC` plus a symlink check.
+**F6: low (documented limitation).** `ExportConfig` still archives the credentials files and `bouncer_key` that the editor now hides (the spec records this as a known limitation and defers the decision). `docs/features/crowdsec.md` and `docs/features.md` say the editor no longer lists the credential files but do not mention that the config export still includes them, which could give false assurance. Suggested: one sentence in the docs and a tracked issue for the export decision.
 
-### Medium and low non-security (for the maintainer to file)
+### Non-security (for the maintainer to file)
 
-- **F1: low.** `backend/internal/crowdsec/hub_sync.go:954-957`. The containment check compares against `rel == ".."` and uses `HasPrefix(cleanName, "..")`, which also rejects legitimate names starting with `..` (for example `..foo`). Cosmetic and safe, since it errs on the strict side.
-- **F2: low (information exposure to authenticated admin).** `crowdsec_files.go:300` and `:325` return `err.Error()` to the client on 500, which can embed absolute server paths. Other branches use fixed messages. Suggested: generic message and log the detail with `fileErrorLog`.
-- **F3: low.** The `backup` field in the `WriteFile` (`crowdsec_files.go:391`) and `ImportConfig` (`crowdsec_handler.go:727`) responses returns an absolute server path. This is consistent with the existing preset-apply behavior and with UI expectations, so it is likely intentional. The extraction error response in `crowdsec_handler.go:715` also interpolates the archive entry name and `%v` error text.
-- **F4: low.** `ReadFile` (`crowdsec_files.go:319`) has no read-size cap (the write cap is 1 MiB). The risk is small because the endpoint is admin-only and the tree is config-sized.
-- **F5: info.** `local_api_credentials.yaml` and `online_api_credentials.yaml` are write-protected but readable and listed by the editor. This matches the design where `isWritable` is a subset of `isReadable`; confirm that exposing them to admins in the UI is intended.
-- **F6: low (test quality).** Known and accepted: #1526 (tolerant Playwright specs).
+- **F2: low.** `RedactPaths` (`crowdsec/backup.go:351-356`) only redacts absolute paths preceded by whitespace, a quote, `(` or `=` and ends them at whitespace, `:`, `;`, `)` or a quote. Paths preceded by `[`, `{`, `,`, `<`, `@` or `:`, and the tail of a path containing a space or colon, would pass through. Today every redacted source (cscli output, validators, extractor) uses the "open /path: reason" form, so nothing leaks in tested cases; the function is a safety net, not a guarantee. It also rewrites non-path text such as " /api/v1/x" to `<path>` (cosmetic).
+- **F3: low.** `frontend/src/utils/sanitizeSecret.ts:10-18` no longer masks letters-only runs of 10-31 characters (see check 2). Backend redaction is the primary control. Optional: keep masking any 20+ char run regardless of content.
+- **F4: low (changelog wording).** `fix: stop returning server paths in CrowdSec responses` (66a4aced) and `refactor: remove the unenforced allowed-domains client option` (1725feb8) are not `(security)`-scoped but name the issue category fairly directly and will appear verbatim in the public changelog. Consider rewording before merge, for example `fix: show CrowdSec backups by name` and `refactor: remove unused HTTP client option`. No hash is pushed yet, so rewording is cheap.
+- **F5: info.** `routes.go:1260` excludes by URI prefix, so any future route that begins with `/api/v1/admin/crowdsec/export` (for example `export-foo`, or a query string) would also skip compression. Harmless today; an exact-path or regex exclusion would be stricter.
+- **F7: info.** The prior report's S1/S2 (extraction opens destination files without a symlink check in `extractTarGz` and `ImportConfig.extractArchive`) were not re-audited in this pass beyond the changed lines; `CreateFileNoSymlink` is unchanged in behavior.
 
 ## Out of scope and not verified
 
-- Codecov manual-trigger behavior cannot be tested locally.
 - Full-suite and cross-browser E2E are deferred to CI.
 - CodeQL and a container-image Trivy scan are deferred to CI.
+- Coverage and local patch scripts were not rerun, as instructed.
+
+## Resolution (F1, F2 and the remaining findings)
+
+- **F1: fixed.** `GET /admin/crowdsec/acquisition` no longer returns `path`; `GET /admin/crowdsec/diagnostics/config` no longer returns `config_path` or `acquis_path` (nothing in `frontend/src` or `tests/` read them). Start, Stop, Status, ClearEnrollment, console heartbeat and the preset cache preview/metadata handlers now return fixed messages and log the detail server-side; console enrollment errors, which are user-facing validation text, pass through `RedactPaths`. Covered by `crowdsec_response_paths_test.go`.
+- **F2: fixed.** `RedactPaths` now matches absolute paths at the start of the string or after whitespace, a quote, `(`, `[`, `{`, `<`, `=` or `,`, ends them at whitespace, a quote or `: ; , ) ] } > <`, and leaves text under `/api/` untouched. Remaining limits (paths containing spaces or `:`, Windows or relative paths) are documented on the function; handlers prefer fixed messages. Covered by `TestRedactPaths`.
+- **F3, F5: reviewed and left** as low or informational, as recommended (backend redaction is the primary control; the gzip exclusion is exact for every registered route).
+- **F4: handled by commit rewording** before merge.
diff --git a/docs/troubleshooting/crowdsec.md b/docs/troubleshooting/crowdsec.md
index 7279858a4..5eb44dd40 100644
--- a/docs/troubleshooting/crowdsec.md
+++ b/docs/troubleshooting/crowdsec.md
@@ -15,8 +15,11 @@ Keep Cerberus terminology and the Configuration Packages flow in mind while debu
   - Bare-metal deployments: install cscli for Hub preset sync or use HTTP fallback with HUB_BASE_URL.
 - HUB_BASE_URL points to a JSON hub endpoint (default: <https://hub-data.crowdsec.net/api/index.json>). Redirects to HTML will be rejected.
   - A loopback hub mirror is no longer reachable from the hub client; RFC 1918 hosts were already blocked.
+  - The hub address must be an `https` address on the official CrowdSec hub hosts. Custom `http`, local, or other mirror addresses are not supported.
 - Proxy env is set when required: HTTP(S)_PROXY and NO_PROXY are respected by the hub client.
 - For slow or proxied networks, increase HUB_PULL_TIMEOUT_SECONDS (default 25) and HUB_APPLY_TIMEOUT_SECONDS (default 45) to avoid premature timeouts.
+- The config file editor hides CrowdSec's account and connection credential files; they remain on disk (see `docker exec charon ls -la /app/data/crowdsec/config`).
+- Backups sit next to the CrowdSec data folder, named `crowdsec.backup.<timestamp>` and `crowdsec.filebackup.<timestamp>`. Acquisition settings are backed up as `acquis.yaml.backup.<timestamp>` right beside the acquisition file. For manual recovery, run `docker exec charon ls -la /app/data` to find them, stop CrowdSec, copy the one you want back, then start it again.
 - Preset workflow: pull from Hub using cache keys/ETags → preview changes → apply with automatic backup and reload flag.
 - Preset pull/apply requires either cscli or cached presets.
 - Offline/curated presets remain available at all times.
diff --git a/frontend/src/components/crowdsec/DashboardTimeRangeSelector.tsx b/frontend/src/components/crowdsec/DashboardTimeRangeSelector.tsx
index 80897a3bf..0c0511fd3 100644
--- a/frontend/src/components/crowdsec/DashboardTimeRangeSelector.tsx
+++ b/frontend/src/components/crowdsec/DashboardTimeRangeSelector.tsx
@@ -57,7 +57,7 @@ export function DashboardTimeRangeSelector({ value, onChange }: DashboardTimeRan
   return (
     <div
       role="radiogroup"
-      aria-label={t('security.crowdsec.dashboard.timeRange', 'Time range')}
+      aria-label={t('security.crowdsec.dashboard.timeRangeLabel')}
       className="inline-flex rounded-lg border border-gray-700 bg-gray-900 p-1"
     >
       {RANGES.map((range, i) => (
diff --git a/frontend/src/hooks/__tests__/useConsoleEnrollment.test.tsx b/frontend/src/hooks/__tests__/useConsoleEnrollment.test.tsx
index 24e750b3c..3dadd2209 100644
--- a/frontend/src/hooks/__tests__/useConsoleEnrollment.test.tsx
+++ b/frontend/src/hooks/__tests__/useConsoleEnrollment.test.tsx
@@ -3,11 +3,13 @@ import { renderHook, waitFor } from '@testing-library/react'
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 
 import * as consoleEnrollmentApi from '../../api/consoleEnrollment'
-import { useConsoleStatus, useEnrollConsole } from '../useConsoleEnrollment'
+import { toast } from '../../utils/toast'
+import { useClearConsoleEnrollment, useConsoleStatus, useEnrollConsole } from '../useConsoleEnrollment'
 
 import type { ConsoleEnrollmentStatus, ConsoleEnrollPayload } from '../../api/consoleEnrollment'
 
 vi.mock('../../api/consoleEnrollment')
+vi.mock('../../utils/toast', () => ({ toast: { success: vi.fn(), error: vi.fn(), info: vi.fn() } }))
 
 describe('useConsoleEnrollment hooks', () => {
   let queryClient: QueryClient
@@ -528,4 +530,28 @@ describe('useConsoleEnrollment hooks', () => {
       expect(result.current.data?.agent_name).toBeUndefined()
     })
   })
+
+  describe('useClearConsoleEnrollment', () => {
+    it('invalidates console status on success', async () => {
+      vi.mocked(consoleEnrollmentApi.clearConsoleEnrollment).mockResolvedValue(undefined)
+      const invalidate = vi.spyOn(queryClient, 'invalidateQueries')
+
+      const { result } = renderHook(() => useClearConsoleEnrollment(), { wrapper })
+      result.current.mutate()
+
+      await waitFor(() => expect(result.current.isSuccess).toBe(true))
+      expect(invalidate).toHaveBeenCalledWith({ queryKey: ['crowdsec-console-status'] })
+      expect(toast.error).not.toHaveBeenCalled()
+    })
+
+    it('shows an error toast when clearing fails', async () => {
+      vi.mocked(consoleEnrollmentApi.clearConsoleEnrollment).mockRejectedValue(new Error('backend unavailable'))
+
+      const { result } = renderHook(() => useClearConsoleEnrollment(), { wrapper })
+      result.current.mutate()
+
+      await waitFor(() => expect(result.current.isError).toBe(true))
+      expect(toast.error).toHaveBeenCalledWith('Failed to clear enrollment state: backend unavailable')
+    })
+  })
 })
diff --git a/frontend/src/hooks/useConsoleEnrollment.ts b/frontend/src/hooks/useConsoleEnrollment.ts
index 9dc199a80..6ef970470 100644
--- a/frontend/src/hooks/useConsoleEnrollment.ts
+++ b/frontend/src/hooks/useConsoleEnrollment.ts
@@ -1,6 +1,10 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { isAxiosError } from 'axios'
+import { useTranslation } from 'react-i18next'
 
 import { enrollConsole, getConsoleStatus, clearConsoleEnrollment, type ConsoleEnrollPayload, type ConsoleEnrollmentStatus } from '../api/consoleEnrollment'
+import { sanitizeSecret } from '../utils/sanitizeSecret'
+import { toast } from '../utils/toast'
 
 export function useConsoleStatus(enabled = true) {
   return useQuery<ConsoleEnrollmentStatus>({ queryKey: ['crowdsec-console-status'], queryFn: getConsoleStatus, enabled })
@@ -18,11 +22,16 @@ export function useEnrollConsole() {
 
 export function useClearConsoleEnrollment() {
   const queryClient = useQueryClient()
+  const { t } = useTranslation()
 
   return useMutation({
     mutationFn: clearConsoleEnrollment,
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['crowdsec-console-status'] })
     },
+    onError: (err: unknown) => {
+      const detail = isAxiosError(err) ? err.response?.data?.error || err.message : err instanceof Error ? err.message : ''
+      toast.error(t('crowdsecConfig.reenroll.clearFailed', { message: sanitizeSecret(String(detail)) }))
+    },
   })
 }
diff --git a/frontend/src/locales/de/translation.json b/frontend/src/locales/de/translation.json
index 1f9cf3085..cb0c69668 100644
--- a/frontend/src/locales/de/translation.json
+++ b/frontend/src/locales/de/translation.json
@@ -384,8 +384,17 @@
           "24h": "24h",
           "7d": "7d",
           "30d": "30d"
-        }
-      }
+        },
+        "timeRangeLabel": "Zeitraum"
+      },
+      "bouncerApiKey": "Bouncer-API-Schlüssel",
+      "keyCopied": "API-Schlüssel in die Zwischenablage kopiert",
+      "keyStoredAt": "Schlüssel gespeichert unter",
+      "noKeyConfigured": "Kein Bouncer-Schlüssel konfiguriert. Aktivieren Sie CrowdSec für die automatische Registrierung.",
+      "notRegistered": "Nicht registriert",
+      "registered": "Registriert",
+      "sourceEnvVar": "Aus Umgebungsvariable",
+      "sourceFile": "Aus Datei"
     },
     "acl": {
       "title": "Zugriffskontrolle",
@@ -1167,7 +1176,7 @@
       "goToSecurity": "Zum Sicherheits-Dashboard",
       "enrollmentToken": "Registrierungstoken",
       "tokenPlaceholder": "Fügen Sie Ihr Registrierungstoken von der CrowdSec-Konsole ein",
-      "agentName": "Agent-Name (optional)",
+      "agentName": "Agent-Name",
       "agentPlaceholder": "meine-charon-instanz",
       "tenant": "Mandant/Organisation (optional)",
       "tenantPlaceholder": "org-id-aus-konsole",
@@ -1186,7 +1195,15 @@
       "tenantLabel": "Mandant",
       "lastAttempt": "Letzter Versuch",
       "enrolledAt": "Registriert",
-      "correlationId": "Korrelations-ID"
+      "correlationId": "Korrelations-ID",
+      "lastError": "Letzter Fehler",
+      "ackText": "Mir ist bekannt, dass meine LAPI-Zugangsdaten rotiert werden, falls bereits registriert",
+      "description": "Verbinden Sie Ihre CrowdSec-LAPI mit der CrowdSec Console für zentrale Verwaltung und Warnungen.",
+      "enrollToken": "Registrierungstoken",
+      "lastHeartbeat": "Letzter Heartbeat",
+      "privacyNote": "Hinweis: Die Registrierung sendet Heartbeat-Daten und Metriken an CrowdSec. Details finden Sie in der Datenschutzrichtlinie von CrowdSec.",
+      "tenantHelper": "Optional: Mandanten-/Organisations-ID angeben, falls Sie ein Multi-Tenant-Setup verwenden",
+      "tokenHelper": "Holen Sie sich Ihr Registrierungstoken aus der CrowdSec Console"
     },
     "reenroll": {
       "title": "Neu-Registrierungsoptionen",
@@ -1202,14 +1219,16 @@
       "reenrolling": "Neu registrieren...",
       "clearState": "Registrierungsstatus löschen",
       "clearing": "Lösche...",
-      "clearConfirm": "Dies löscht den lokalen Registrierungsstatus. Möglicherweise müssen Sie sich erneut registrieren. Fortfahren?"
+      "clearConfirm": "Dies löscht den lokalen Registrierungsstatus. Möglicherweise müssen Sie sich erneut registrieren. Fortfahren?",
+      "clearFailed": "Der Registrierungsstatus konnte nicht gelöscht werden: {{message}}"
     },
     "packages": {
       "title": "Konfigurationspakete",
       "description": "Exportieren oder importieren Sie CrowdSec-Konfigurationspakete (tar.gz/zip). Vor dem Import wird ein Backup erstellt.",
       "export": "Exportieren",
       "import": "Importieren",
-      "importing": "Importiere..."
+      "importing": "Importiere...",
+      "selectFile": "CrowdSec-Paketdatei auswählen"
     },
     "presets": {
       "title": "Vorlagen",
@@ -1235,18 +1254,22 @@
       "previewUnavailable": "Vorschau nicht verfügbar",
       "applied": "Angewendet",
       "backup": "Backup",
+      "backupCreated": "Sicherung erstellt: {{name}} ({{location}})",
+      "backupLocation": "neben dem CrowdSec-Datenverzeichnis gespeichert",
       "reload": "Neu laden",
       "required": "Erforderlich",
       "method": "Methode",
       "filesystem": "Dateisystem",
       "loadCached": "Zwischengespeicherte Vorschau laden",
       "applyDisabled": "Anwenden deaktiviert, solange Hub offline ist.",
-      "noPresets": "Keine Vorlagen verfügbar. Stellen Sie sicher, dass Cerberus aktiviert ist."
+      "noPresets": "Keine Vorlagen verfügbar. Stellen Sie sicher, dass Cerberus aktiviert ist.",
+      "sortBy": "Presets sortieren"
     },
     "files": {
       "title": "Konfigurationsdateien bearbeiten",
       "selectFile": "Datei auswählen...",
-      "refresh": "Aktualisieren"
+      "refresh": "Aktualisieren",
+      "content": "Dateiinhalt"
     },
     "bannedIps": {
       "title": "Gesperrte IPs",
@@ -1281,7 +1304,38 @@
       "title": "Entsperrung bestätigen",
       "confirm": "Sind Sie sicher, dass Sie entsperren möchten",
       "submit": "Entsperren"
-    }
+    },
+    "lapiInitializing": "CrowdSec läuft, aber die lokale API wird noch initialisiert.",
+    "lapiInitializingDesc": "Die Console-Registrierung ist verfügbar, sobald die lokale API bereit ist. Das kann nach dem Start von CrowdSec bis zu einer Minute dauern.",
+    "checkingAgain": "(wird erneut geprüft...)",
+    "notRunning": "CrowdSec läuft nicht",
+    "notRunningDesc": "Starten Sie CrowdSec, bevor Sie sich in der Console registrieren.",
+    "starting": "CrowdSec wird gestartet...",
+    "startFailed": "CrowdSec konnte nicht gestartet werden",
+    "startCrowdsec": "CrowdSec starten",
+    "goToSecurity": "Zu Sicherheit wechseln",
+    "whitelist": {
+      "tabLabel": "Whitelist",
+      "title": "IP-Whitelist",
+      "description": "IPs und CIDRs auf der Whitelist werden von CrowdSec nie blockiert, auch wenn sie Warnungen auslösen.",
+      "ipLabel": "IP oder CIDR",
+      "reasonLabel": "Grund",
+      "reasonPlaceholder": "Optionaler Grund",
+      "addMyIp": "Meine IP hinzufügen",
+      "none": "Keine Whitelist-Einträge",
+      "columnIp": "IP / CIDR",
+      "columnReason": "Grund",
+      "columnAdded": "Hinzugefügt",
+      "deleteAriaLabel": "Whitelist-Eintrag entfernen für",
+      "delete": "Löschen",
+      "deleteModal": {
+        "title": "Whitelist-Eintrag entfernen",
+        "body": "{{ip}} von der Whitelist entfernen? CrowdSec kann diese IP dann blockieren, wenn sie Warnungen auslöst.",
+        "submit": "Entfernen"
+      }
+    },
+    "noConfig": "CrowdSec-Konfiguration im Sicherheitsstatus nicht gefunden",
+    "noteText": "CrowdSec wird über den Schalter auf der Seite gesteuert:"
   },
   "smtp": {
     "title": "E-Mail (SMTP) Einstellungen",
diff --git a/frontend/src/locales/en/translation.json b/frontend/src/locales/en/translation.json
index a72858cbd..46c2de23c 100644
--- a/frontend/src/locales/en/translation.json
+++ b/frontend/src/locales/en/translation.json
@@ -488,7 +488,8 @@
           "24h": "24h",
           "7d": "7d",
           "30d": "30d"
-        }
+        },
+        "timeRangeLabel": "Time range"
       }
     },
     "acl": {
@@ -1505,7 +1506,7 @@
       "goToSecurity": "Go to Security Dashboard",
       "enrollmentToken": "Enrollment Token",
       "tokenPlaceholder": "Paste your enrollment token from CrowdSec Console",
-      "agentName": "Agent Name (optional)",
+      "agentName": "Agent Name",
       "agentPlaceholder": "my-charon-instance",
       "tenant": "Tenant/Organization (optional)",
       "tenantPlaceholder": "org-id-from-console",
@@ -1524,7 +1525,8 @@
       "tenantLabel": "Tenant",
       "lastAttempt": "Last attempt",
       "enrolledAt": "Enrolled",
-      "correlationId": "Correlation ID"
+      "correlationId": "Correlation ID",
+      "lastError": "Last error"
     },
     "reenroll": {
       "title": "Re-enrollment Options",
@@ -1540,14 +1542,16 @@
       "reenrolling": "Re-enrolling...",
       "clearState": "Clear enrollment state",
       "clearing": "Clearing...",
-      "clearConfirm": "This will clear local enrollment state. You may need to re-enroll. Continue?"
+      "clearConfirm": "This will clear local enrollment state. You may need to re-enroll. Continue?",
+      "clearFailed": "Failed to clear enrollment state: {{message}}"
     },
     "packages": {
       "title": "Configuration Packages",
       "description": "Export or import CrowdSec configuration packages (tar.gz/zip). A backup is created before importing.",
       "export": "Export",
       "import": "Import",
-      "importing": "Importing..."
+      "importing": "Importing...",
+      "selectFile": "Select CrowdSec package file"
     },
     "presets": {
       "title": "Presets",
@@ -1573,18 +1577,22 @@
       "previewUnavailable": "Preview unavailable",
       "applied": "Applied",
       "backup": "Backup",
+      "backupCreated": "Backup created: {{name}} ({{location}})",
+      "backupLocation": "stored next to the CrowdSec data directory",
       "reload": "Reload",
       "required": "Required",
       "method": "Method",
       "filesystem": "Filesystem",
       "loadCached": "Load cached preview",
       "applyDisabled": "Apply disabled while hub is offline.",
-      "noPresets": "No presets available. Ensure Cerberus is enabled."
+      "noPresets": "No presets available. Ensure Cerberus is enabled.",
+      "sortBy": "Sort presets"
     },
     "files": {
       "title": "Edit Configuration Files",
       "selectFile": "Select a file...",
-      "refresh": "Refresh"
+      "refresh": "Refresh",
+      "content": "File content"
     },
     "bannedIps": {
       "title": "Banned IPs",
@@ -1619,6 +1627,35 @@
       "title": "Confirm Unban",
       "confirm": "Are you sure you want to unban",
       "submit": "Unban"
+    },
+    "lapiInitializing": "CrowdSec is running, but the Local API is still initializing.",
+    "lapiInitializingDesc": "Console enrollment will be available once the Local API is ready. This can take up to a minute after CrowdSec starts.",
+    "checkingAgain": "(checking again...)",
+    "notRunning": "CrowdSec is not running",
+    "notRunningDesc": "Start CrowdSec before enrolling in the Console.",
+    "starting": "Starting CrowdSec...",
+    "startFailed": "Failed to start CrowdSec",
+    "startCrowdsec": "Start CrowdSec",
+    "goToSecurity": "Go to Security",
+    "whitelist": {
+      "tabLabel": "Whitelist",
+      "title": "IP Whitelist",
+      "description": "Whitelisted IPs and CIDRs are never blocked by CrowdSec, even if they trigger alerts.",
+      "ipLabel": "IP or CIDR",
+      "reasonLabel": "Reason",
+      "reasonPlaceholder": "Optional reason",
+      "addMyIp": "Add My IP",
+      "none": "No whitelist entries",
+      "columnIp": "IP / CIDR",
+      "columnReason": "Reason",
+      "columnAdded": "Added",
+      "deleteAriaLabel": "Remove whitelist entry for",
+      "delete": "Delete",
+      "deleteModal": {
+        "title": "Remove Whitelist Entry",
+        "body": "Remove {{ip}} from the whitelist? CrowdSec may then block this IP if it triggers alerts.",
+        "submit": "Remove"
+      }
     }
   },
   "smtp": {
diff --git a/frontend/src/locales/es/translation.json b/frontend/src/locales/es/translation.json
index 7768f0d6f..8720ce0f4 100644
--- a/frontend/src/locales/es/translation.json
+++ b/frontend/src/locales/es/translation.json
@@ -384,8 +384,17 @@
           "24h": "24h",
           "7d": "7d",
           "30d": "30d"
-        }
-      }
+        },
+        "timeRangeLabel": "Rango de tiempo"
+      },
+      "bouncerApiKey": "Clave API del bouncer",
+      "keyCopied": "Clave API copiada al portapapeles",
+      "keyStoredAt": "Clave almacenada en",
+      "noKeyConfigured": "No hay clave de bouncer configurada. Active CrowdSec para el registro automático.",
+      "notRegistered": "No registrado",
+      "registered": "Registrado",
+      "sourceEnvVar": "Desde variable de entorno",
+      "sourceFile": "Desde archivo"
     },
     "acl": {
       "title": "Control de Acceso",
@@ -1169,7 +1178,7 @@
       "goToSecurity": "Ir al Panel de Seguridad",
       "enrollmentToken": "Token de inscripción",
       "tokenPlaceholder": "Pegue su token de inscripción de la Consola CrowdSec",
-      "agentName": "Nombre del agente (opcional)",
+      "agentName": "Nombre del agente",
       "agentPlaceholder": "mi-instancia-charon",
       "tenant": "Inquilino/Organización (opcional)",
       "tenantPlaceholder": "id-org-de-consola",
@@ -1188,7 +1197,15 @@
       "tenantLabel": "Inquilino",
       "lastAttempt": "Último intento",
       "enrolledAt": "Inscrito",
-      "correlationId": "ID de correlación"
+      "correlationId": "ID de correlación",
+      "lastError": "Último error",
+      "ackText": "Entiendo que esto rotará mis credenciales de LAPI si ya estoy registrado",
+      "description": "Conecte su LAPI de CrowdSec a la consola de CrowdSec para gestión centralizada y alertas.",
+      "enrollToken": "Token de registro",
+      "lastHeartbeat": "Último latido",
+      "privacyNote": "Nota: El registro envía datos de latido y métricas a CrowdSec. Consulte la política de privacidad de CrowdSec para más detalles.",
+      "tenantHelper": "Opcional: indique el ID de inquilino/organización si usa una configuración multiinquilino",
+      "tokenHelper": "Obtenga su token de registro en la consola de CrowdSec"
     },
     "reenroll": {
       "title": "Opciones de reinscripción",
@@ -1204,14 +1221,16 @@
       "reenrolling": "Reinscribiendo...",
       "clearState": "Limpiar estado de inscripción",
       "clearing": "Limpiando...",
-      "clearConfirm": "Esto limpiará el estado de inscripción local. Puede que necesite reinscribirse. ¿Continuar?"
+      "clearConfirm": "Esto limpiará el estado de inscripción local. Puede que necesite reinscribirse. ¿Continuar?",
+      "clearFailed": "No se pudo borrar el estado de registro: {{message}}"
     },
     "packages": {
       "title": "Paquetes de configuración",
       "description": "Exporte o importe paquetes de configuración de CrowdSec (tar.gz/zip). Se crea una copia de seguridad antes de importar.",
       "export": "Exportar",
       "import": "Importar",
-      "importing": "Importando..."
+      "importing": "Importando...",
+      "selectFile": "Seleccionar archivo de paquete de CrowdSec"
     },
     "presets": {
       "title": "Plantillas",
@@ -1237,18 +1256,22 @@
       "previewUnavailable": "Vista previa no disponible",
       "applied": "Aplicado",
       "backup": "Respaldo",
+      "backupCreated": "Copia de seguridad creada: {{name}} ({{location}})",
+      "backupLocation": "almacenada junto al directorio de datos de CrowdSec",
       "reload": "Recargar",
       "required": "Requerido",
       "method": "Método",
       "filesystem": "Sistema de archivos",
       "loadCached": "Cargar vista previa en caché",
       "applyDisabled": "Aplicar deshabilitado mientras el hub está fuera de línea.",
-      "noPresets": "No hay plantillas disponibles. Asegúrese de que Cerberus esté habilitado."
+      "noPresets": "No hay plantillas disponibles. Asegúrese de que Cerberus esté habilitado.",
+      "sortBy": "Ordenar presets"
     },
     "files": {
       "title": "Editar archivos de configuración",
       "selectFile": "Seleccionar un archivo...",
-      "refresh": "Actualizar"
+      "refresh": "Actualizar",
+      "content": "Contenido del archivo"
     },
     "bannedIps": {
       "title": "IPs bloqueadas",
@@ -1283,7 +1306,38 @@
       "title": "Confirmar desbloqueo",
       "confirm": "¿Está seguro de que desea desbloquear",
       "submit": "Desbloquear"
-    }
+    },
+    "lapiInitializing": "CrowdSec se está ejecutando, pero la API local aún se está inicializando.",
+    "lapiInitializingDesc": "El registro en la consola estará disponible cuando la API local esté lista. Puede tardar hasta un minuto después de iniciar CrowdSec.",
+    "checkingAgain": "(comprobando de nuevo...)",
+    "notRunning": "CrowdSec no se está ejecutando",
+    "notRunningDesc": "Inicie CrowdSec antes de registrarse en la consola.",
+    "starting": "Iniciando CrowdSec...",
+    "startFailed": "No se pudo iniciar CrowdSec",
+    "startCrowdsec": "Iniciar CrowdSec",
+    "goToSecurity": "Ir a Seguridad",
+    "whitelist": {
+      "tabLabel": "Lista blanca",
+      "title": "Lista blanca de IP",
+      "description": "Las IP y CIDR de la lista blanca nunca son bloqueadas por CrowdSec, aunque generen alertas.",
+      "ipLabel": "IP o CIDR",
+      "reasonLabel": "Motivo",
+      "reasonPlaceholder": "Motivo opcional",
+      "addMyIp": "Añadir mi IP",
+      "none": "No hay entradas en la lista blanca",
+      "columnIp": "IP / CIDR",
+      "columnReason": "Motivo",
+      "columnAdded": "Añadida",
+      "deleteAriaLabel": "Eliminar entrada de la lista blanca de",
+      "delete": "Eliminar",
+      "deleteModal": {
+        "title": "Eliminar entrada de la lista blanca",
+        "body": "¿Eliminar {{ip}} de la lista blanca? CrowdSec podrá bloquear esta IP si genera alertas.",
+        "submit": "Eliminar"
+      }
+    },
+    "noConfig": "No se encontró la configuración de CrowdSec en el estado de seguridad",
+    "noteText": "CrowdSec se controla mediante el interruptor de la página"
   },
   "smtp": {
     "title": "Configuración de Correo (SMTP)",
diff --git a/frontend/src/locales/fr/translation.json b/frontend/src/locales/fr/translation.json
index cf003bd2a..7d0790a6f 100644
--- a/frontend/src/locales/fr/translation.json
+++ b/frontend/src/locales/fr/translation.json
@@ -384,8 +384,17 @@
           "24h": "24h",
           "7d": "7d",
           "30d": "30d"
-        }
-      }
+        },
+        "timeRangeLabel": "Plage de temps"
+      },
+      "bouncerApiKey": "Clé API du bouncer",
+      "keyCopied": "Clé API copiée dans le presse-papiers",
+      "keyStoredAt": "Clé stockée dans",
+      "noKeyConfigured": "Aucune clé de bouncer configurée. Activez CrowdSec pour l'enregistrement automatique.",
+      "notRegistered": "Non enregistré",
+      "registered": "Enregistré",
+      "sourceEnvVar": "Depuis une variable d'environnement",
+      "sourceFile": "Depuis un fichier"
     },
     "acl": {
       "title": "Contrôle d'Accès",
@@ -1169,7 +1178,7 @@
       "goToSecurity": "Aller au tableau de bord de sécurité",
       "enrollmentToken": "Jeton d'inscription",
       "tokenPlaceholder": "Collez votre jeton d'inscription de la Console CrowdSec",
-      "agentName": "Nom de l'agent (optionnel)",
+      "agentName": "Nom de l'agent",
       "agentPlaceholder": "mon-instance-charon",
       "tenant": "Locataire/Organisation (optionnel)",
       "tenantPlaceholder": "id-org-de-console",
@@ -1188,7 +1197,15 @@
       "tenantLabel": "Locataire",
       "lastAttempt": "Dernière tentative",
       "enrolledAt": "Inscrit",
-      "correlationId": "ID de corrélation"
+      "correlationId": "ID de corrélation",
+      "lastError": "Dernière erreur",
+      "ackText": "Je comprends que cela renouvellera mes identifiants LAPI si je suis déjà inscrit",
+      "description": "Connectez votre LAPI CrowdSec à la console CrowdSec pour une gestion centralisée et des alertes.",
+      "enrollToken": "Jeton d'inscription",
+      "lastHeartbeat": "Dernier signal de vie",
+      "privacyNote": "Remarque : l'inscription envoie des signaux de vie et des métriques à CrowdSec. Consultez la politique de confidentialité de CrowdSec pour plus de détails.",
+      "tenantHelper": "Facultatif : indiquez l'ID du locataire/de l'organisation si vous utilisez une configuration multi-locataire",
+      "tokenHelper": "Obtenez votre jeton d'inscription depuis la console CrowdSec"
     },
     "reenroll": {
       "title": "Options de réinscription",
@@ -1204,14 +1221,16 @@
       "reenrolling": "Réinscription...",
       "clearState": "Effacer l'état d'inscription",
       "clearing": "Effacement...",
-      "clearConfirm": "Cela effacera l'état d'inscription local. Vous devrez peut-être vous réinscrire. Continuer ?"
+      "clearConfirm": "Cela effacera l'état d'inscription local. Vous devrez peut-être vous réinscrire. Continuer ?",
+      "clearFailed": "Impossible d'effacer l'état d'inscription : {{message}}"
     },
     "packages": {
       "title": "Paquets de configuration",
       "description": "Exportez ou importez des paquets de configuration CrowdSec (tar.gz/zip). Une sauvegarde est créée avant l'importation.",
       "export": "Exporter",
       "import": "Importer",
-      "importing": "Importation..."
+      "importing": "Importation...",
+      "selectFile": "Sélectionner le fichier de paquet CrowdSec"
     },
     "presets": {
       "title": "Préréglages",
@@ -1237,18 +1256,22 @@
       "previewUnavailable": "Aperçu non disponible",
       "applied": "Appliqué",
       "backup": "Sauvegarde",
+      "backupCreated": "Sauvegarde créée : {{name}} ({{location}})",
+      "backupLocation": "stockée à côté du répertoire de données CrowdSec",
       "reload": "Recharger",
       "required": "Requis",
       "method": "Méthode",
       "filesystem": "Système de fichiers",
       "loadCached": "Charger l'aperçu en cache",
       "applyDisabled": "Application désactivée tant que le hub est hors ligne.",
-      "noPresets": "Aucun préréglage disponible. Assurez-vous que Cerberus est activé."
+      "noPresets": "Aucun préréglage disponible. Assurez-vous que Cerberus est activé.",
+      "sortBy": "Trier les préréglages"
     },
     "files": {
       "title": "Modifier les fichiers de configuration",
       "selectFile": "Sélectionner un fichier...",
-      "refresh": "Actualiser"
+      "refresh": "Actualiser",
+      "content": "Contenu du fichier"
     },
     "bannedIps": {
       "title": "IPs bannies",
@@ -1283,7 +1306,38 @@
       "title": "Confirmer le débannissement",
       "confirm": "Êtes-vous sûr de vouloir débannir",
       "submit": "Débannir"
-    }
+    },
+    "lapiInitializing": "CrowdSec est en cours d'exécution, mais l'API locale est encore en cours d'initialisation.",
+    "lapiInitializingDesc": "L'inscription à la console sera disponible dès que l'API locale sera prête. Cela peut prendre jusqu'à une minute après le démarrage de CrowdSec.",
+    "checkingAgain": "(nouvelle vérification...)",
+    "notRunning": "CrowdSec n'est pas en cours d'exécution",
+    "notRunningDesc": "Démarrez CrowdSec avant de vous inscrire à la console.",
+    "starting": "Démarrage de CrowdSec...",
+    "startFailed": "Échec du démarrage de CrowdSec",
+    "startCrowdsec": "Démarrer CrowdSec",
+    "goToSecurity": "Aller à Sécurité",
+    "whitelist": {
+      "tabLabel": "Liste blanche",
+      "title": "Liste blanche d'IP",
+      "description": "Les IP et CIDR de la liste blanche ne sont jamais bloqués par CrowdSec, même s'ils déclenchent des alertes.",
+      "ipLabel": "IP ou CIDR",
+      "reasonLabel": "Raison",
+      "reasonPlaceholder": "Raison facultative",
+      "addMyIp": "Ajouter mon IP",
+      "none": "Aucune entrée dans la liste blanche",
+      "columnIp": "IP / CIDR",
+      "columnReason": "Raison",
+      "columnAdded": "Ajoutée",
+      "deleteAriaLabel": "Supprimer l'entrée de la liste blanche pour",
+      "delete": "Supprimer",
+      "deleteModal": {
+        "title": "Supprimer l'entrée de la liste blanche",
+        "body": "Supprimer {{ip}} de la liste blanche ? CrowdSec pourra alors bloquer cette IP si elle déclenche des alertes.",
+        "submit": "Supprimer"
+      }
+    },
+    "noConfig": "Configuration de CrowdSec introuvable dans l'état de sécurité",
+    "noteText": "CrowdSec est contrôlé via l'interrupteur de la page"
   },
   "smtp": {
     "title": "Paramètres Email (SMTP)",
diff --git a/frontend/src/locales/zh/translation.json b/frontend/src/locales/zh/translation.json
index 874691e4a..ee38da191 100644
--- a/frontend/src/locales/zh/translation.json
+++ b/frontend/src/locales/zh/translation.json
@@ -384,8 +384,17 @@
           "24h": "24小时",
           "7d": "7天",
           "30d": "30天"
-        }
-      }
+        },
+        "timeRangeLabel": "时间范围"
+      },
+      "bouncerApiKey": "Bouncer API 密钥",
+      "keyCopied": "API 密钥已复制到剪贴板",
+      "keyStoredAt": "密钥存储位置",
+      "noKeyConfigured": "未配置 Bouncer 密钥。启用 CrowdSec 以自动注册。",
+      "notRegistered": "未注册",
+      "registered": "已注册",
+      "sourceEnvVar": "来自环境变量",
+      "sourceFile": "来自文件"
     },
     "acl": {
       "title": "访问控制",
@@ -1168,7 +1177,7 @@
       "goToSecurity": "前往安全仪表板",
       "enrollmentToken": "注册令牌",
       "tokenPlaceholder": "粘贴您从 CrowdSec 控制台获取的注册令牌",
-      "agentName": "代理名称（可选）",
+      "agentName": "代理名称",
       "agentPlaceholder": "我的-charon-实例",
       "tenant": "租户/组织（可选）",
       "tenantPlaceholder": "控制台中的组织ID",
@@ -1187,7 +1196,15 @@
       "tenantLabel": "租户",
       "lastAttempt": "最后尝试",
       "enrolledAt": "注册于",
-      "correlationId": "关联ID"
+      "correlationId": "关联ID",
+      "lastError": "上次错误",
+      "ackText": "我了解如果已注册，这将轮换我的 LAPI 凭据",
+      "description": "将您的 CrowdSec LAPI 连接到 CrowdSec 控制台，以进行集中管理和接收警报。",
+      "enrollToken": "注册令牌",
+      "lastHeartbeat": "上次心跳",
+      "privacyNote": "注意：注册会向 CrowdSec 发送心跳数据和指标。详情请参阅 CrowdSec 的隐私政策。",
+      "tenantHelper": "可选：如果使用多租户设置，请指定租户/组织 ID",
+      "tokenHelper": "从 CrowdSec 控制台获取您的注册令牌"
     },
     "reenroll": {
       "title": "重新注册选项",
@@ -1203,14 +1220,16 @@
       "reenrolling": "正在重新注册...",
       "clearState": "清除注册状态",
       "clearing": "正在清除...",
-      "clearConfirm": "这将清除本地注册状态。您可能需要重新注册。是否继续？"
+      "clearConfirm": "这将清除本地注册状态。您可能需要重新注册。是否继续？",
+      "clearFailed": "清除注册状态失败：{{message}}"
     },
     "packages": {
       "title": "配置包",
       "description": "导出或导入 CrowdSec 配置包（tar.gz/zip）。导入前会创建备份。",
       "export": "导出",
       "import": "导入",
-      "importing": "正在导入..."
+      "importing": "正在导入...",
+      "selectFile": "选择 CrowdSec 软件包文件"
     },
     "presets": {
       "title": "预设",
@@ -1236,18 +1255,22 @@
       "previewUnavailable": "预览不可用",
       "applied": "已应用",
       "backup": "备份",
+      "backupCreated": "备份已创建：{{name}}（{{location}}）",
+      "backupLocation": "存放在 CrowdSec 数据目录旁",
       "reload": "重新加载",
       "required": "必需",
       "method": "方法",
       "filesystem": "文件系统",
       "loadCached": "加载缓存的预览",
       "applyDisabled": "Hub 离线时禁用应用。",
-      "noPresets": "没有可用的预设。请确保 Cerberus 已启用。"
+      "noPresets": "没有可用的预设。请确保 Cerberus 已启用。",
+      "sortBy": "排序预设"
     },
     "files": {
       "title": "编辑配置文件",
       "selectFile": "选择文件...",
-      "refresh": "刷新"
+      "refresh": "刷新",
+      "content": "文件内容"
     },
     "bannedIps": {
       "title": "已封禁 IP",
@@ -1282,7 +1305,38 @@
       "title": "确认解封",
       "confirm": "您确定要解封",
       "submit": "解封"
-    }
+    },
+    "lapiInitializing": "CrowdSec 正在运行，但本地 API 仍在初始化。",
+    "lapiInitializingDesc": "本地 API 就绪后即可进行控制台注册。CrowdSec 启动后可能需要最多一分钟。",
+    "checkingAgain": "(正在重新检查...)",
+    "notRunning": "CrowdSec 未运行",
+    "notRunningDesc": "请先启动 CrowdSec，再注册到控制台。",
+    "starting": "正在启动 CrowdSec...",
+    "startFailed": "启动 CrowdSec 失败",
+    "startCrowdsec": "启动 CrowdSec",
+    "goToSecurity": "前往安全页面",
+    "whitelist": {
+      "tabLabel": "白名单",
+      "title": "IP 白名单",
+      "description": "白名单中的 IP 和 CIDR 即使触发警报也不会被 CrowdSec 拦截。",
+      "ipLabel": "IP 或 CIDR",
+      "reasonLabel": "原因",
+      "reasonPlaceholder": "可选原因",
+      "addMyIp": "添加我的 IP",
+      "none": "没有白名单条目",
+      "columnIp": "IP / CIDR",
+      "columnReason": "原因",
+      "columnAdded": "添加时间",
+      "deleteAriaLabel": "移除白名单条目：",
+      "delete": "删除",
+      "deleteModal": {
+        "title": "移除白名单条目",
+        "body": "要将 {{ip}} 从白名单中移除吗？如果该 IP 触发警报，CrowdSec 之后可能会拦截它。",
+        "submit": "移除"
+      }
+    },
+    "noConfig": "在安全状态中未找到 CrowdSec 配置",
+    "noteText": "CrowdSec 由以下页面上的开关控制："
   },
   "smtp": {
     "title": "电子邮件 (SMTP) 设置",
diff --git a/frontend/src/pages/CrowdSecConfig.tsx b/frontend/src/pages/CrowdSecConfig.tsx
index cc6b017a1..95958737f 100644
--- a/frontend/src/pages/CrowdSecConfig.tsx
+++ b/frontend/src/pages/CrowdSecConfig.tsx
@@ -1,7 +1,7 @@
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query'
 import { isAxiosError } from 'axios'
 import { Shield, ShieldOff, Trash2, Search, AlertTriangle, ExternalLink } from 'lucide-react'
-import { lazy, Suspense, useEffect, useMemo, useState } from 'react'
+import { lazy, Suspense, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useNavigate, Link } from 'react-router'
 
@@ -22,6 +22,7 @@ import { CROWDSEC_PRESETS, type CrowdsecPreset } from '../data/crowdsecPresets'
 import { useConsoleStatus, useEnrollConsole, useClearConsoleEnrollment } from '../hooks/useConsoleEnrollment'
 import { useWhitelistEntries, useAddWhitelist, useDeleteWhitelist } from '../hooks/useCrowdSecWhitelist'
 import { buildCrowdsecExportFilename, downloadCrowdsecExport, promptCrowdsecFilename } from '../utils/crowdsecExport'
+import { sanitizeSecret } from '../utils/sanitizeSecret'
 import { toast } from '../utils/toast'
 
 /** Prefer the server's `error` message for Axios failures, falling back to the given text. */
@@ -57,6 +58,8 @@ export default function CrowdSecConfig() {
   const [validationError, setValidationError] = useState<string | null>(null)
   const [applyInfo, setApplyInfo] = useState<{ status?: string; backup?: string; reloadHint?: boolean; usedCscli?: boolean; cacheKey?: string } | null>(null)
   const queryClient = useQueryClient()
+  const backupCreatedMessage = (name: string) =>
+    t('crowdsecConfig.presets.backupCreated', { name, location: t('crowdsecConfig.presets.backupLocation') })
   // Read the "CrowdSec is starting" signal broadcast by Security.tsx via the
   // QueryClient cache. No HTTP call is made; this is pure in-memory coordination.
   const { data: crowdsecStartingCache } = useQuery<{ isStarting: boolean; startedAt?: number }>({
@@ -80,8 +83,11 @@ export default function CrowdSecConfig() {
   const [enrollmentToken, setEnrollmentToken] = useState('')
   const [consoleTenant, setConsoleTenant] = useState('')
   const [consoleAgentName, setConsoleAgentName] = useState((typeof window !== 'undefined' && window.location?.hostname) || 'charon-agent')
+  // Tracks manual edits so late-arriving enrollment status never overwrites what the user typed
+  const consoleAgentNameEdited = useRef(false)
+  const consoleTenantEdited = useRef(false)
   const [consoleAck, setConsoleAck] = useState(false)
-  const [consoleErrors, setConsoleErrors] = useState<{ token?: string; agent?: string; tenant?: string; ack?: string; submit?: string }>({})
+  const [consoleErrors, setConsoleErrors] = useState<{ token?: string; agent?: string; ack?: string; submit?: string }>({})
   const consoleStatusQuery = useConsoleStatus(consoleEnrollmentEnabled)
   const enrollConsoleMutation = useEnrollConsole()
   const clearEnrollmentMutation = useClearConsoleEnrollment()
@@ -216,15 +222,28 @@ export default function CrowdSecConfig() {
     }
   }, [presetCatalog, selectedPresetSlug])
 
+  // Prefer the enrolled identity over the hostname default, unless the user already edited the field
   useEffect(() => {
-    if (consoleStatusQuery.data?.agent_name) {
-      setConsoleAgentName((prev) => prev || consoleStatusQuery.data?.agent_name || prev)
+    const enrolledAgent = consoleStatusQuery.data?.agent_name
+    if (enrolledAgent && !consoleAgentNameEdited.current) {
+      setConsoleAgentName(enrolledAgent)
     }
-    if (consoleStatusQuery.data?.tenant) {
-      setConsoleTenant((prev) => prev || consoleStatusQuery.data?.tenant || prev)
+    const enrolledTenant = consoleStatusQuery.data?.tenant
+    if (enrolledTenant && !consoleTenantEdited.current) {
+      setConsoleTenant(enrolledTenant)
     }
   }, [consoleStatusQuery.data?.agent_name, consoleStatusQuery.data?.tenant])
 
+  const handleConsoleAgentNameChange = (value: string) => {
+    consoleAgentNameEdited.current = true
+    setConsoleAgentName(value)
+  }
+
+  const handleConsoleTenantChange = (value: string) => {
+    consoleTenantEdited.current = true
+    setConsoleTenant(value)
+  }
+
   const selectedPreset = presetCatalog.find((preset) => preset.slug === selectedPresetSlug)
   const selectedPresetRequiresHub = selectedPreset?.requiresHub ?? false
 
@@ -295,8 +314,6 @@ export default function CrowdSecConfig() {
   const canRotateKey = normalizedConsoleStatus === 'enrolled' || normalizedConsoleStatus === 'degraded' || isConsolePendingAcceptance
   const consoleDocsHref = 'https://wikid82.github.io/charon/security/'
 
-  const sanitizeSecret = (msg: string) => msg.replace(/\b[A-Za-z0-9]{10,64}\b/g, '***')
-
   const sanitizeErrorMessage = (err: unknown) => {
     if (isAxiosError(err)) {
       return sanitizeSecret(err.response?.data?.error || err.message)
@@ -305,17 +322,14 @@ export default function CrowdSecConfig() {
     return 'Console enrollment failed'
   }
 
-  const validateConsoleEnrollment = (options?: { allowMissingTenant?: boolean; requireAck?: boolean }) => {
-    const nextErrors: { token?: string; agent?: string; tenant?: string; ack?: string } = {}
+  const validateConsoleEnrollment = (options?: { requireAck?: boolean }) => {
+    const nextErrors: { token?: string; agent?: string; ack?: string } = {}
     if (!enrollmentToken.trim()) {
       nextErrors.token = 'Enrollment token is required'
     }
     if (!consoleAgentName.trim()) {
       nextErrors.agent = 'Agent name is required'
     }
-    if (!consoleTenant.trim() && !options?.allowMissingTenant) {
-      nextErrors.tenant = 'Tenant / organization is required'
-    }
     if (options?.requireAck && !consoleAck) {
       nextErrors.ack = 'You must acknowledge the console data-sharing notice'
     }
@@ -324,9 +338,8 @@ export default function CrowdSecConfig() {
   }
 
   const submitConsoleEnrollment = async (force = false) => {
-    const allowMissingTenant = force && !consoleTenant.trim()
     const requireAck = normalizedConsoleStatus === 'not_enrolled'
-    if (!validateConsoleEnrollment({ allowMissingTenant, requireAck })) return
+    if (!validateConsoleEnrollment({ requireAck })) return
     const tenantValue = consoleTenant.trim() || consoleStatusQuery.data?.tenant || consoleAgentName || 'charon-agent'
     try {
       await enrollConsoleMutation.mutateAsync({
@@ -471,7 +484,7 @@ export default function CrowdSecConfig() {
       const reloadNote = res.reload_hint ? ' (reload required)' : ''
       toast.success(`Preset applied via backend${reloadNote}`)
       if (res.backup) {
-        setPresetStatusMessage(`Backup stored at ${res.backup}`)
+        setPresetStatusMessage(backupCreatedMessage(res.backup))
       }
     } catch (err) {
       if (!isAxiosError(err)) {
@@ -481,7 +494,7 @@ export default function CrowdSecConfig() {
       // The server is authoritative for every preset source: surface its message for any
       // non-2xx response and never write preset content client-side.
       const status = err.response?.status
-      const backupPath = (err.response?.data as { backup?: string } | undefined)?.backup
+      const backupName = (err.response?.data as { backup?: string } | undefined)?.backup
       const message = getServerErrorMessage(err, 'Failed to apply preset')
       if (status === 400) {
         setValidationError(message)
@@ -489,8 +502,8 @@ export default function CrowdSecConfig() {
       if (status === 503) {
         setHubUnavailable(true)
       }
-      setApplyInfo({ status: 'failed', backup: backupPath || undefined, cacheKey: presetMeta?.cacheKey })
-      toast.error(`Apply failed: ${message}${backupPath ? `. Backup created at ${backupPath}` : ''}`)
+      setApplyInfo({ status: 'failed', backup: backupName || undefined, cacheKey: presetMeta?.cacheKey })
+      toast.error(`Apply failed: ${message}${backupName ? `. ${backupCreatedMessage(backupName)}` : ''}`)
     } finally {
       setIsApplyingPreset(false)
     }
@@ -708,7 +721,7 @@ export default function CrowdSecConfig() {
                 id="console-agent-name"
                 label={t('crowdsecConfig.consoleEnrollment.agentName')}
                 value={consoleAgentName}
-                onChange={(e) => setConsoleAgentName(e.target.value)}
+                onChange={(e) => handleConsoleAgentNameChange(e.target.value)}
                 error={consoleErrors.agent}
                 errorTestId="console-enroll-error"
                 data-testid="console-agent-name"
@@ -717,10 +730,8 @@ export default function CrowdSecConfig() {
                 id="console-tenant"
                 label={t('crowdsecConfig.consoleEnrollment.tenant')}
                 value={consoleTenant}
-                onChange={(e) => setConsoleTenant(e.target.value)}
+                onChange={(e) => handleConsoleTenantChange(e.target.value)}
                 helperText={t('crowdsecConfig.consoleEnrollment.tenantHelper')}
-                error={consoleErrors.tenant}
-                errorTestId="console-enroll-error"
                 data-testid="console-tenant"
               />
             </div>
@@ -863,7 +874,7 @@ export default function CrowdSecConfig() {
                             id="reenroll-agent-name"
                             type="text"
                             value={consoleAgentName}
-                            onChange={(e) => setConsoleAgentName(e.target.value)}
+                            onChange={(e) => handleConsoleAgentNameChange(e.target.value)}
                             placeholder={t('crowdsecConfig.reenroll.agentPlaceholder')}
                           />
                         </div>
@@ -875,7 +886,7 @@ export default function CrowdSecConfig() {
                             id="reenroll-tenant"
                             type="text"
                             value={consoleTenant}
-                            onChange={(e) => setConsoleTenant(e.target.value)}
+                            onChange={(e) => handleConsoleTenantChange(e.target.value)}
                             placeholder={t('crowdsecConfig.reenroll.orgPlaceholder')}
                           />
                         </div>
@@ -966,7 +977,7 @@ export default function CrowdSecConfig() {
             onChange={(e) => setFile(e.target.files?.[0] ?? null)}
             data-testid="import-file"
             accept=".tar.gz,.zip"
-            aria-label={t('crowdsecConfig.packages.selectFile') || "Select CrowdSec package"}
+            aria-label={t('crowdsecConfig.packages.selectFile')}
           />
         </div>
       </Card>
@@ -992,7 +1003,7 @@ export default function CrowdSecConfig() {
             </div>
             <select
               value={sortBy}
-              aria-label={t('crowdsecConfig.presets.sortBy') || "Sort presets"}
+              aria-label={t('crowdsecConfig.presets.sortBy')}
               onChange={(e) => setSortBy(e.target.value as 'alpha' | 'type' | 'source')}
               className="bg-gray-900 border border-gray-700 rounded-lg px-3 py-2 text-white"
             >
@@ -1113,7 +1124,7 @@ export default function CrowdSecConfig() {
               {applyInfo && (
                 <div className="rounded-lg border border-gray-800 bg-gray-900/70 p-3 text-xs text-gray-200" data-testid="preset-apply-info">
                   <p>{t('common.status')}: {applyInfo.status || t('crowdsecConfig.presets.applied')}</p>
-                  {applyInfo.backup && <p>{t('crowdsecConfig.presets.backup')}: {applyInfo.backup}</p>}
+                  {applyInfo.backup && <p>{t('crowdsecConfig.presets.backup')}: {applyInfo.backup} ({t('crowdsecConfig.presets.backupLocation')})</p>}
                   {applyInfo.reloadHint && <p>{t('crowdsecConfig.presets.reload')}: {t('crowdsecConfig.presets.required')}</p>}
                   {applyInfo.usedCscli !== undefined && <p>{t('crowdsecConfig.presets.method')}: {applyInfo.usedCscli ? 'cscli' : t('crowdsecConfig.presets.filesystem')}</p>}
                 </div>
@@ -1161,7 +1172,7 @@ export default function CrowdSecConfig() {
             onChange={(e) => setFileContent(e.target.value)}
             rows={12}
             className="w-full bg-gray-900 border border-gray-700 rounded-lg p-3 text-white"
-            aria-label={t('crowdsecConfig.files.content') || "File content"}
+            aria-label={t('crowdsecConfig.files.content')}
           />
           <div className="flex gap-2">
             <Button onClick={handleSaveFile} isLoading={writeMutation.isPending || backupMutation.isPending}>{t('common.save')}</Button>
@@ -1543,7 +1554,7 @@ export default function CrowdSecConfig() {
               {t('crowdsecConfig.whitelist.deleteModal.title', 'Remove Whitelist Entry')}
             </h2>
             <p className="text-sm text-gray-300 mb-4">
-              {t('crowdsecConfig.whitelist.deleteModal.body', 'Remove {{ip}} from the whitelist? CrowdSec may then block this IP if it triggers alerts.', { ip: confirmDeleteWhitelist.ip_or_cidr })}
+              {t('crowdsecConfig.whitelist.deleteModal.body', { ip: confirmDeleteWhitelist.ip_or_cidr })}
             </p>
             <div className="flex justify-end gap-3">
               <Button
diff --git a/frontend/src/pages/__tests__/CrowdSecConfig.coverage.test.tsx b/frontend/src/pages/__tests__/CrowdSecConfig.coverage.test.tsx
index 820cc1875..1eedbc17f 100644
--- a/frontend/src/pages/__tests__/CrowdSecConfig.coverage.test.tsx
+++ b/frontend/src/pages/__tests__/CrowdSecConfig.coverage.test.tsx
@@ -138,7 +138,7 @@ describe('CrowdSecConfig coverage', () => {
     })
     vi.mocked(presetsApi.applyCrowdsecPreset).mockResolvedValue({
       status: 'applied',
-      backup: '/tmp/backup.tar.gz',
+      backup: 'crowdsec.backup.20260101-000000.000000',
       reload_hint: true,
       used_cscli: true,
       cache_key: 'cache-123',
@@ -286,7 +286,7 @@ describe('CrowdSecConfig coverage', () => {
   it('sets apply info on backend success', async () => {
     await renderPage()
     await userEvent.click(screen.getByTestId('apply-preset-btn'))
-    await waitFor(() => expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('Backup: /tmp/backup.tar.gz'))
+    await waitFor(() => expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('Backup: crowdsec.backup.20260101-000000.000000 (stored next to the CrowdSec data directory)'))
   })
 
   it('supports keyboard selection for preset cards (Enter and Space)', async () => {
@@ -351,10 +351,10 @@ describe('CrowdSecConfig coverage', () => {
   })
 
   it('records backup info on apply failure and generic errors', async () => {
-    vi.mocked(presetsApi.applyCrowdsecPreset).mockRejectedValueOnce(axiosError(500, 'failed', { error: 'boom', backup: '/tmp/backup' }))
+    vi.mocked(presetsApi.applyCrowdsecPreset).mockRejectedValueOnce(axiosError(500, 'failed', { error: 'boom', backup: 'crowdsec.backup.20260101-000000.000000' }))
     await renderPage()
     await userEvent.click(screen.getByTestId('apply-preset-btn'))
-    await waitFor(() => expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('/tmp/backup'))
+    await waitFor(() => expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('crowdsec.backup.20260101-000000.000000'))
 
     cleanup()
 
diff --git a/frontend/src/pages/__tests__/CrowdSecConfig.curatedApply.test.tsx b/frontend/src/pages/__tests__/CrowdSecConfig.curatedApply.test.tsx
index 72dc0ab86..636dac361 100644
--- a/frontend/src/pages/__tests__/CrowdSecConfig.curatedApply.test.tsx
+++ b/frontend/src/pages/__tests__/CrowdSecConfig.curatedApply.test.tsx
@@ -127,7 +127,7 @@ describe('CrowdSecConfig curated preset apply', () => {
     })
     vi.mocked(presetsApi.applyCrowdsecPreset).mockResolvedValue({
       status: 'applied',
-      backup: '/tmp/backup.tar.gz',
+      backup: 'crowdsec.backup.20260101-000000.000000',
       reload_hint: true,
       used_cscli: true,
       cache_key: curatedPreset.cache_key,
@@ -144,7 +144,8 @@ describe('CrowdSecConfig curated preset apply', () => {
     await renderPage()
     await userEvent.click(screen.getByTestId('apply-preset-btn'))
     await waitFor(() => expect(toast.success).toHaveBeenCalledWith('Preset applied via backend (reload required)'))
-    expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('Backup: /tmp/backup.tar.gz')
+    expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('Backup: crowdsec.backup.20260101-000000.000000 (stored next to the CrowdSec data directory)')
+    expect(screen.getByTestId('preset-apply-info').textContent).not.toMatch(/(^|\s)\//)
     expect(toast.error).not.toHaveBeenCalled()
   })
 
@@ -161,13 +162,13 @@ describe('CrowdSecConfig curated preset apply', () => {
     'surfaces the server error and never applies locally for curated presets on %i',
     async (status) => {
       vi.mocked(presetsApi.applyCrowdsecPreset).mockRejectedValue(
-        axiosError(status, 'request failed', { error: `server says ${status}`, backup: '/tmp/rollback.tar.gz' }),
+        axiosError(status, 'request failed', { error: `server says ${status}`, backup: 'crowdsec.backup.20260101-000000.000000' }),
       )
       await renderPage()
       await userEvent.click(screen.getByTestId('apply-preset-btn'))
       await waitFor(() =>
         expect(toast.error).toHaveBeenCalledWith(
-          `Apply failed: server says ${status}. Backup created at /tmp/rollback.tar.gz`,
+          `Apply failed: server says ${status}. Backup created: crowdsec.backup.20260101-000000.000000 (stored next to the CrowdSec data directory)`,
         ),
       )
       expect(toast.success).not.toHaveBeenCalled()
diff --git a/frontend/src/pages/__tests__/CrowdSecConfig.i18nKeys.test.ts b/frontend/src/pages/__tests__/CrowdSecConfig.i18nKeys.test.ts
new file mode 100644
index 000000000..9484188cf
--- /dev/null
+++ b/frontend/src/pages/__tests__/CrowdSecConfig.i18nKeys.test.ts
@@ -0,0 +1,56 @@
+import { describe, it, expect } from 'vitest'
+
+type Json = { [key: string]: Json | string }
+
+const LOCALES = ['de', 'en', 'es', 'fr', 'zh'] as const
+const sourceModules = {
+  ...import.meta.glob('../CrowdSecConfig.tsx', { query: '?raw', import: 'default', eager: true }),
+  ...import.meta.glob('../../components/crowdsec/DashboardTimeRangeSelector.tsx', { query: '?raw', import: 'default', eager: true }),
+} as Record<string, string>
+const localeModules = import.meta.glob('../../locales/*/translation.json', { import: 'default', eager: true }) as Record<string, Json>
+const NAMESPACES = ['crowdsecConfig', 'security.crowdsec']
+
+const loadLocale = (locale: string): Json => localeModules[`../../locales/${locale}/translation.json`]
+
+const lookup = (tree: Json, path: string): Json | string | undefined =>
+  path.split('.').reduce<Json | string | undefined>((node, part) => {
+    if (node && typeof node === 'object' && part in node) return node[part]
+    return undefined
+  }, tree)
+
+const leafKeys = (node: Json | string, prefix: string): string[] =>
+  typeof node === 'string'
+    ? [prefix]
+    : Object.entries(node).flatMap(([k, v]) => leafKeys(v, `${prefix}.${k}`))
+
+const usedKeys = (): string[] => {
+  const keys = new Set<string>()
+  for (const src of Object.values(sourceModules)) {
+    for (const m of src.matchAll(/\bt\(\s*'([A-Za-z0-9_.]+)'/g)) keys.add(m[1])
+  }
+  return [...keys]
+}
+
+describe('CrowdSec config i18n keys', () => {
+  it('finds static keys in the sources', () => {
+    expect(usedKeys().length).toBeGreaterThan(50)
+  })
+
+  it('every static t() key resolves to a string in the en locale', () => {
+    const en = loadLocale('en')
+    const missing = usedKeys().filter((k) => typeof lookup(en, k) !== 'string')
+    expect(missing).toEqual([])
+  })
+
+  it.each(LOCALES.filter((l) => l !== 'en'))('%s has the same key set as en for CrowdSec namespaces', (locale) => {
+    const en = loadLocale('en')
+    const other = loadLocale(locale)
+    for (const ns of NAMESPACES) {
+      const enNode = lookup(en, ns)
+      const otherNode = lookup(other, ns)
+      expect(enNode, `en.${ns}`).toBeDefined()
+      expect(otherNode, `${locale}.${ns}`).toBeDefined()
+      expect(leafKeys(otherNode as Json, ns).sort()).toEqual(leafKeys(enNode as Json, ns).sort())
+    }
+  })
+})
diff --git a/frontend/src/pages/__tests__/CrowdSecConfig.spec.tsx b/frontend/src/pages/__tests__/CrowdSecConfig.spec.tsx
index d6b40b10d..f5e30a837 100644
--- a/frontend/src/pages/__tests__/CrowdSecConfig.spec.tsx
+++ b/frontend/src/pages/__tests__/CrowdSecConfig.spec.tsx
@@ -85,7 +85,7 @@ describe('CrowdSecConfig', () => {
     })
     vi.mocked(presetsApi.applyCrowdsecPreset).mockResolvedValue({
       status: 'applied',
-      backup: '/tmp/backup.tar.gz',
+      backup: 'crowdsec.backup.20260101-000000.000000',
       reload_hint: true,
       used_cscli: true,
       cache_key: 'cache-123',
@@ -202,6 +202,104 @@ describe('CrowdSecConfig', () => {
     expect((screen.getByTestId('console-enrollment-token') as HTMLInputElement).value).toBe('')
   })
 
+  const setupConsoleEnrollment = () => {
+    vi.mocked(featureFlagsApi.getFeatureFlags).mockResolvedValue({ 'feature.crowdsec.console_enrollment': true })
+    vi.mocked(api.getSecurityStatus).mockResolvedValue({ crowdsec: { enabled: true, mode: 'local' as const, api_url: '' }, cerberus: { enabled: true }, waf: { enabled: false, mode: 'disabled' as const }, rate_limit: { enabled: false }, acl: { enabled: false } })
+    vi.mocked(crowdsecApi.listCrowdsecFiles).mockResolvedValue({ files: [] })
+  }
+
+  it('does not require a tenant to enroll (backend treats it as optional)', async () => {
+    setupConsoleEnrollment()
+    renderWithProviders(<CrowdSecConfig />)
+
+    await screen.findByTestId('console-enrollment-card')
+    await userEvent.type(screen.getByTestId('console-enrollment-token'), 'secret-1234567890')
+    await userEvent.clear(screen.getByTestId('console-agent-name'))
+    await userEvent.type(screen.getByTestId('console-agent-name'), 'agent-one')
+    await userEvent.click(screen.getByTestId('console-ack-checkbox'))
+    await userEvent.click(screen.getByTestId('console-enroll-btn'))
+
+    await waitFor(() => expect(enrollConsoleMock).toHaveBeenCalledWith(expect.objectContaining({
+      agent_name: 'agent-one',
+      tenant: 'agent-one',
+      force: false,
+    })))
+    expect(screen.queryByText(/Tenant \/ organization is required/)).not.toBeInTheDocument()
+  })
+
+  it('still requires an agent name', async () => {
+    setupConsoleEnrollment()
+    renderWithProviders(<CrowdSecConfig />)
+
+    await screen.findByTestId('console-enrollment-card')
+    await userEvent.type(screen.getByTestId('console-enrollment-token'), 'secret-1234567890')
+    await userEvent.clear(screen.getByTestId('console-agent-name'))
+    await userEvent.click(screen.getByTestId('console-ack-checkbox'))
+    await userEvent.click(screen.getByTestId('console-enroll-btn'))
+
+    expect(await screen.findByText('Agent name is required')).toBeInTheDocument()
+    expect(enrollConsoleMock).not.toHaveBeenCalled()
+  })
+
+  it('defaults the agent name to the hostname when not enrolled', async () => {
+    setupConsoleEnrollment()
+    renderWithProviders(<CrowdSecConfig />)
+
+    const input = await screen.findByTestId('console-agent-name')
+    expect((input as HTMLInputElement).value).toBe(window.location.hostname)
+  })
+
+  it('initializes the agent name and tenant from the enrolled status', async () => {
+    setupConsoleEnrollment()
+    consoleStatusMock.mockReturnValue({ status: 'enrolled', key_present: true, agent_name: 'enrolled-agent', tenant: 'enrolled-org' })
+    renderWithProviders(<CrowdSecConfig />)
+
+    await waitFor(() => expect((screen.getByTestId('console-agent-name') as HTMLInputElement).value).toBe('enrolled-agent'))
+    expect((screen.getByTestId('console-tenant') as HTMLInputElement).value).toBe('enrolled-org')
+  })
+
+  it('does not overwrite a typed agent name when enrolled status arrives later', async () => {
+    setupConsoleEnrollment()
+    renderWithProviders(<CrowdSecConfig />)
+
+    const agent = await screen.findByTestId('console-agent-name')
+    await userEvent.clear(agent)
+    await userEvent.type(agent, 'my-typed-agent')
+
+    consoleStatusMock.mockReturnValue({ status: 'enrolled', key_present: true, agent_name: 'enrolled-agent', tenant: 'enrolled-org' })
+    await userEvent.type(screen.getByTestId('console-enrollment-token'), 'x')
+
+    await waitFor(() => expect((screen.getByTestId('console-tenant') as HTMLInputElement).value).toBe('enrolled-org'))
+    expect((screen.getByTestId('console-agent-name') as HTMLInputElement).value).toBe('my-typed-agent')
+  })
+
+  it('keeps edits made in the re-enroll form and submits them forced', async () => {
+    setupConsoleEnrollment()
+    consoleStatusMock.mockReturnValue({ status: 'enrolled', key_present: true, agent_name: 'enrolled-agent', tenant: 'enrolled-org' })
+    enrollConsoleMock.mockResolvedValue({ status: 'enrolled', key_present: true })
+    renderWithProviders(<CrowdSecConfig />)
+
+    await userEvent.click(await screen.findByTestId('show-reenroll-form-btn'))
+    await userEvent.type(screen.getByTestId('reenroll-token-input'), 'reenroll-secret-123456')
+
+    const agent = document.getElementById('reenroll-agent-name') as HTMLInputElement
+    await userEvent.clear(agent)
+    await userEvent.type(agent, 'renamed-agent')
+    const tenant = document.getElementById('reenroll-tenant') as HTMLInputElement
+    await userEvent.clear(tenant)
+    await userEvent.type(tenant, 'renamed-org')
+
+    expect(agent.value).toBe('renamed-agent')
+    expect(tenant.value).toBe('renamed-org')
+
+    await userEvent.click(screen.getByTestId('reenroll-submit-btn'))
+    await waitFor(() => expect(enrollConsoleMock).toHaveBeenCalledWith(expect.objectContaining({
+      agent_name: 'renamed-agent',
+      tenant: 'renamed-org',
+      force: true,
+    })))
+  })
+
   it('renders masked key state in console status', async () => {
     vi.mocked(featureFlagsApi.getFeatureFlags).mockResolvedValue({ 'feature.crowdsec.console_enrollment': true })
     vi.mocked(api.getSecurityStatus).mockResolvedValue({ crowdsec: { enabled: true, mode: 'local' as const, api_url: '' }, cerberus: { enabled: true }, waf: { enabled: false, mode: 'disabled' as const }, rate_limit: { enabled: false }, acl: { enabled: false } })
@@ -370,7 +468,7 @@ describe('CrowdSecConfig', () => {
     vi.mocked(crowdsecApi.readCrowdsecFile).mockResolvedValue({ content: '' })
     vi.mocked(presetsApi.applyCrowdsecPreset).mockResolvedValueOnce({
       status: 'applied',
-      backup: '/tmp/crowdsec-backup',
+      backup: 'crowdsec.backup.20260101-000000.000000',
       reload_hint: true,
       used_cscli: true,
       cache_key: 'cache-123',
@@ -382,7 +480,7 @@ describe('CrowdSecConfig', () => {
     const applyBtn = await screen.findByTestId('apply-preset-btn')
     await userEvent.click(applyBtn)
 
-    await waitFor(() => expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('/tmp/crowdsec-backup'))
+    await waitFor(() => expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('crowdsec.backup.20260101-000000.000000'))
     expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('Status: applied')
     expect(screen.getByTestId('preset-apply-info')).toHaveTextContent('Method: cscli')
     // reloadHint is a boolean and renders as empty/true - just verify the info section exists
diff --git a/frontend/src/pages/__tests__/CrowdSecConfig.whitelist.test.tsx b/frontend/src/pages/__tests__/CrowdSecConfig.whitelist.test.tsx
index 7be429d7e..98e7a105e 100644
--- a/frontend/src/pages/__tests__/CrowdSecConfig.whitelist.test.tsx
+++ b/frontend/src/pages/__tests__/CrowdSecConfig.whitelist.test.tsx
@@ -57,9 +57,9 @@ vi.mock('../../utils/toast', () => ({
 
 // The i18n mock in test setup returns the translation key when no translation is found.
 // These constants keep assertions in sync with what the component actually renders.
-const TAB_WHITELIST = 'crowdsecConfig.whitelist.tabLabel'
-const MODAL_TITLE = 'crowdsecConfig.whitelist.deleteModal.title'
-const BTN_REMOVE = 'crowdsecConfig.whitelist.deleteModal.submit'
+const TAB_WHITELIST = 'Whitelist'
+const MODAL_TITLE = 'Remove Whitelist Entry'
+const BTN_REMOVE = 'Remove'
 
 const baseStatus = {
   cerberus: { enabled: true },
diff --git a/frontend/src/utils/__tests__/sanitizeSecret.test.ts b/frontend/src/utils/__tests__/sanitizeSecret.test.ts
new file mode 100644
index 000000000..14b25c62b
--- /dev/null
+++ b/frontend/src/utils/__tests__/sanitizeSecret.test.ts
@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest'
+
+import { sanitizeSecret } from '../sanitizeSecret'
+
+describe('sanitizeSecret', () => {
+  it('does not mask ordinary words', () => {
+    const msg = 'enrollment failed: authentication required for Console registration'
+    expect(sanitizeSecret(msg)).toBe(msg)
+  })
+
+  it('masks mixed alphanumeric tokens', () => {
+    expect(sanitizeSecret('bad key clxyz0123456789abcdef here')).toBe('bad key *** here')
+  })
+
+  it('masks hex-like tokens', () => {
+    expect(sanitizeSecret('token 3f9a1c7e5b2d4a60 rejected')).toBe('token *** rejected')
+  })
+
+  it('masks very long letter-only strings', () => {
+    const secret = 'abcdefghijklmnopqrstuvwxyzABCDEFGH'
+    expect(sanitizeSecret(`key ${secret}`)).toBe('key ***')
+  })
+
+  it('leaves short strings and numbers alone', () => {
+    expect(sanitizeSecret('error 404 on port 8080')).toBe('error 404 on port 8080')
+  })
+})
diff --git a/frontend/src/utils/sanitizeSecret.ts b/frontend/src/utils/sanitizeSecret.ts
new file mode 100644
index 000000000..83b6c91ab
--- /dev/null
+++ b/frontend/src/utils/sanitizeSecret.ts
@@ -0,0 +1,18 @@
+const TOKEN_CANDIDATE = /\b[A-Za-z0-9]{10,64}\b/g
+// Letters-only strings are ordinary words unless they are implausibly long.
+const MIN_LETTERS_ONLY_SECRET_LENGTH = 32
+
+/**
+ * Masks token-like substrings (enrollment keys, API tokens) in a message.
+ * A candidate is masked when it mixes letters and digits, or is a very long
+ * run of letters. Ordinary words such as "enrollment" are left intact.
+ */
+export function sanitizeSecret(message: string): string {
+  return message.replace(TOKEN_CANDIDATE, (candidate) => {
+    const hasDigit = /\d/.test(candidate)
+    const hasLetter = /[A-Za-z]/.test(candidate)
+    if (hasDigit && hasLetter) return '***'
+    if (!hasDigit && candidate.length >= MIN_LETTERS_ONLY_SECRET_LENGTH) return '***'
+    return candidate
+  })
+}
diff --git a/tests/security/crowdsec-config.spec.ts b/tests/security/crowdsec-config.spec.ts
index a65bf523a..bbd850a5c 100644
--- a/tests/security/crowdsec-config.spec.ts
+++ b/tests/security/crowdsec-config.spec.ts
@@ -6,13 +6,28 @@
  * - Preset management (view, apply, preview)
  * - Configuration file management
  * - Import/Export functionality
- * - Console enrollment (if enabled)
+ * - Console enrollment (stubbed API states)
  *
  * @see /projects/Charon/docs/plans/current_spec.md
  */
 
+import type { Page } from '@playwright/test';
 import { test, expect, loginUser } from '../fixtures/auth-fixtures';
 import { waitForLoadingComplete } from '../utils/wait-helpers';
+import {
+  CROWDSEC_ROUTES,
+  crowdsecFixtures,
+  stubCrowdSecApi,
+  type CrowdSecStubOptions,
+} from '../utils/crowdsec-stubs';
+
+/** Installs the CrowdSec API stubs, then (re)loads the configuration page so they take effect. */
+async function openWithStubs(page: Page, options: CrowdSecStubOptions) {
+  const recorder = await stubCrowdSecApi(page, options);
+  await page.goto('/security/crowdsec');
+  await waitForLoadingComplete(page);
+  return recorder;
+}
 
 test.describe('CrowdSec Configuration @security', () => {
   test.beforeEach(async ({ page, adminUser }) => {
@@ -28,29 +43,9 @@ test.describe('CrowdSec Configuration @security', () => {
       await expect(page.getByRole('heading', { name: /crowdsec/i }).first()).toBeVisible();
     });
 
-    test('should show navigation back to security dashboard', async ({ page }) => {
-      // Should have breadcrumb, back link, or navigation element
-      const backLink = page.getByRole('link', { name: /security|back/i });
-      const backLinkVisible = await backLink.isVisible().catch(() => false);
-
-      if (backLinkVisible) {
-        await expect(backLink).toBeVisible();
-      } else {
-        // Check for navigation button instead
-        const backButton = page.getByRole('button', { name: /back/i });
-        const buttonVisible = await backButton.isVisible().catch(() => false);
-
-        if (!buttonVisible) {
-          // Check for breadcrumbs or navigation in header
-          const breadcrumb = page.locator('nav, [class*="breadcrumb"], [aria-label*="breadcrumb"]');
-          const breadcrumbVisible = await breadcrumb.isVisible().catch(() => false);
-
-          // At minimum, the page should be loaded
-          if (!breadcrumbVisible) {
-            await expect(page).toHaveURL(/crowdsec/);
-          }
-        }
-      }
+    test('should navigate back to the security dashboard from the page note', async ({ page }) => {
+      await page.getByRole('link', { name: 'Cerberus', exact: true }).click();
+      await expect(page).toHaveURL(/\/security$/);
     });
 
     test('should display presets section', async ({ page }) => {
@@ -96,43 +91,96 @@ test.describe('CrowdSec Configuration @security', () => {
   });
 
   test.describe('Configuration Files', () => {
-    test('should display configuration file list', async ({ page }) => {
-      // Look for file selector or list
-      const fileSelector = page.locator('select, [role="listbox"]').filter({
-        hasNotText: /sort|filter/i
-      }).first();
+    const FILES = ['acquis.yaml', 'config.yaml'];
+    const CONTENTS: Record<string, string> = {
+      'acquis.yaml': 'filenames:\n  - /var/log/caddy/access.log\n',
+      'config.yaml': 'common:\n  log_level: info\n',
+    };
+
+    test.beforeEach(async ({ page }) => {
+      await openWithStubs(page, { files: FILES, fileContents: CONTENTS });
+    });
 
-      const filesVisible = await fileSelector.isVisible().catch(() => false);
+    test('should list the configuration files in the file selector', async ({ page }) => {
+      const selector = page.getByRole('combobox', { name: 'Select a file...' });
+      await expect(selector).toBeVisible();
+      await expect(selector.getByRole('option')).toHaveText(['Select a file...', ...FILES]);
+    });
 
-      if (filesVisible) {
-        await expect(fileSelector).toBeVisible();
-      }
+    test('should show the file content when a file is selected', async ({ page }) => {
+      const selector = page.getByRole('combobox', { name: 'Select a file...' });
+      const content = page.locator('textarea');
+
+      await test.step('No content is shown before a file is chosen', async () => {
+        await expect(content).toHaveValue('');
+      });
+
+      await test.step('Select the first file', async () => {
+        await selector.selectOption('acquis.yaml');
+        await expect(content).toHaveValue(CONTENTS['acquis.yaml']);
+      });
+
+      await test.step('Select the second file', async () => {
+        await selector.selectOption('config.yaml');
+        await expect(content).toHaveValue(CONTENTS['config.yaml']);
+      });
     });
 
-    test('should show file content when selected', async ({ page }) => {
-      // Find file selector
-      const fileSelector = page.locator('select').first();
-      const selectorVisible = await fileSelector.isVisible().catch(() => false);
+    test('should clear the content when the editor is closed', async ({ page }) => {
+      const selector = page.getByRole('combobox', { name: 'Select a file...' });
+      const content = page.locator('textarea');
+      await selector.selectOption('config.yaml');
+      await expect(content).toHaveValue(CONTENTS['config.yaml']);
 
-      if (selectorVisible) {
-        // Select a file - content area should appear
-        const contentArea = page.locator('textarea, pre, [class*="editor"]');
-        const contentVisible = await contentArea.isVisible().catch(() => false);
+      await page.getByRole('button', { name: 'Close', exact: true }).click();
+      await expect(content).toHaveValue('');
+    });
 
-        // Content area may or may not be visible depending on selection
-        expect(contentVisible !== undefined).toBeTruthy();
-      }
+    test('should expose the file editor with an accessible name', async ({ page }) => {
+      await expect(page.getByRole('textbox', { name: /file content/i })).toBeVisible();
     });
   });
 
   test.describe('Import/Export', () => {
-    test('should have export functionality', async ({ page }) => {
-      const exportButton = page.getByRole('button', { name: /export/i });
-      const exportVisible = await exportButton.isVisible().catch(() => false);
+    const ARCHIVE = Buffer.from('stub-archive-bytes');
 
-      if (exportVisible) {
-        await expect(exportButton).toBeEnabled();
-      }
+    test('should export the configuration under the chosen file name', async ({ page }) => {
+      const stubs = await openWithStubs(page, { exportBody: ARCHIVE });
+
+      page.once('dialog', (dialog) => {
+        expect(dialog.type()).toBe('prompt');
+        void dialog.accept('my-backup');
+      });
+      const downloadPromise = page.waitForEvent('download');
+      await page.getByRole('button', { name: 'Export', exact: true }).click();
+      const download = await downloadPromise;
+
+      expect(download.suggestedFilename()).toBe('my-backup.tar.gz');
+      expect(stubs.exportRequests).toBe(1);
+      await expect(page.getByText('CrowdSec configuration exported')).toBeVisible();
+    });
+
+    test('should not export when the file name prompt is cancelled', async ({ page }) => {
+      const stubs = await openWithStubs(page, { exportBody: ARCHIVE });
+
+      page.once('dialog', (dialog) => void dialog.dismiss());
+      await page.getByRole('button', { name: 'Export', exact: true }).click();
+
+      await expect(page.getByText('CrowdSec configuration exported')).toHaveCount(0);
+      expect(stubs.exportRequests).toBe(0);
+    });
+
+    test('should show an error when the export fails', async ({ page }) => {
+      await openWithStubs(page, {});
+      await page.route(CROWDSEC_ROUTES.export, (route) =>
+        route.fulfill({ status: 500, contentType: 'application/json', json: { error: 'export failed' } }),
+      );
+
+      page.once('dialog', (dialog) => void dialog.accept('my-backup'));
+      await page.getByRole('button', { name: 'Export', exact: true }).click();
+
+      await expect(page.getByText('Failed to export CrowdSec configuration')).toBeVisible();
+      await expect(page.getByText('CrowdSec configuration exported')).toHaveCount(0);
     });
 
     test('should have import functionality', async ({ page }) => {
@@ -142,66 +190,241 @@ test.describe('CrowdSec Configuration @security', () => {
   });
 
   test.describe('Console Enrollment', () => {
-    test('should display console enrollment section if feature enabled', async ({ page }) => {
-      // Console enrollment is a feature-flagged component
-      const enrollmentSection = page.getByTestId('console-section').or(
-        page.locator('[class*="card"]').filter({ hasText: /console.*enrollment|enroll/i })
-      );
+    const consoleCard = (page: Page) => page.getByTestId('console-enrollment-card');
 
-      const enrollmentVisible = await enrollmentSection.isVisible().catch(() => false);
+    test('should hide the console enrollment section when the feature is disabled', async ({ page }) => {
+      await openWithStubs(page, { consoleEnrollmentEnabled: false, consoleStatus: crowdsecFixtures.notEnrolled() });
 
-      if (enrollmentVisible) {
-        await test.step('Verify enrollment form elements', async () => {
-          // Should have token input
-          const tokenInput = page.getByTestId('crowdsec-token-input').or(
-            page.getByPlaceholder(/token|key/i)
-          );
-          await expect(tokenInput).toBeVisible();
+      await expect(page.getByRole('heading', { name: 'Presets', level: 3 })).toBeVisible();
+      await expect(page.getByRole('heading', { name: 'Console Enrollment', level: 3 })).toHaveCount(0);
+    });
+
+    test('should show the enrollment form when the feature is enabled', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.notEnrolled(),
+        status: crowdsecFixtures.runningStatus(),
+      });
+
+      await expect(page.getByRole('heading', { name: 'Console Enrollment', level: 3 })).toBeVisible();
+      await expect(consoleCard(page).getByLabel('Enrollment Token', { exact: true })).toBeVisible();
+      await expect(consoleCard(page).getByLabel('Agent Name')).toBeVisible();
+      await expect(consoleCard(page).getByRole('button', { name: 'Enroll', exact: true })).toBeVisible();
+      await expect(page.getByText('Status: not enrolled')).toBeVisible();
+      await expect(page.getByText('Not stored')).toBeVisible();
+    });
+
+    const STATES = [
+      {
+        name: 'pending acceptance',
+        state: crowdsecFixtures.enrollment({ status: 'pending_acceptance' }),
+        label: 'Status: pending acceptance',
+        token: 'Stored (masked)',
+      },
+      {
+        name: 'enrolled',
+        state: crowdsecFixtures.enrollment({
+          status: 'enrolled',
+          last_heartbeat_at: '2026-01-02T03:04:05Z',
+          enrolled_at: '2026-01-01T00:00:00Z',
+        }),
+        label: 'Status: enrolled',
+        token: 'Stored (masked)',
+      },
+      {
+        name: 'failed',
+        state: crowdsecFixtures.enrollment({ status: 'failed', last_error: 'key rejected by console' }),
+        label: 'Status: degraded',
+        token: 'Stored (masked)',
+      },
+    ];
+
+    for (const { name, state, label, token } of STATES) {
+      test(`should display the ${name} enrollment state`, async ({ page }) => {
+        await openWithStubs(page, {
+          consoleEnrollmentEnabled: true,
+          consoleStatus: state,
+          status: crowdsecFixtures.runningStatus(),
         });
-      } else {
-        // Feature might be disabled - that's OK
-        test.info().annotations.push({
-          type: 'info',
-          description: 'Console enrollment feature not enabled'
+
+        await expect(page.getByText(label, { exact: true })).toBeVisible();
+        await expect(page.getByTestId('console-token-state')).toHaveText(token);
+        await expect(consoleCard(page).getByText('e2e-agent', { exact: true })).toBeVisible();
+      });
+    }
+
+    test('should show the heartbeat time and enrolled actions for an enrolled agent', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.enrollment({ last_heartbeat_at: '2026-01-02T03:04:05Z' }),
+        status: crowdsecFixtures.runningStatus(),
+      });
+
+      await expect(page.getByText(/Last heartbeat: .*2026/)).toBeVisible();
+      await expect(page.getByTestId('reenroll-section')).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Rotate Key' })).toBeEnabled();
+    });
+
+    test('should show the acceptance instructions while enrollment is pending acceptance', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.enrollment({ status: 'pending_acceptance' }),
+        status: crowdsecFixtures.runningStatus(),
+      });
+
+      await expect(page.getByTestId('pending-acceptance-info')).toContainText('Action Required');
+    });
+
+    test('should show the last error and a retry action for a failed enrollment', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.enrollment({ status: 'failed', last_error: 'key rejected by console' }),
+        status: crowdsecFixtures.runningStatus(),
+      });
+
+      await expect(page.getByTestId('console-status-error')).toContainText('key rejected by console');
+      await expect(page.getByRole('button', { name: 'Retry Enrollment' })).toBeVisible();
+    });
+
+    test('should label the last error in readable text', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.enrollment({ status: 'failed', last_error: 'key rejected by console' }),
+        status: crowdsecFixtures.runningStatus(),
+      });
+
+      await expect(page.getByTestId('console-status-error')).toHaveText('Last error: key rejected by console');
+    });
+
+    test('should submit the enrollment and report success', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.notEnrolled(),
+        status: crowdsecFixtures.runningStatus(),
+      });
+      let payload: unknown;
+      await page.route(CROWDSEC_ROUTES.consoleEnroll, async (route) => {
+        payload = route.request().postDataJSON();
+        await route.fulfill({
+          status: 200,
+          contentType: 'application/json',
+          json: crowdsecFixtures.enrollment({ status: 'pending_acceptance', agent_name: 'e2e-agent', tenant: 'e2e-tenant' }),
         });
-      }
+      });
+
+      const card = consoleCard(page);
+      await card.getByLabel('Enrollment Token', { exact: true }).fill('stub-enrollment-key');
+      await card.getByLabel('Agent Name').fill('e2e-agent');
+      await card.getByLabel('Tenant/Organization (optional)').fill('e2e-tenant');
+      await card.getByRole('checkbox', { name: /I understand this will rotate/ }).check();
+      await card.getByRole('button', { name: 'Enroll', exact: true }).click();
+
+      await expect(page.getByText(/Enrollment request sent!/)).toBeVisible();
+      expect(payload).toEqual({
+        enrollment_key: 'stub-enrollment-key',
+        tenant: 'e2e-tenant',
+        agent_name: 'e2e-agent',
+        force: false,
+      });
+    });
+
+    test('should require the acknowledgement before enrolling', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.notEnrolled(),
+        status: crowdsecFixtures.runningStatus(),
+      });
+      let enrollRequests = 0;
+      await page.route(CROWDSEC_ROUTES.consoleEnroll, (route) => {
+        enrollRequests += 1;
+        return route.fulfill({ status: 200, contentType: 'application/json', json: crowdsecFixtures.notEnrolled() });
+      });
+
+      const card = consoleCard(page);
+      await card.getByLabel('Enrollment Token', { exact: true }).fill('stub-enrollment-key');
+      await card.getByRole('button', { name: 'Enroll', exact: true }).click();
+
+      await expect(page.getByText('You must acknowledge the console data-sharing notice')).toBeVisible();
+      expect(enrollRequests).toBe(0);
     });
 
-    test('should show enrollment status when enrolled', async ({ page }) => {
-      const statusText = page.getByTestId('console-token-state').or(
-        page.locator('text=/enrolled|pending|not enrolled/i')
+    test('should surface the backend error when enrollment is rejected', async ({ page }) => {
+      await openWithStubs(page, {
+        consoleEnrollmentEnabled: true,
+        consoleStatus: crowdsecFixtures.notEnrolled(),
+        status: crowdsecFixtures.runningStatus(),
+      });
+      await page.route(CROWDSEC_ROUTES.consoleEnroll, (route) =>
+        route.fulfill({ status: 400, contentType: 'application/json', json: { error: 'invalid key' } }),
       );
 
-      const statusVisible = await statusText.isVisible().catch(() => false);
+      const card = consoleCard(page);
+      await card.getByLabel('Enrollment Token', { exact: true }).fill('bad-key');
+      await card.getByLabel('Tenant/Organization (optional)').fill('e2e-tenant');
+      await card.getByRole('checkbox', { name: /I understand this will rotate/ }).check();
+      await card.getByRole('button', { name: 'Enroll', exact: true }).click();
 
-      if (statusVisible) {
-        // Verify status is displayed
-        await expect(statusText).toBeVisible();
-      }
+      await expect(page.getByTestId('console-enroll-error')).toContainText('invalid key');
+      await expect(page.getByText(/Enrollment request sent!/)).toHaveCount(0);
     });
   });
 
   test.describe('Status Indicators', () => {
-    test('should display CrowdSec running status', async ({ page }) => {
-      // Look for status indicators
-      const statusBadge = page.locator('[class*="badge"]').filter({
-        hasText: /running|stopped|enabled|disabled/i
+    // The LAPI banners appear only after the page's 3 second start-up grace period.
+    const BANNER_TIMEOUT = 15_000;
+    const ENROLL_FLAGS = { consoleEnrollmentEnabled: true, consoleStatus: crowdsecFixtures.notEnrolled() };
+
+    test('should allow enrollment and show no warnings when CrowdSec and LAPI are ready', async ({ page }) => {
+      await openWithStubs(page, { ...ENROLL_FLAGS, status: crowdsecFixtures.runningStatus() });
+
+      const card = page.getByTestId('console-enrollment-card');
+      await card.getByLabel('Enrollment Token', { exact: true }).fill('stub-enrollment-key');
+      const enroll = card.getByRole('button', { name: 'Enroll', exact: true });
+      await page.waitForResponse(CROWDSEC_ROUTES.status);
+
+      await expect(enroll).toBeEnabled();
+      await expect(page.getByTestId('lapi-warning')).toHaveCount(0);
+      await expect(page.getByTestId('lapi-not-running-warning')).toHaveCount(0);
+    });
+
+    test('should warn and block enrollment while CrowdSec is running but LAPI is not ready', async ({ page }) => {
+      await openWithStubs(page, {
+        ...ENROLL_FLAGS,
+        status: crowdsecFixtures.runningStatus({ lapi_ready: false }),
       });
 
-      const statusVisible = await statusBadge.first().isVisible().catch(() => false);
+      const card = page.getByTestId('console-enrollment-card');
+      await card.getByLabel('Enrollment Token', { exact: true }).fill('stub-enrollment-key');
 
-      if (statusVisible) {
-        await expect(statusBadge.first()).toBeVisible();
-      }
+      await expect(page.getByTestId('lapi-warning')).toBeVisible({ timeout: BANNER_TIMEOUT });
+      await expect(page.getByTestId('lapi-not-running-warning')).toHaveCount(0);
+      await expect(card.getByRole('button', { name: 'Enroll', exact: true })).toBeDisabled();
+      await expect(page.getByTestId('lapi-warning').getByRole('button', { name: 'Check Now' })).toBeEnabled();
     });
 
-    test('should display LAPI status', async ({ page }) => {
-      // LAPI ready status might be displayed
-      const lapiStatus = page.getByText(/lapi.*ready|lapi.*status/i);
-      const lapiVisible = await lapiStatus.isVisible().catch(() => false);
+    test('should warn and block enrollment when CrowdSec is not running', async ({ page }) => {
+      await openWithStubs(page, {
+        ...ENROLL_FLAGS,
+        status: crowdsecFixtures.runningStatus({ running: false, pid: 0, lapi_ready: false }),
+      });
+
+      const warning = page.getByTestId('lapi-not-running-warning');
+      await expect(warning).toBeVisible({ timeout: BANNER_TIMEOUT });
+      await expect(page.getByTestId('lapi-warning')).toHaveCount(0);
+      await expect(warning.getByRole('button', { name: 'Check Now' })).toBeEnabled();
+      await expect(page.getByTestId('console-enrollment-card').getByRole('button', { name: 'Enroll', exact: true })).toBeDisabled();
+    });
+
+    test('should show readable text in the LAPI warnings', async ({ page }) => {
+      await openWithStubs(page, {
+        ...ENROLL_FLAGS,
+        status: crowdsecFixtures.runningStatus({ running: false, pid: 0, lapi_ready: false }),
+      });
 
-      // LAPI status might not always be visible
-      expect(lapiVisible !== undefined).toBeTruthy();
+      const warning = page.getByTestId('lapi-not-running-warning');
+      await expect(warning).toBeVisible({ timeout: BANNER_TIMEOUT });
+      await expect(warning).not.toContainText('crowdsecConfig.');
+      await expect(warning.getByRole('button', { name: 'Start CrowdSec' })).toBeVisible();
     });
   });
 
diff --git a/tests/security/crowdsec-console-enrollment.spec.ts b/tests/security/crowdsec-console-enrollment.spec.ts
index aad91bbcb..59c9b9194 100644
--- a/tests/security/crowdsec-console-enrollment.spec.ts
+++ b/tests/security/crowdsec-console-enrollment.spec.ts
@@ -1,18 +1,129 @@
 /**
  * CrowdSec Console Enrollment E2E Tests
  *
- * Tests the CrowdSec console enrollment functionality including:
- * - Enrollment status API
- * - Diagnostics connectivity status
- * - Diagnostics config validation
- * - Heartbeat status
- * - UI enrollment section display
+ * The E2E container has no CrowdSec engine and the enrollment feature flag is off by
+ * default, so the enrollment API is stubbed (see tests/utils/crowdsec-stubs.ts) and the
+ * assertions run against known enrollment states:
+ * - What the card shows for each state (not enrolled, enrolling, pending acceptance,
+ *   enrolled, failed) including timestamps, heartbeat and the last error
+ * - Validation before a request is sent
+ * - The exact enroll, rotate, retry and re-enroll requests
+ * - Outcomes: refreshed status, toasts and server errors
+ * - Clearing the local enrollment state
+ * - Gating on local API readiness
+ *
+ * The diagnostics endpoints are covered by crowdsec-diagnostics.spec.ts. The UI does not
+ * call the console heartbeat endpoint; heartbeat is read from the console status.
  *
  * @see /projects/Charon/docs/plans/crowdsec_enrollment_debug_spec.md
  */
 
+import type { Page } from '@playwright/test';
 import { test, expect, loginUser } from '../fixtures/auth-fixtures';
+import { getToastLocator } from '../utils/ui-helpers';
 import { waitForLoadingComplete } from '../utils/wait-helpers';
+import {
+  CROWDSEC_ROUTES,
+  crowdsecFixtures,
+  stubCrowdSecApi,
+  type ConsoleEnrollmentState,
+  type CrowdSecStubOptions,
+} from '../utils/crowdsec-stubs';
+
+/** The LAPI readiness warnings and gating only appear after the page's 3 second start-up grace period. */
+const GATING_TIMEOUT = 15_000;
+const KEY = 'stub-enrollment-key';
+
+const NOT_ENROLLED = crowdsecFixtures.notEnrolled();
+const ENROLLED = crowdsecFixtures.enrollment();
+const PENDING = crowdsecFixtures.enrollment({ status: 'pending_acceptance' });
+const ENROLLING = crowdsecFixtures.enrollment({ status: 'enrolling' });
+const FAILED = crowdsecFixtures.enrollment({ status: 'failed', last_error: 'key rejected by console' });
+
+const card = (page: Page) => page.getByTestId('console-enrollment-card');
+const tokenField = (page: Page) => page.getByTestId('console-enrollment-token');
+const agentField = (page: Page) => page.getByTestId('console-agent-name');
+const tenantField = (page: Page) => page.getByTestId('console-tenant');
+const enrollButton = (page: Page) => card(page).getByRole('button', { name: 'Enroll', exact: true });
+const rotateButton = (page: Page) => card(page).getByRole('button', { name: 'Rotate Key', exact: true });
+const retryButton = (page: Page) => card(page).getByRole('button', { name: 'Retry Enrollment', exact: true });
+const hostname = (page: Page) => new URL(page.url()).hostname;
+
+/** Local time formatting exactly as the page renders a timestamp. */
+const localTime = (page: Page, iso: string) => page.evaluate((value) => new Date(value).toLocaleString(), iso);
+
+/** Installs the stubs (feature enabled, CrowdSec running) and loads the CrowdSec page. */
+async function openEnrollment(
+  page: Page,
+  state: ConsoleEnrollmentState,
+  options: CrowdSecStubOptions = {},
+  beforeLoad?: () => Promise<void>,
+) {
+  const recorder = await stubCrowdSecApi(page, {
+    consoleEnrollmentEnabled: true,
+    consoleStatus: state,
+    status: crowdsecFixtures.runningStatus(),
+    ...options,
+  });
+  await beforeLoad?.();
+  await page.goto('/security/crowdsec');
+  await waitForLoadingComplete(page);
+  await expect(card(page)).toBeVisible();
+  return recorder;
+}
+
+/**
+ * Serves `console/status` from a mutable state and records POST /console/enroll bodies and
+ * DELETE /console/enrollment calls. Registered after the base stubs so it takes precedence.
+ * `enrollResponse` is applied to the state when an enrollment succeeds.
+ */
+async function trackConsole(
+  page: Page,
+  initial: ConsoleEnrollmentState,
+  behaviour: { enrollResponse?: ConsoleEnrollmentState; enrollError?: { status: number; error: string } } = {},
+) {
+  const tracker = { state: initial, enrollments: [] as unknown[], clears: 0 };
+  await page.route(CROWDSEC_ROUTES.consoleStatus, (route) =>
+    route.request().method() === 'GET'
+      ? route.fulfill({ status: 200, contentType: 'application/json', json: tracker.state })
+      : route.fallback(),
+  );
+  await page.route(CROWDSEC_ROUTES.consoleEnroll, (route) => {
+    if (route.request().method() !== 'POST') return route.fallback();
+    tracker.enrollments.push(route.request().postDataJSON());
+    if (behaviour.enrollError) {
+      return route.fulfill({
+        status: behaviour.enrollError.status,
+        contentType: 'application/json',
+        json: { error: behaviour.enrollError.error },
+      });
+    }
+    tracker.state = behaviour.enrollResponse ?? tracker.state;
+    return route.fulfill({ status: 200, contentType: 'application/json', json: tracker.state });
+  });
+  await page.route(CROWDSEC_ROUTES.consoleEnrollment, (route) => {
+    if (route.request().method() !== 'DELETE') return route.fallback();
+    tracker.clears += 1;
+    tracker.state = NOT_ENROLLED;
+    return route.fulfill({ status: 200, contentType: 'application/json', json: { message: 'enrollment state cleared' } });
+  });
+  return tracker;
+}
+
+/** Opens the page with the tracked console API in place of the plain status stub. */
+async function openTracked(
+  page: Page,
+  initial: ConsoleEnrollmentState,
+  behaviour: Parameters<typeof trackConsole>[2] = {},
+  options: CrowdSecStubOptions = {},
+) {
+  let tracker!: Awaited<ReturnType<typeof trackConsole>>;
+  // Tracking routes must be registered after the base stubs so they take precedence.
+  await openEnrollment(page, initial, options, async () => {
+    tracker = await trackConsole(page, initial, behaviour);
+  });
+  return tracker;
+}
 
 test.describe('CrowdSec Console Enrollment', () => {
   test.beforeEach(async ({ page, adminUser }) => {
@@ -20,367 +131,468 @@ test.describe('CrowdSec Console Enrollment', () => {
     await waitForLoadingComplete(page);
   });
 
-  test.describe('Console Enrollment Status API', () => {
-    test('should fetch console enrollment status via API', async ({ request }) => {
-      await test.step('GET enrollment status endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/console/enrollment');
-
-        // Endpoint may not exist yet (return 404) or return enrollment status
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Console enrollment endpoint not implemented (404)',
-          });
-          return;
+  test.describe('Enrollment States', () => {
+    const STATES = [
+      {
+        name: 'not enrolled',
+        state: NOT_ENROLLED,
+        label: 'Status: not enrolled',
+        token: 'Not stored',
+        rotate: false,
+        retry: false,
+        reenroll: false,
+        pending: false,
+      },
+      {
+        name: 'enrolling',
+        state: ENROLLING,
+        label: 'Status: enrolling',
+        token: 'Stored (masked)',
+        rotate: false,
+        retry: false,
+        reenroll: false,
+        pending: false,
+      },
+      {
+        name: 'pending acceptance',
+        state: PENDING,
+        label: 'Status: pending acceptance',
+        token: 'Stored (masked)',
+        rotate: true,
+        retry: false,
+        reenroll: true,
+        pending: true,
+      },
+      {
+        name: 'enrolled',
+        state: ENROLLED,
+        label: 'Status: enrolled',
+        token: 'Stored (masked)',
+        rotate: true,
+        retry: false,
+        reenroll: true,
+        pending: false,
+      },
+      {
+        name: 'failed',
+        state: FAILED,
+        label: 'Status: degraded',
+        token: 'Stored (masked)',
+        rotate: true,
+        retry: true,
+        reenroll: false,
+        pending: false,
+      },
+    ];
+
+    for (const { name, state, label, token, rotate, retry, reenroll, pending } of STATES) {
+      test(`should show the ${name} state and only the actions that apply`, async ({ page }) => {
+        await openEnrollment(page, state);
+
+        await expect(page.getByTestId('console-status-label')).toHaveText(label);
+        await expect(page.getByTestId('console-token-state')).toHaveText(token);
+        await expect(enrollButton(page)).toBeVisible();
+        if (rotate) {
+          await expect(rotateButton(page)).toBeEnabled();
+        } else {
+          await expect(rotateButton(page)).toBeDisabled();
         }
+        await expect(retryButton(page)).toHaveCount(retry ? 1 : 0);
+        await expect(page.getByTestId('reenroll-section')).toHaveCount(reenroll ? 1 : 0);
+        await expect(page.getByTestId('pending-acceptance-info')).toHaveCount(pending ? 1 : 0);
+      });
+    }
+
+    test('should show the agent, tenant and every timestamp of an enrolled agent', async ({ page }) => {
+      const enrollment = crowdsecFixtures.enrollment({
+        last_attempt_at: '2026-01-01T00:00:00Z',
+        enrolled_at: '2026-01-01T00:01:00Z',
+        last_heartbeat_at: '2026-01-02T03:04:05Z',
+        correlation_id: 'corr-1234',
+      });
+      await openEnrollment(page, enrollment);
+
+      await expect(card(page).getByText(`Last heartbeat: ${await localTime(page, '2026-01-02T03:04:05Z')}`, { exact: true })).toBeVisible();
+      await expect(card(page).getByText(`Last attempt: ${await localTime(page, '2026-01-01T00:00:00Z')}`, { exact: true })).toBeVisible();
+      await expect(card(page).getByText(`Enrolled: ${await localTime(page, '2026-01-01T00:01:00Z')}`, { exact: true })).toBeVisible();
+      await expect(card(page).getByText('Correlation ID: corr-1234', { exact: true })).toBeVisible();
+      await expect(card(page).getByText('e2e-agent', { exact: true })).toBeVisible();
+      await expect(card(page).getByText('e2e-tenant', { exact: true }).first()).toBeVisible();
+    });
 
-        expect(response.ok()).toBeTruthy();
+    test('should show dashes for the times of an agent that was never enrolled', async ({ page }) => {
+      await openEnrollment(page, NOT_ENROLLED);
 
-        const status = await response.json();
+      await expect(card(page).getByText('Last heartbeat: —', { exact: true })).toBeVisible();
+      await expect(card(page).getByText('Last attempt: —', { exact: true })).toBeVisible();
+      await expect(card(page).getByText('Enrolled: —', { exact: true })).toBeVisible();
+      await expect(card(page).getByText(/Correlation ID/)).toHaveCount(0);
+    });
 
-        // Verify response contains expected fields
-        expect(status).toHaveProperty('status');
-        expect(['not_enrolled', 'enrolling', 'pending_acceptance', 'enrolled', 'failed']).toContain(
-          status.status
-        );
+    test('should mask secret-looking words in the last error', async ({ page }) => {
+      await openEnrollment(
+        page,
+        crowdsecFixtures.enrollment({ status: 'failed', last_error: 'rejected key abcdefghij1234567890 by console' }),
+      );
 
-        // Optional fields that should be present
-        if (status.status !== 'not_enrolled') {
-          expect(status).toHaveProperty('agent_name');
-          expect(status).toHaveProperty('tenant');
-        }
+      const error = page.getByTestId('console-status-error');
+      await expect(error).toContainText('rejected key *** by console');
+      await expect(error).not.toContainText('abcdefghij1234567890');
+    });
 
-        expect(status).toHaveProperty('last_attempt_at');
-        expect(status).toHaveProperty('key_present');
-      });
+    test('should fall back to the not enrolled view when the status cannot be read', async ({ page }) => {
+      await openEnrollment(page, NOT_ENROLLED);
+      await page.route(CROWDSEC_ROUTES.consoleStatus, (route) =>
+        route.fulfill({ status: 500, contentType: 'application/json', json: { error: 'failed to read enrollment status' } }),
+      );
+      await page.reload();
+      await waitForLoadingComplete(page);
+
+      await expect(page.getByTestId('console-status-label')).toHaveText('Status: not enrolled');
+      await expect(page.getByTestId('console-token-state')).toHaveText('—');
+      await expect(rotateButton(page)).toBeDisabled();
     });
 
-    test('should fetch diagnostics connectivity status', async ({ request }) => {
-      await test.step('GET diagnostics connectivity endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/connectivity');
-
-        // Endpoint may not exist yet
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Diagnostics connectivity endpoint not implemented (404)',
-          });
-          return;
-        }
+    test('should describe the card for assistive technology', async ({ page }) => {
+      await openEnrollment(page, NOT_ENROLLED);
+
+      await expect(card(page)).toMatchAriaSnapshot(`
+        - heading "Console Enrollment" [level=3]
+        - textbox "Agent Name"
+        - textbox "Tenant/Organization (optional)"
+        - checkbox "I understand this will rotate my LAPI credentials if already enrolled"
+        - button "Enroll" [disabled]
+        - button "Rotate Key" [disabled]
+      `);
+    });
+  });
 
-        expect(response.ok()).toBeTruthy();
+  test.describe('Token Handling', () => {
+    test('should mask the token as it is typed and allow revealing it', async ({ page }) => {
+      await openEnrollment(page, NOT_ENROLLED);
 
-        const connectivity = await response.json();
+      await tokenField(page).fill(KEY);
+      await expect(tokenField(page)).toHaveAttribute('type', 'password');
 
-        // Verify response contains expected boolean fields
-        expect(connectivity).toHaveProperty('lapi_running');
-        expect(typeof connectivity.lapi_running).toBe('boolean');
+      await card(page).getByRole('button', { name: 'Show password' }).click();
+      await expect(tokenField(page)).toHaveAttribute('type', 'text');
+      await expect(tokenField(page)).toHaveValue(KEY);
+    });
 
-        expect(connectivity).toHaveProperty('lapi_ready');
-        expect(typeof connectivity.lapi_ready).toBe('boolean');
+    test('should keep Enroll disabled and explain why until a token is entered', async ({ page }) => {
+      await openEnrollment(page, NOT_ENROLLED);
 
-        expect(connectivity).toHaveProperty('capi_registered');
-        expect(typeof connectivity.capi_registered).toBe('boolean');
+      await expect(enrollButton(page)).toBeDisabled();
+      await expect(enrollButton(page)).toHaveAttribute('title', 'Enrollment token is required');
 
-        expect(connectivity).toHaveProperty('console_enrolled');
-        expect(typeof connectivity.console_enrolled).toBe('boolean');
-      });
-    });
+      await tokenField(page).fill('   ');
+      await expect(enrollButton(page)).toBeDisabled();
 
-    test('should fetch diagnostics config validation', async ({ request }) => {
-      await test.step('GET diagnostics config endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/config');
-
-        // Endpoint may not exist yet
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Diagnostics config endpoint not implemented (404)',
-          });
-          return;
-        }
+      await tokenField(page).fill(KEY);
+      await expect(enrollButton(page)).toBeEnabled();
+      await expect(enrollButton(page)).not.toHaveAttribute('title');
+    });
+  });
 
-        expect(response.ok()).toBeTruthy();
+  test.describe('Validation', () => {
+    test('should require an agent name', async ({ page }) => {
+      const tracker = await openTracked(page, NOT_ENROLLED);
 
-        const config = await response.json();
+      await tokenField(page).fill(KEY);
+      await agentField(page).fill('');
+      await tenantField(page).fill('e2e-tenant');
+      await card(page).getByRole('checkbox', { name: /I understand this will rotate/ }).check();
+      await enrollButton(page).click();
 
-        // Verify response contains expected fields
-        expect(config).toHaveProperty('config_exists');
-        expect(typeof config.config_exists).toBe('boolean');
+      await expect(card(page).getByText('Agent name is required', { exact: true })).toBeVisible();
+      expect(tracker.enrollments).toEqual([]);
+    });
 
-        expect(config).toHaveProperty('acquis_exists');
-        expect(typeof config.acquis_exists).toBe('boolean');
+    test('should list every missing required field at once', async ({ page }) => {
+      const tracker = await openTracked(page, NOT_ENROLLED);
 
-        expect(config).toHaveProperty('lapi_port');
-        expect(typeof config.lapi_port).toBe('string');
+      await tokenField(page).fill(KEY);
+      await agentField(page).fill('');
+      await enrollButton(page).click();
 
-        expect(config).toHaveProperty('errors');
-        expect(Array.isArray(config.errors)).toBe(true);
-      });
+      await expect(card(page).getByText('Agent name is required', { exact: true })).toBeVisible();
+      await expect(card(page).getByText('You must acknowledge the console data-sharing notice', { exact: true })).toBeVisible();
+      await expect(card(page).getByText('Tenant / organization is required')).toHaveCount(0);
+      expect(tracker.enrollments).toEqual([]);
     });
 
-    test('should fetch heartbeat status', async ({ request }) => {
-      await test.step('GET console heartbeat endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/console/heartbeat');
-
-        // Endpoint may not exist yet
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Console heartbeat endpoint not implemented (404)',
-          });
-          return;
-        }
+    test('should enroll without a tenant and send the agent name as the tenant', async ({ page }) => {
+      const tracker = await openTracked(page, NOT_ENROLLED, { enrollResponse: PENDING });
 
-        expect(response.ok()).toBeTruthy();
+      await tokenField(page).fill(KEY);
+      await agentField(page).fill('e2e-agent');
+      await card(page).getByRole('checkbox', { name: /I understand this will rotate/ }).check();
+      await enrollButton(page).click();
 
-        const heartbeat = await response.json();
+      await expect.poll(() => tracker.enrollments).toEqual([
+        { enrollment_key: KEY, tenant: 'e2e-agent', agent_name: 'e2e-agent', force: false },
+      ]);
+      await expect(card(page).getByText('Tenant / organization is required')).toHaveCount(0);
+    });
 
-        // Verify response contains expected fields
-        expect(heartbeat).toHaveProperty('status');
-        expect(['not_enrolled', 'enrolling', 'pending_acceptance', 'enrolled', 'failed']).toContain(
-          heartbeat.status
-        );
+    test('should send the enrolled tenant when rotating with the tenant field cleared', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED, { enrollResponse: PENDING });
 
-        expect(heartbeat).toHaveProperty('last_heartbeat_at');
-        // last_heartbeat_at can be null if not enrolled or not yet received
-      });
+      await tokenField(page).fill(KEY);
+      await tenantField(page).fill('');
+      await rotateButton(page).click();
+
+      await expect.poll(() => tracker.enrollments).toEqual([
+        { enrollment_key: KEY, tenant: 'e2e-tenant', agent_name: 'e2e-agent', force: true },
+      ]);
     });
   });
 
-  test.describe('Console Enrollment UI', () => {
-    test('should display console enrollment section in UI when feature is enabled', async ({
-      page,
-    }) => {
-      await test.step('Navigate to CrowdSec configuration', async () => {
-        await page.goto('/security/crowdsec');
-        await waitForLoadingComplete(page);
+  test.describe('Enrolling', () => {
+    test('should send the trimmed values, mark the request as non-forced and show the pending state', async ({ page }) => {
+      const tracker = await openTracked(page, NOT_ENROLLED, { enrollResponse: PENDING });
+
+      await tokenField(page).fill(`  ${KEY}  `);
+      await agentField(page).fill('  e2e-agent  ');
+      await tenantField(page).fill('  e2e-tenant  ');
+      await card(page).getByRole('checkbox', { name: /I understand this will rotate/ }).check();
+      await enrollButton(page).click();
+
+      await expect(
+        getToastLocator(page, 'Enrollment request sent! Accept the enrollment on app.crowdsec.net to complete registration.', {
+          type: 'success',
+        }),
+      ).toBeVisible();
+      expect(tracker.enrollments).toEqual([
+        { enrollment_key: KEY, tenant: 'e2e-tenant', agent_name: 'e2e-agent', force: false },
+      ]);
+
+      await test.step('The status is refreshed and the token is cleared', async () => {
+        await expect(page.getByTestId('console-status-label')).toHaveText('Status: pending acceptance');
+        await expect(page.getByTestId('pending-acceptance-info')).toContainText('Action Required');
+        await expect(tokenField(page)).toHaveValue('');
       });
+    });
 
-      await test.step('Verify enrollment section visibility', async () => {
-        // Look for console enrollment section using various selectors
-        const enrollmentSection = page
-          .getByTestId('console-section')
-          .or(page.getByTestId('console-enrollment-section'))
-          .or(page.locator('[class*="card"]').filter({ hasText: /console.*enrollment|enroll/i }));
-
-        const enrollmentVisible = await enrollmentSection.isVisible().catch(() => false);
-
-        if (enrollmentVisible) {
-          await expect(enrollmentSection).toBeVisible();
+    test('should default the agent name to the host name of the page', async ({ page }) => {
+      const tracker = await openTracked(page, NOT_ENROLLED, { enrollResponse: PENDING });
 
-          // Check for token input
-          const tokenInput = page
-            .getByTestId('enrollment-token-input')
-            .or(page.getByTestId('crowdsec-token-input'))
-            .or(page.getByPlaceholder(/token|key/i));
+      await expect(agentField(page)).toHaveValue(hostname(page));
+      await tokenField(page).fill(KEY);
+      await tenantField(page).fill('e2e-tenant');
+      await card(page).getByRole('checkbox', { name: /I understand this will rotate/ }).check();
+      await enrollButton(page).click();
 
-          const tokenInputVisible = await tokenInput.isVisible().catch(() => false);
-          if (tokenInputVisible) {
-            await expect(tokenInput).toBeVisible();
-          }
-        } else {
-          // Feature might be disabled via feature flag
-          test.info().annotations.push({
-            type: 'info',
-            description:
-              'Console enrollment section not visible - feature may be disabled via feature flag',
-          });
-        }
-      });
+      await expect.poll(() => tracker.enrollments).toEqual([
+        { enrollment_key: KEY, tenant: 'e2e-tenant', agent_name: hostname(page), force: false },
+      ]);
     });
 
-    test('should display enrollment status correctly', async ({ page }) => {
-      await test.step('Navigate to CrowdSec configuration', async () => {
-        await page.goto('/security/crowdsec');
-        await waitForLoadingComplete(page);
+    test('should show the server error inline and as a toast, with secrets masked', async ({ page }) => {
+      const tracker = await openTracked(page, NOT_ENROLLED, {
+        enrollError: { status: 400, error: 'bad key abcdefghij1234567890 rejected' },
       });
 
-      await test.step('Verify enrollment status display', async () => {
-        // Look for status text that shows current enrollment state
-        const statusText = page
-          .getByTestId('console-token-state')
-          .or(page.getByTestId('enrollment-status'))
-          .or(page.locator('text=/not enrolled|pending.*acceptance|enrolled|enrolling/i'));
-
-        const statusVisible = await statusText.first().isVisible().catch(() => false);
-
-        if (statusVisible) {
-          // Verify one of the expected statuses is displayed
-          const possibleStatuses = [
-            /not enrolled/i,
-            /pending.*acceptance/i,
-            /enrolled/i,
-            /enrolling/i,
-            /failed/i,
-          ];
-
-          let foundStatus = false;
-          for (const pattern of possibleStatuses) {
-            const statusMatch = page.getByText(pattern);
-            if (await statusMatch.first().isVisible().catch(() => false)) {
-              foundStatus = true;
-              break;
-            }
-          }
-
-          if (!foundStatus) {
-            test.info().annotations.push({
-              type: 'info',
-              description: 'No enrollment status text found in expected formats',
-            });
-          }
-        } else {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Enrollment status not visible - feature may not be implemented',
-          });
-        }
-      });
+      await tokenField(page).fill(KEY);
+      await tenantField(page).fill('e2e-tenant');
+      await card(page).getByRole('checkbox', { name: /I understand this will rotate/ }).check();
+      await enrollButton(page).click();
+
+      await expect(card(page).getByText('bad key *** rejected', { exact: true })).toBeVisible();
+      await expect(getToastLocator(page, 'bad key *** rejected', { type: 'error' })).toBeVisible();
+      await expect(getToastLocator(page, /Enrollment request sent/, { type: 'success' })).toHaveCount(0);
+      await expect(page.getByTestId('console-status-label')).toHaveText('Status: not enrolled');
+      expect(tracker.enrollments).toHaveLength(1);
     });
+  });
 
-    test('should show enroll button when not enrolled', async ({ page, request }) => {
-      await test.step('Check enrollment status via API', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/console/enrollment');
+  test.describe('Rotating the Key', () => {
+    test('should require a token before rotating', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED);
 
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Console enrollment API not implemented',
-          });
-          return;
-        }
+      await rotateButton(page).click();
 
-        const status = await response.json();
+      await expect(card(page).getByText('Enrollment token is required', { exact: true })).toBeVisible();
+      expect(tracker.enrollments).toEqual([]);
+    });
 
-        if (status.status === 'not_enrolled') {
-          await page.goto('/security/crowdsec');
-          await waitForLoadingComplete(page);
+    test('should send a forced request without asking for the acknowledgement', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED, { enrollResponse: PENDING });
+
+      await tokenField(page).fill(KEY);
+      await agentField(page).fill('e2e-agent');
+      await rotateButton(page).click();
+
+      await expect(
+        getToastLocator(page, 'Enrollment submitted! Accept the request on app.crowdsec.net to complete.', {
+          type: 'success',
+        }),
+      ).toBeVisible();
+      await expect(card(page).getByText('You must acknowledge the console data-sharing notice')).toHaveCount(0);
+      expect(tracker.enrollments).toEqual([
+        { enrollment_key: KEY, tenant: 'e2e-tenant', agent_name: 'e2e-agent', force: true },
+      ]);
+      await expect(page.getByTestId('console-status-label')).toHaveText('Status: pending acceptance');
+    });
 
-          // Look for enroll button
-          const enrollButton = page.getByRole('button', { name: /enroll/i });
-          const buttonVisible = await enrollButton.isVisible().catch(() => false);
+    test('should keep the enrolled agent name when rotating without editing it', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED, { enrollResponse: PENDING });
 
-          if (buttonVisible) {
-            await expect(enrollButton).toBeVisible();
-            await expect(enrollButton).toBeEnabled();
-          }
-        } else {
-          test.info().annotations.push({
-            type: 'info',
-            description: `CrowdSec is already enrolled with status: ${status.status}`,
-          });
-        }
-      });
+      await expect(agentField(page)).toHaveValue('e2e-agent');
+      await tokenField(page).fill(KEY);
+      await rotateButton(page).click();
+
+      await expect.poll(() => tracker.enrollments).toEqual([
+        { enrollment_key: KEY, tenant: 'e2e-tenant', agent_name: 'e2e-agent', force: true },
+      ]);
     });
+  });
 
-    test('should show agent name field when enrolling', async ({ page }) => {
-      await test.step('Navigate to CrowdSec configuration', async () => {
-        await page.goto('/security/crowdsec');
-        await waitForLoadingComplete(page);
-      });
+  test.describe('Retrying a Failed Enrollment', () => {
+    test('should require a token before retrying', async ({ page }) => {
+      const tracker = await openTracked(page, FAILED);
 
-      await test.step('Check for agent name input', async () => {
-        const agentNameInput = page
-          .getByTestId('agent-name-input')
-          .or(page.getByLabel(/agent.*name/i))
-          .or(page.getByPlaceholder(/agent.*name/i));
+      await retryButton(page).click();
 
-        const inputVisible = await agentNameInput.isVisible().catch(() => false);
+      await expect(card(page).getByText('Enrollment token is required', { exact: true })).toBeVisible();
+      expect(tracker.enrollments).toEqual([]);
+    });
 
-        if (inputVisible) {
-          await expect(agentNameInput).toBeVisible();
-        } else {
-          // Agent name input may only show when token is entered
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Agent name input not visible - may require token input first',
-          });
-        }
-      });
+    test('should send a forced request and move on to the pending state', async ({ page }) => {
+      const tracker = await openTracked(page, FAILED, { enrollResponse: PENDING });
+
+      await tokenField(page).fill(KEY);
+      await agentField(page).fill('e2e-agent');
+      await retryButton(page).click();
+
+      await expect(page.getByTestId('console-status-label')).toHaveText('Status: pending acceptance');
+      expect(tracker.enrollments).toEqual([
+        { enrollment_key: KEY, tenant: 'e2e-tenant', agent_name: 'e2e-agent', force: true },
+      ]);
+      await expect(retryButton(page)).toHaveCount(0);
     });
   });
 
-  test.describe('Enrollment Validation', () => {
-    test('should validate enrollment token format', async ({ page }) => {
-      await test.step('Navigate to CrowdSec configuration', async () => {
-        await page.goto('/security/crowdsec');
-        await waitForLoadingComplete(page);
-      });
+  test.describe('Re-enrollment', () => {
+    const section = (page: Page) => page.getByTestId('reenroll-section');
 
-      await test.step('Check token input validation', async () => {
-        const tokenInput = page
-          .getByTestId('enrollment-token-input')
-          .or(page.getByTestId('crowdsec-token-input'))
-          .or(page.getByPlaceholder(/token|key/i));
+    test('should reveal and hide the re-enrollment form', async ({ page }) => {
+      await openEnrollment(page, ENROLLED);
 
-        const inputVisible = await tokenInput.isVisible().catch(() => false);
+      await expect(section(page).getByRole('heading', { name: 'Re-enrollment Options' })).toBeVisible();
+      await expect(section(page).getByLabel('New Enrollment Key')).toHaveCount(0);
 
-        if (!inputVisible) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Token input not visible - console enrollment UI not implemented',
-          });
-          return;
-        }
+      await section(page).getByRole('button', { name: 'Re-enroll with new key' }).click();
+      await expect(section(page).getByLabel('New Enrollment Key')).toBeVisible();
+      await expect(section(page).getByRole('button', { name: 'Re-enroll', exact: true })).toBeDisabled();
 
-        // Try submitting empty token
-        const enrollButton = page.getByRole('button', { name: /enroll/i });
-        const buttonVisible = await enrollButton.isVisible().catch(() => false);
+      await section(page).getByRole('button', { name: 'Cancel' }).click();
+      await expect(section(page).getByLabel('New Enrollment Key')).toHaveCount(0);
+    });
 
-        if (buttonVisible) {
-          await enrollButton.click();
+    test('should send a forced request with the new key and close the form', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED, { enrollResponse: PENDING });
+
+      await section(page).getByRole('button', { name: 'Re-enroll with new key' }).click();
+      await section(page).getByLabel('New Enrollment Key').fill('new-enrollment-key');
+      await section(page).getByLabel('Agent Name').fill('e2e-agent');
+      await section(page).getByRole('button', { name: 'Re-enroll', exact: true }).click();
+
+      await expect(
+        getToastLocator(page, 'Enrollment submitted! Accept the request on app.crowdsec.net to complete.', {
+          type: 'success',
+        }),
+      ).toBeVisible();
+      expect(tracker.enrollments).toEqual([
+        { enrollment_key: 'new-enrollment-key', tenant: 'e2e-tenant', agent_name: 'e2e-agent', force: true },
+      ]);
+      await expect(section(page).getByLabel('New Enrollment Key')).toHaveCount(0);
+    });
 
-          // Should show validation error
-          const errorText = page.getByText(/required|invalid|token/i);
-          const errorVisible = await errorText.first().isVisible().catch(() => false);
+    test('should link to the CrowdSec console for a new key', async ({ page }) => {
+      await openEnrollment(page, ENROLLED);
 
-          if (errorVisible) {
-            await expect(errorText.first()).toBeVisible();
-          }
-        }
+      await expect(section(page).getByRole('link', { name: 'Get new enrollment key from Console' })).toHaveAttribute(
+        'href',
+        'https://app.crowdsec.net/security-engines',
+      );
+    });
+  });
+
+  test.describe('Clearing the Enrollment State', () => {
+    const CONFIRMATION = 'This will clear local enrollment state. You may need to re-enroll. Continue?';
+
+    test('should leave the state untouched when the confirmation is declined', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED);
+
+      page.once('dialog', (dialog) => {
+        expect(dialog.type()).toBe('confirm');
+        expect(dialog.message()).toBe(CONFIRMATION);
+        void dialog.dismiss();
       });
+      await page.getByRole('button', { name: 'Clear enrollment state' }).click();
+
+      await expect(page.getByTestId('console-status-label')).toHaveText('Status: enrolled');
+      expect(tracker.clears).toBe(0);
     });
 
-    test('should handle LAPI not running error gracefully', async ({ page, request }) => {
-      // LAPI availability enforced via CrowdSec internal checks. Verified in integration tests (backend/integration/).
+    test('should clear the state once confirmed and return to the not enrolled view', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED);
 
-      await test.step('Attempt enrollment when LAPI is not running', async () => {
-        // This test would verify the error message when LAPI is not available
-        // Skipped because it requires stopping CrowdSec which affects other tests
+      page.once('dialog', (dialog) => {
+        expect(dialog.message()).toBe(CONFIRMATION);
+        void dialog.accept();
       });
+      await page.getByRole('button', { name: 'Clear enrollment state' }).click();
+
+      await expect(page.getByTestId('console-status-label')).toHaveText('Status: not enrolled');
+      await expect(page.getByTestId('reenroll-section')).toHaveCount(0);
+      await expect(page.getByTestId('console-token-state')).toHaveText('Not stored');
+      expect(tracker.clears).toBe(1);
+    });
+
+    test('should show an error toast and keep the state when clearing fails', async ({ page }) => {
+      const tracker = await openTracked(page, ENROLLED);
+      await page.route(CROWDSEC_ROUTES.consoleEnrollment, (route) =>
+        route.request().method() === 'DELETE'
+          ? route.fulfill({ status: 500, contentType: 'application/json', json: { error: 'database is locked' } })
+          : route.fallback(),
+      );
+
+      page.once('dialog', (dialog) => void dialog.accept());
+      await page.getByRole('button', { name: 'Clear enrollment state' }).click();
+
+      await expect(
+        getToastLocator(page, 'Failed to clear enrollment state: database is locked', { type: 'error' }),
+      ).toBeVisible();
+      await expect(page.getByTestId('console-status-label')).toHaveText('Status: enrolled');
+      expect(tracker.clears).toBe(0);
     });
   });
 
-  test.describe('Enrollment Status Persistence', () => {
-    test('should persist enrollment status across page reloads', async ({ page, request }) => {
-      await test.step('Check initial status', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/console/enrollment');
-
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Console enrollment API not implemented',
-          });
-          return;
-        }
+  test.describe('Local API Readiness', () => {
+    const NOT_READY = crowdsecFixtures.runningStatus({ lapi_ready: false });
 
-        const initialStatus = await response.json();
+    test('should block enrolling and explain why while the local API is not ready', async ({ page }) => {
+      await openEnrollment(page, NOT_ENROLLED, { status: NOT_READY });
+      await tokenField(page).fill(KEY);
 
-        await page.goto('/security/crowdsec');
-        await waitForLoadingComplete(page);
+      await expect(enrollButton(page)).toBeDisabled({ timeout: GATING_TIMEOUT });
+      await expect(enrollButton(page)).toHaveAttribute('title', 'LAPI must be ready to enroll');
+    });
+
+    test('should block rotating the key while the local API is not ready', async ({ page }) => {
+      await openEnrollment(page, ENROLLED, { status: NOT_READY });
 
-        // Reload page
-        await page.reload();
-        await waitForLoadingComplete(page);
+      await expect(rotateButton(page)).toBeDisabled({ timeout: GATING_TIMEOUT });
+      await expect(rotateButton(page)).toHaveAttribute('title', 'LAPI must be ready to rotate key');
+    });
 
-        // Verify status persists
-        const afterReloadResponse = await request.get('/api/v1/admin/crowdsec/console/enrollment');
-        expect(afterReloadResponse.ok()).toBeTruthy();
+    test('should block retrying while the local API is not ready', async ({ page }) => {
+      await openEnrollment(page, FAILED, { status: NOT_READY });
 
-        const afterReloadStatus = await afterReloadResponse.json();
-        expect(afterReloadStatus.status).toBe(initialStatus.status);
-      });
+      await expect(retryButton(page)).toBeDisabled({ timeout: GATING_TIMEOUT });
+      await expect(retryButton(page)).toHaveAttribute('title', 'LAPI must be ready to retry enrollment');
     });
   });
 });
diff --git a/tests/security/crowdsec-dashboard.spec.ts b/tests/security/crowdsec-dashboard.spec.ts
index 0f906224c..f61be1f19 100644
--- a/tests/security/crowdsec-dashboard.spec.ts
+++ b/tests/security/crowdsec-dashboard.spec.ts
@@ -1,273 +1,580 @@
 /**
  * CrowdSec Dashboard E2E Tests
  *
- * Tests the CrowdSec Dashboard tab functionality including:
+ * The E2E container has no CrowdSec engine, so every dashboard endpoint is stubbed
+ * (see tests/utils/crowdsec-stubs.ts) and the assertions run against known data:
  * - Tab navigation between Configuration and Dashboard
- * - Summary cards rendering
- * - Chart components rendering
- * - Time range selector interaction
- * - Active decisions table display
- * - Alerts list display
- * - Export button functionality
- * - Refresh button functionality
+ * - Summary cards, charts, active decisions table and alerts list
+ * - Empty and error states of every panel
+ * - Time range selection and refresh (asserted on the requests the UI sends)
+ * - Decision export (CSV and JSON)
  *
  * @see /projects/Charon/docs/plans/current_spec.md PR-2, PR-3
  */
 
+import type { Locator, Page } from '@playwright/test';
 import { test, expect, loginUser } from '../fixtures/auth-fixtures';
 import { waitForLoadingComplete } from '../utils/wait-helpers';
+import {
+  crowdsecFixtures,
+  stubCrowdSecApi,
+  type CrowdSecStubOptions,
+  type StubFailure,
+} from '../utils/crowdsec-stubs';
+
+const ALERT_TOTAL = 25;
+const ALERT_PAGE_SIZE = 10;
+const ERROR_TIMEOUT = 15_000;
+const SERVER_ERROR: StubFailure = { failWith: 500 };
+
+const TOP_IPS = [
+  { ip: '203.0.113.1', count: 5, last_seen: '2020-01-01T00:00:00Z', country: 'DE' },
+  { ip: '203.0.113.2', count: 9, last_seen: '2020-01-02T00:00:00Z', country: 'US' },
+  { ip: '203.0.113.3', count: 1, last_seen: '2020-01-03T00:00:00Z', country: '' },
+];
+
+const SCENARIOS = [
+  { name: 'crowdsecurity/http-probing', count: 60, percentage: 60 },
+  { name: 'crowdsecurity/ssh-bf', count: 40, percentage: 40 },
+];
+
+const TIMELINE = [
+  { timestamp: '2026-01-01T00:00:00Z', bans: 3, captchas: 1 },
+  { timestamp: '2026-01-01T01:00:00Z', bans: 5, captchas: 0 },
+];
+
+/** Serves a page of generated alerts; alert N has IP 198.51.100.N and scenario crowdsecurity/scenario-N. */
+function alertsPage(query: URLSearchParams) {
+  const offset = Number(query.get('offset') ?? 0);
+  const limit = Number(query.get('limit') ?? ALERT_PAGE_SIZE);
+  const alerts = Array.from({ length: Math.max(0, Math.min(limit, ALERT_TOTAL - offset)) }, (_, i) => {
+    const n = offset + i + 1;
+    return crowdsecFixtures.alert({
+      id: n,
+      ip: `198.51.100.${n}`,
+      scenario: `crowdsecurity/scenario-${n}`,
+      events_count: n * 2,
+    });
+  });
+  return { alerts, total: ALERT_TOTAL, source: 'lapi', cached: false };
+}
+
+/** Dashboard stub set with data in every panel; override individual panels per test. */
+function dashboardOptions(
+  overrides: NonNullable<CrowdSecStubOptions['dashboard']> = {},
+): CrowdSecStubOptions {
+  return {
+    dashboard: {
+      summary: crowdsecFixtures.dashboardSummary(),
+      timeline: { buckets: TIMELINE, range: '24h', interval: '1h', cached: false },
+      topIps: { ips: TOP_IPS, range: '24h', cached: false },
+      scenarios: { scenarios: SCENARIOS, total: 100, range: '24h', cached: false },
+      alerts: alertsPage,
+      ...overrides,
+    },
+  };
+}
+
+/** Installs the stubs, loads the CrowdSec page and opens the Dashboard tab. */
+async function openDashboard(page: Page, options: CrowdSecStubOptions = dashboardOptions()) {
+  const recorder = await stubCrowdSecApi(page, options);
+  await page.goto('/security/crowdsec');
+  await waitForLoadingComplete(page);
+  await page.getByRole('tab', { name: 'Dashboard', exact: true }).click();
+  await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible();
+  return recorder;
+}
+
+/** The accessible name of this group is currently a raw i18n error string (F3), so it is located by role only. */
+const timeRangeGroup = (page: Page) => page.getByRole('radiogroup');
+const activeDecisionsTable = (page: Page) =>
+  page.getByRole('table').filter({ has: page.getByRole('button', { name: 'Sort by Alerts' }) });
+const alertsTable = (page: Page) =>
+  page.getByRole('table').filter({ has: page.getByRole('columnheader', { name: 'Scenario' }) });
+
+/** Text of the first cell of each body row, in display order. */
+async function firstColumn(table: Locator): Promise<string[]> {
+  return table.getByRole('row').filter({ has: table.page().getByRole('cell') }).evaluateAll((rows) =>
+    rows.map((row) => row.querySelector('td')?.textContent?.trim() ?? ''),
+  );
+}
 
 test.describe('CrowdSec Dashboard @security', () => {
   test.beforeEach(async ({ page, adminUser }) => {
     await loginUser(page, adminUser);
     await waitForLoadingComplete(page);
-    await page.goto('/security/crowdsec');
-    await waitForLoadingComplete(page);
   });
 
   test.describe('Tab Navigation', () => {
+    test.beforeEach(async ({ page }) => {
+      await stubCrowdSecApi(page, dashboardOptions());
+      await page.goto('/security/crowdsec');
+      await waitForLoadingComplete(page);
+    });
+
     test('should display Configuration and Dashboard tabs', async ({ page }) => {
-      await test.step('Verify tab list is present', async () => {
-        const tabList = page.getByRole('tablist');
-        await expect(tabList).toBeVisible();
-      });
+      await expect(page.getByRole('tablist')).toBeVisible();
+      await expect(page.getByRole('tab', { name: 'Configuration', exact: true })).toBeVisible();
+      await expect(page.getByRole('tab', { name: 'Dashboard', exact: true })).toBeVisible();
+    });
+
+    test('should default to Configuration tab', async ({ page }) => {
+      await expect(page.getByRole('tab', { name: 'Configuration', exact: true })).toHaveAttribute('data-state', 'active');
+      await expect(page.getByRole('tab', { name: 'Dashboard', exact: true })).toHaveAttribute('data-state', 'inactive');
+      await expect(page.getByTestId('dashboard-summary-cards')).toHaveCount(0);
+    });
 
-      await test.step('Verify Configuration tab', async () => {
-        const configTab = page.getByRole('tab', { name: /configuration/i });
-        await expect(configTab).toBeVisible();
+    test('should switch to the Dashboard tab and back', async ({ page }) => {
+      await test.step('Open the Dashboard tab', async () => {
+        await page.getByRole('tab', { name: 'Dashboard', exact: true }).click();
+        await expect(page.getByRole('tab', { name: 'Dashboard', exact: true })).toHaveAttribute('data-state', 'active');
+        await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible();
       });
 
-      await test.step('Verify Dashboard tab', async () => {
-        const dashboardTab = page.getByRole('tab', { name: /dashboard/i });
-        await expect(dashboardTab).toBeVisible();
+      await test.step('Return to the Configuration tab', async () => {
+        await page.getByRole('tab', { name: 'Configuration', exact: true }).click();
+        await expect(page.getByRole('tab', { name: 'Configuration', exact: true })).toHaveAttribute('data-state', 'active');
+        await expect(page.getByTestId('dashboard-summary-cards')).toHaveCount(0);
+        await expect(page.getByRole('heading', { name: 'Presets', level: 3 })).toBeVisible();
       });
     });
+  });
 
-    test('should default to Configuration tab', async ({ page }) => {
-      await test.step('Verify Configuration tab is selected by default', async () => {
-        const configTab = page.getByRole('tab', { name: /configuration/i });
-        await expect(configTab).toHaveAttribute('data-state', 'active');
-      });
+  test.describe('Summary Cards', () => {
+    test('should show the summary figures', async ({ page }) => {
+      await openDashboard(page);
+
+      const cards = page.getByTestId('dashboard-summary-cards');
+      await expect(cards.getByText('Total Decisions', { exact: true })).toBeVisible();
+      await expect(cards.getByText('1,234', { exact: true })).toBeVisible();
+      await expect(cards.getByText('+12.5%', { exact: true })).toBeVisible();
+      await expect(cards.getByText('Active Decisions', { exact: true })).toBeVisible();
+      await expect(cards.getByText('56', { exact: true })).toBeVisible();
+      await expect(cards.getByText('Currently enforced', { exact: true })).toBeVisible();
+      await expect(cards.getByText('Unique IPs', { exact: true })).toBeVisible();
+      await expect(cards.getByText('78', { exact: true })).toBeVisible();
+      await expect(cards.getByText('Top Scenario', { exact: true })).toBeVisible();
+      await expect(cards.getByText('http-probing', { exact: true })).toBeVisible();
+      await expect(cards.getByText('crowdsecurity/http-probing', { exact: true })).toBeVisible();
     });
 
-    test('should switch to Dashboard tab when clicked', async ({ page }) => {
-      await test.step('Click Dashboard tab', async () => {
-        await page.getByRole('tab', { name: /dashboard/i }).click();
+    const TRENDS = [
+      { name: 'a falling', trend: -3, label: '-3.0%' },
+      { name: 'a flat', trend: 0, label: '0%' },
+    ];
+    for (const { name, trend, label } of TRENDS) {
+      test(`should show ${name} decision trend`, async ({ page }) => {
+        await openDashboard(
+          page,
+          dashboardOptions({ summary: crowdsecFixtures.dashboardSummary({ decisions_trend: trend }) }),
+        );
+
+        await expect(page.getByTestId('dashboard-summary-cards').getByText(label, { exact: true })).toBeVisible();
       });
+    }
 
-      await test.step('Verify Dashboard tab is selected', async () => {
-        const dashboardTab = page.getByRole('tab', { name: /dashboard/i });
-        await expect(dashboardTab).toHaveAttribute('data-state', 'active');
-      });
+    test('should show N/A when the local API is unavailable', async ({ page }) => {
+      await openDashboard(
+        page,
+        dashboardOptions({ summary: crowdsecFixtures.dashboardSummary({ active_decisions: -1 }) }),
+      );
 
-      await test.step('Verify dashboard content is visible', async () => {
-        await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible({ timeout: 10000 });
-      });
+      const cards = page.getByTestId('dashboard-summary-cards');
+      await expect(cards.getByText('N/A', { exact: true })).toBeVisible();
+      await expect(cards.getByText('LAPI unavailable', { exact: true })).toBeVisible();
     });
 
-    test('should switch back to Configuration tab', async ({ page }) => {
-      await test.step('Navigate to Dashboard tab', async () => {
-        await page.getByRole('tab', { name: /dashboard/i }).click();
-        await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible({ timeout: 10000 });
-      });
+    test('should show a placeholder when there is no top scenario', async ({ page }) => {
+      await openDashboard(
+        page,
+        dashboardOptions({ summary: crowdsecFixtures.dashboardSummary({ top_scenario: '' }) }),
+      );
 
-      await test.step('Switch back to Configuration tab', async () => {
-        await page.getByRole('tab', { name: /configuration/i }).click();
-      });
+      const cards = page.getByTestId('dashboard-summary-cards');
+      await expect(cards.getByText('—', { exact: true })).toBeVisible();
+      await expect(cards.getByText('No data', { exact: true })).toBeVisible();
+    });
 
-      await test.step('Verify Configuration content is visible', async () => {
-        const configTab = page.getByRole('tab', { name: /configuration/i });
-        await expect(configTab).toHaveAttribute('data-state', 'active');
+    test('should show an error when the summary cannot be loaded', async ({ page }) => {
+      await openDashboard(page, dashboardOptions({ summary: SERVER_ERROR }));
+
+      await expect(page.getByTestId('dashboard-summary-cards')).toHaveText('Failed to load summary data.', {
+        timeout: ERROR_TIMEOUT,
       });
     });
   });
 
-  test.describe('Dashboard Content', () => {
-    test.beforeEach(async ({ page }) => {
-      await page.getByRole('tab', { name: /dashboard/i }).click();
-      await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible({ timeout: 10000 });
+  test.describe('Charts', () => {
+    test('should render the timeline, top IPs and scenario charts', async ({ page }) => {
+      await openDashboard(page);
+
+      await expect(page.getByRole('heading', { name: 'Decision Timeline' })).toBeVisible();
+      await expect(page.getByRole('img', { name: 'Area chart showing bans and captchas over time' })).toBeVisible();
+      await expect(page.getByRole('heading', { name: 'Top Attacking IPs' })).toBeVisible();
+      await expect(
+        page.getByRole('img', { name: 'Horizontal bar chart showing top attacking IPs by decision count' }),
+      ).toBeVisible();
+      await expect(page.getByRole('heading', { name: 'Scenario Breakdown' })).toBeVisible();
+      await expect(
+        page.getByRole('img', { name: 'Donut chart showing distribution of scenarios by decision count' }),
+      ).toBeVisible();
     });
 
-    test('should display summary cards section', async ({ page }) => {
-      await test.step('Verify summary cards container', async () => {
-        await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible();
-      });
+    test('should list each scenario with its count and share', async ({ page }) => {
+      await openDashboard(page);
+
+      const legend = page.getByRole('list', { name: 'Scenario legend' });
+      await expect(legend.getByRole('listitem')).toHaveCount(2);
+      await expect(legend.getByRole('listitem').nth(0)).toHaveText('http-probing6060.0%');
+      await expect(legend.getByRole('listitem').nth(1)).toHaveText('ssh-bf4040.0%');
     });
 
-    test('should display time range selector', async ({ page }) => {
-      await test.step('Verify time range buttons are present', async () => {
-        const timeRangeGroup = page.getByRole('tablist', { name: /time range/i });
-        const timeRangeVisible = await timeRangeGroup.isVisible().catch(() => false);
-
-        if (timeRangeVisible) {
-          await expect(timeRangeGroup).toBeVisible();
-        } else {
-          // Fallback: look for individual time range buttons
-          const button24h = page.getByRole('tab', { name: /24h/i });
-          const buttonVisible = await button24h.isVisible().catch(() => false);
-
-          if (buttonVisible) {
-            await expect(button24h).toBeVisible();
-          } else {
-            test.info().annotations.push({
-              type: 'info',
-              description: 'Time range selector not visible - may use different UI pattern',
-            });
-          }
-        }
-      });
+    test('should show empty states when there is no data', async ({ page }) => {
+      await openDashboard(
+        page,
+        dashboardOptions({
+          timeline: { buckets: [], range: '24h', interval: '1h', cached: false },
+          topIps: { ips: [], range: '24h', cached: false },
+          scenarios: { scenarios: [], total: 0, range: '24h', cached: false },
+        }),
+      );
+
+      await expect(page.getByText('No decision data for the selected period.', { exact: true })).toBeVisible();
+      await expect(page.getByText('No attacking IPs in the selected period.', { exact: true })).toBeVisible();
+      await expect(page.getByText('No scenario data for the selected period.', { exact: true })).toBeVisible();
+      await expect(page.getByRole('img', { name: /chart showing/ })).toHaveCount(0);
     });
 
-    test('should display refresh button', async ({ page }) => {
-      await test.step('Verify refresh button exists', async () => {
-        const refreshButton = page.getByRole('button', { name: /refresh/i });
-        await expect(refreshButton).toBeVisible();
-      });
+    test('should show an error in each chart panel when its data cannot be loaded', async ({ page }) => {
+      await openDashboard(
+        page,
+        dashboardOptions({ timeline: SERVER_ERROR, topIps: SERVER_ERROR, scenarios: SERVER_ERROR }),
+      );
+
+      await expect(page.getByText('Failed to load timeline data.', { exact: true })).toBeVisible({ timeout: ERROR_TIMEOUT });
+      await expect(page.getByText('Failed to load top IPs data.', { exact: true })).toBeVisible({ timeout: ERROR_TIMEOUT });
+      await expect(page.getByText('Failed to load scenario data.', { exact: true })).toBeVisible({ timeout: ERROR_TIMEOUT });
     });
+  });
 
-    test('should display chart sections', async ({ page }) => {
-      await test.step('Verify chart containers are rendered', async () => {
-        // Charts render as role="img" with aria-labels
-        const banTimeline = page.getByRole('img', { name: /ban.*timeline|timeline.*chart/i });
-        const banTimelineVisible = await banTimeline.isVisible().catch(() => false);
-
-        const topIPs = page.getByRole('img', { name: /top.*ip|attacking.*ip/i });
-        const topIPsVisible = await topIPs.isVisible().catch(() => false);
-
-        const scenarios = page.getByRole('img', { name: /scenario.*breakdown|scenario.*chart/i });
-        const scenariosVisible = await scenarios.isVisible().catch(() => false);
-
-        // At least one chart should render (even with error/empty state)
-        // Charts may not render if CrowdSec is not running
-        if (!banTimelineVisible && !topIPsVisible && !scenariosVisible) {
-          // Check for error or empty state messages instead
-          const errorOrEmpty = page.getByText(/error|no data|unavailable|failed/i).first();
-          const hasMessage = await errorOrEmpty.isVisible().catch(() => false);
-
-          if (!hasMessage) {
-            test.info().annotations.push({
-              type: 'info',
-              description: 'Charts not rendered - CrowdSec may not be running or no data available',
-            });
-          }
-        }
-      });
+  test.describe('Active Decisions Table', () => {
+    test('should list the decisions sorted by alert count, highest first', async ({ page }) => {
+      await openDashboard(page);
+
+      const table = activeDecisionsTable(page);
+      await expect(page.getByRole('heading', { name: 'Active Decisions' })).toBeVisible();
+      await expect(table.getByRole('columnheader')).toHaveText(['IP', 'Alerts', 'Last Seen', 'Country']);
+      await expect.poll(() => firstColumn(table)).toEqual(['203.0.113.2', '203.0.113.1', '203.0.113.3']);
+      await expect(table.getByRole('columnheader', { name: 'Sort by Alerts' })).toHaveAttribute('aria-sort', 'descending');
     });
 
-    test('should display active decisions table', async ({ page }) => {
-      await test.step('Verify decisions table or empty state', async () => {
-        const table = page.getByRole('table');
-        const tableVisible = await table.isVisible().catch(() => false);
-
-        if (tableVisible) {
-          // If table is visible, verify it has column headers
-          const headers = page.getByRole('columnheader');
-          const headerCount = await headers.count();
-          expect(headerCount).toBeGreaterThan(0);
-        } else {
-          // Table may not render if no data or CrowdSec not running
-          const errorOrEmpty = page.getByText(/error|no.*decisions|no.*alerts|no data/i).first();
-          const hasMessage = await errorOrEmpty.isVisible().catch(() => false);
-
-          if (!hasMessage) {
-            test.info().annotations.push({
-              type: 'info',
-              description: 'Active decisions table not visible - CrowdSec may not be running',
-            });
-          }
-        }
-      });
+    test('should show the country of each decision, or a dash when unknown', async ({ page }) => {
+      await openDashboard(page);
+
+      const rows = activeDecisionsTable(page).getByRole('row');
+      await expect(rows.filter({ hasText: '203.0.113.1' }).getByRole('cell').nth(3)).toHaveText('DE');
+      await expect(rows.filter({ hasText: '203.0.113.2' }).getByRole('cell').nth(3)).toHaveText('US');
+      await expect(rows.filter({ hasText: '203.0.113.3' }).getByRole('cell').nth(3)).toHaveText('—');
     });
 
-    test('should display alerts list section', async ({ page }) => {
-      await test.step('Verify alerts list or empty state', async () => {
-        const alertsList = page.getByTestId('alerts-list');
-        await expect(alertsList).toBeVisible({ timeout: 10000 });
+    test('should expose the exact last seen time on each row', async ({ page }) => {
+      await openDashboard(page);
+
+      const row = activeDecisionsTable(page).getByRole('row').filter({ hasText: '203.0.113.1' });
+      await expect(row.locator('time')).toHaveAttribute('datetime', '2020-01-01T00:00:00Z');
+    });
+
+    test('should re-sort when a column header is activated', async ({ page }) => {
+      await openDashboard(page);
+      const table = activeDecisionsTable(page);
+
+      await test.step('Sort by IP, highest first', async () => {
+        await table.getByRole('button', { name: 'Sort by IP' }).click();
+        await expect(table.getByRole('columnheader', { name: 'Sort by IP' })).toHaveAttribute('aria-sort', 'descending');
+        await expect(table.getByRole('columnheader', { name: 'Sort by Alerts' })).toHaveAttribute('aria-sort', 'none');
+        await expect.poll(() => firstColumn(table)).toEqual(['203.0.113.3', '203.0.113.2', '203.0.113.1']);
+      });
+
+      await test.step('Activate the same header again to reverse the order', async () => {
+        await table.getByRole('button', { name: 'Sort by IP' }).click();
+        await expect(table.getByRole('columnheader', { name: 'Sort by IP' })).toHaveAttribute('aria-sort', 'ascending');
+        await expect.poll(() => firstColumn(table)).toEqual(['203.0.113.1', '203.0.113.2', '203.0.113.3']);
       });
     });
 
-    test('should display export button', async ({ page }) => {
-      await test.step('Verify export button is visible', async () => {
-        const exportBtn = page.getByRole('button', { name: /export/i });
-        await expect(exportBtn).toBeVisible();
+    test('should show an empty state when there are no decisions', async ({ page }) => {
+      await openDashboard(page, dashboardOptions({ topIps: { ips: [], range: '24h', cached: false } }));
+
+      await expect(page.getByText('No active decisions.', { exact: true })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Sort by IP' })).toHaveCount(0);
+    });
+
+    test('should show an error when the decisions cannot be loaded', async ({ page }) => {
+      await openDashboard(page, dashboardOptions({ topIps: SERVER_ERROR }));
+
+      await expect(page.getByText('Failed to load decisions.', { exact: true })).toBeVisible({ timeout: ERROR_TIMEOUT });
+    });
+  });
+
+  test.describe('Alerts List', () => {
+    test('should list the first page of alerts', async ({ page }) => {
+      const recorder = await openDashboard(page);
+
+      const list = page.getByTestId('alerts-list');
+      await expect(list.getByRole('heading', { name: 'Recent Alerts' })).toBeVisible();
+      await expect(list.getByText('25 total', { exact: true })).toBeVisible();
+
+      const table = alertsTable(page);
+      await expect(table.getByRole('columnheader')).toHaveText(['IP', 'Scenario', 'Time', 'Events']);
+      await expect(table.getByRole('row')).toHaveCount(ALERT_PAGE_SIZE + 1);
+      const first = table.getByRole('row').nth(1);
+      await expect(first.getByRole('cell').nth(0)).toHaveText('198.51.100.1');
+      await expect(first.getByRole('cell').nth(1)).toHaveText('scenario-1');
+      await expect(first.getByRole('cell').nth(3)).toHaveText('2');
+      await expect(first.locator('time')).toHaveAttribute('datetime', '2026-01-01T00:05:00Z');
+      expect(recorder.alertQueries[0]).toEqual({ range: '24h', limit: '10', offset: '0' });
+    });
+
+    test('should page through the alerts', async ({ page }) => {
+      const recorder = await openDashboard(page);
+      const pagination = page.getByRole('navigation', { name: 'Alerts pagination' });
+      const previous = pagination.getByRole('button', { name: 'Previous page' });
+      const next = pagination.getByRole('button', { name: 'Next page' });
+      const table = alertsTable(page);
+
+      await test.step('First page', async () => {
+        await expect(pagination.getByText('Page 1 of 3', { exact: true })).toBeVisible();
+        await expect(previous).toBeDisabled();
+        await expect(next).toBeEnabled();
       });
 
-      await test.step('Open export dropdown', async () => {
-        const exportBtn = page.getByRole('button', { name: /export/i });
-        await exportBtn.click();
-
-        const menu = page.getByRole('menu');
-        const menuVisible = await menu.isVisible().catch(() => false);
-
-        if (menuVisible) {
-          const csvOption = page.getByRole('menuitem', { name: /csv/i });
-          const jsonOption = page.getByRole('menuitem', { name: /json/i });
-          await expect(csvOption).toBeVisible();
-          await expect(jsonOption).toBeVisible();
-        } else {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Export dropdown menu did not open - may need interaction delay',
-          });
-        }
+      await test.step('Second page', async () => {
+        await next.click();
+        await expect(pagination.getByText('Page 2 of 3', { exact: true })).toBeVisible();
+        await expect(table.getByRole('row').nth(1).getByRole('cell').nth(0)).toHaveText('198.51.100.11');
+        await expect(previous).toBeEnabled();
+        expect(recorder.alertQueries.at(-1)).toEqual({ range: '24h', limit: '10', offset: '10' });
       });
+
+      await test.step('Last page holds the remaining alerts', async () => {
+        await next.click();
+        await expect(pagination.getByText('Page 3 of 3', { exact: true })).toBeVisible();
+        await expect(table.getByRole('row')).toHaveCount(5 + 1);
+        await expect(next).toBeDisabled();
+        expect(recorder.alertQueries.at(-1)).toEqual({ range: '24h', limit: '10', offset: '20' });
+      });
+
+      await test.step('Back to the previous page', async () => {
+        await previous.click();
+        await expect(pagination.getByText('Page 2 of 3', { exact: true })).toBeVisible();
+        await expect(table.getByRole('row').nth(1).getByRole('cell').nth(0)).toHaveText('198.51.100.11');
+      });
+    });
+
+    test('should not show pagination when everything fits on one page', async ({ page }) => {
+      await openDashboard(
+        page,
+        dashboardOptions({
+          alerts: () => ({ alerts: [crowdsecFixtures.alert()], total: 1, source: 'lapi', cached: false }),
+        }),
+      );
+
+      await expect(page.getByTestId('alerts-list').getByText('1 total', { exact: true })).toBeVisible();
+      await expect(alertsTable(page).getByRole('row')).toHaveCount(2);
+      await expect(page.getByRole('navigation', { name: 'Alerts pagination' })).toHaveCount(0);
+    });
+
+    test('should show an empty state when there are no alerts', async ({ page }) => {
+      await openDashboard(
+        page,
+        dashboardOptions({ alerts: () => ({ alerts: [], total: 0, source: 'lapi', cached: false }) }),
+      );
+
+      await expect(page.getByTestId('alerts-list')).toHaveText('No alerts for the selected period.');
+    });
+
+    test('should show an error when the alerts cannot be loaded', async ({ page }) => {
+      await openDashboard(page, dashboardOptions({ alerts: SERVER_ERROR }));
+
+      await expect(page.getByTestId('alerts-list')).toHaveText('Failed to load alerts.', { timeout: ERROR_TIMEOUT });
     });
   });
 
   test.describe('Time Range Interaction', () => {
-    test.beforeEach(async ({ page }) => {
-      await page.getByRole('tab', { name: /dashboard/i }).click();
-      await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible({ timeout: 10000 });
-    });
-
-    test('should update data when selecting different time range', async ({ page }) => {
-      await test.step('Select 7d time range', async () => {
-        const sevenDayButton = page.getByRole('tab', { name: /7d/i });
-        const sevenDayVisible = await sevenDayButton.isVisible().catch(() => false);
-
-        if (sevenDayVisible) {
-          await sevenDayButton.click();
-          await expect(sevenDayButton).toHaveAttribute('aria-selected', 'true');
-        } else {
-          test.info().annotations.push({
-            type: 'info',
-            description: '7d time range button not found - may use different selector pattern',
-          });
-        }
+    test('should expose the time range as a radio group', async ({ page }) => {
+      await openDashboard(page);
+
+      await expect(timeRangeGroup(page)).toMatchAriaSnapshot(`
+        - radiogroup:
+          - radio "1H"
+          - radio "6H"
+          - radio "24H" [checked]
+          - radio "7D"
+          - radio "30D"
+      `);
+    });
+
+    test('should name the time range group in readable text', async ({ page }) => {
+      await openDashboard(page);
+
+      await expect(page.getByRole('radiogroup', { name: 'Time range', exact: true })).toBeVisible();
+    });
+
+    test('should request data for the selected time range', async ({ page }) => {
+      const recorder = await openDashboard(page);
+      const group = timeRangeGroup(page);
+
+      await test.step('Defaults to 24 hours', async () => {
+        await expect(group.getByRole('radio', { name: '24H' })).toBeChecked();
+        expect(recorder.dashboardQueries.summary[0]).toEqual({ range: '24h' });
+        expect(recorder.dashboardQueries['top-ips'][0]).toEqual({ range: '24h', limit: '10' });
       });
+
+      await test.step('Select 7 days', async () => {
+        await group.getByRole('radio', { name: '7D' }).click();
+        await expect(group.getByRole('radio', { name: '7D' })).toBeChecked();
+        await expect(group.getByRole('radio', { name: '24H' })).not.toBeChecked();
+        await expect.poll(() => recorder.dashboardQueries.summary.at(-1)).toEqual({ range: '7d' });
+        await expect.poll(() => recorder.dashboardQueries.timeline.at(-1)).toEqual({ range: '7d' });
+        await expect.poll(() => recorder.dashboardQueries.scenarios.at(-1)).toEqual({ range: '7d' });
+        await expect.poll(() => recorder.dashboardQueries['top-ips'].at(-1)).toEqual({ range: '7d', limit: '10' });
+        await expect.poll(() => recorder.alertQueries.at(-1)).toEqual({ range: '7d', limit: '10', offset: '0' });
+      });
+    });
+
+    test('should move between time ranges with the arrow keys', async ({ page }) => {
+      await openDashboard(page);
+      const group = timeRangeGroup(page);
+
+      await group.getByRole('radio', { name: '24H' }).focus();
+      await page.keyboard.press('ArrowRight');
+      await expect(group.getByRole('radio', { name: '7D' })).toBeChecked();
+      await expect(group.getByRole('radio', { name: '7D' })).toBeFocused();
+
+      await page.keyboard.press('End');
+      await expect(group.getByRole('radio', { name: '30D' })).toBeChecked();
+
+      await page.keyboard.press('Home');
+      await expect(group.getByRole('radio', { name: '1H' })).toBeChecked();
+
+      await page.keyboard.press('ArrowLeft');
+      await expect(group.getByRole('radio', { name: '30D' })).toBeChecked();
+    });
+
+    test('should return to the first alerts page when the time range changes', async ({ page }) => {
+      const recorder = await openDashboard(page);
+      const pagination = page.getByRole('navigation', { name: 'Alerts pagination' });
+
+      await pagination.getByRole('button', { name: 'Next page' }).click();
+      await expect(pagination.getByText('Page 2 of 3', { exact: true })).toBeVisible();
+
+      await timeRangeGroup(page).getByRole('radio', { name: '30D' }).click();
+      await expect(pagination.getByText('Page 1 of 3', { exact: true })).toBeVisible();
+      expect(recorder.alertQueries.at(-1)).toEqual({ range: '30d', limit: '10', offset: '0' });
     });
   });
 
   test.describe('Refresh Functionality', () => {
-    test.beforeEach(async ({ page }) => {
-      await page.getByRole('tab', { name: /dashboard/i }).click();
-      await expect(page.getByTestId('dashboard-summary-cards')).toBeVisible({ timeout: 10000 });
-    });
-
-    test('should trigger data refresh when clicking refresh button', async ({ page }) => {
-      await test.step('Click refresh and verify loading state', async () => {
-        const refreshButton = page.getByRole('button', { name: /refresh/i });
-        await expect(refreshButton).toBeVisible();
-
-        // Click refresh and expect API calls to be triggered
-        const responsePromise = page.waitForResponse(
-          resp => resp.url().includes('/crowdsec/dashboard') || resp.url().includes('/crowdsec/alerts'),
-          { timeout: 10000 }
-        ).catch(() => null);
-
-        await refreshButton.click();
-
-        const response = await responsePromise;
-        if (response) {
-          // API call was made - refresh working
-          expect(response.status()).toBeLessThan(500);
-        } else {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'No dashboard API response detected after refresh - endpoints may not be implemented',
-          });
-        }
+    test('should reload every panel when clicking refresh', async ({ page }) => {
+      const recorder = await openDashboard(page);
+      await expect.poll(() => recorder.alertQueries.length).toBe(1);
+
+      await page.getByRole('button', { name: 'Refresh', exact: true }).click();
+
+      await expect.poll(() => recorder.dashboardQueries.summary.length).toBe(2);
+      await expect.poll(() => recorder.dashboardQueries.timeline.length).toBe(2);
+      await expect.poll(() => recorder.dashboardQueries['top-ips'].length).toBe(2);
+      await expect.poll(() => recorder.dashboardQueries.scenarios.length).toBe(2);
+      await expect.poll(() => recorder.alertQueries.length).toBe(2);
+      await expect(page.getByRole('button', { name: 'Refresh', exact: true })).toBeEnabled();
+    });
+  });
+
+  test.describe('Export', () => {
+    const today = () => new Date().toISOString().slice(0, 10);
+
+    test('should offer CSV and JSON export formats', async ({ page }) => {
+      await openDashboard(page);
+      const exportButton = page.getByRole('button', { name: 'Export decisions' });
+
+      await expect(exportButton).toHaveAttribute('aria-expanded', 'false');
+      await exportButton.click();
+      await expect(exportButton).toHaveAttribute('aria-expanded', 'true');
+      await expect(page.getByRole('menu', { name: 'Export format' })).toMatchAriaSnapshot(`
+        - menu "Export format":
+          - menuitem "Export as CSV"
+          - menuitem "Export as JSON"
+      `);
+    });
+
+    const FORMATS = [
+      { label: 'Export as CSV', format: 'csv', contentType: 'text/csv', body: 'ip,reason\n203.0.113.2,probing\n' },
+      { label: 'Export as JSON', format: 'json', contentType: 'application/json', body: '[{"ip":"203.0.113.2"}]' },
+    ];
+    for (const { label, format, contentType, body } of FORMATS) {
+      test(`should download the decisions as ${format.toUpperCase()}`, async ({ page }) => {
+        const recorder = await openDashboard(page, {
+          ...dashboardOptions(),
+          decisionsExport: { body, contentType },
+        });
+
+        await page.getByRole('button', { name: 'Export decisions' }).click();
+        const downloadPromise = page.waitForEvent('download');
+        await page.getByRole('menuitem', { name: label }).click();
+        const download = await downloadPromise;
+
+        expect(download.suggestedFilename()).toBe(`crowdsec-decisions-${today()}.${format}`);
+        expect(recorder.decisionsExportQueries).toEqual([{ format, range: '24h', source: 'all' }]);
+        await expect(page.getByRole('menu')).toHaveCount(0);
+        await expect(page.getByRole('alert')).toHaveCount(0);
+      });
+    }
+
+    test('should export the selected time range', async ({ page }) => {
+      const recorder = await openDashboard(page, {
+        ...dashboardOptions(),
+        decisionsExport: { body: 'ip\n', contentType: 'text/csv' },
       });
+
+      await timeRangeGroup(page).getByRole('radio', { name: '7D' }).click();
+      await page.getByRole('button', { name: 'Export decisions' }).click();
+      const downloadPromise = page.waitForEvent('download');
+      await page.getByRole('menuitem', { name: 'Export as CSV' }).click();
+      await downloadPromise;
+
+      expect(recorder.decisionsExportQueries).toEqual([{ format: 'csv', range: '7d', source: 'all' }]);
+    });
+
+    test('should close the menu with Escape', async ({ page }) => {
+      await openDashboard(page);
+      const exportButton = page.getByRole('button', { name: 'Export decisions' });
+
+      await exportButton.click();
+      await expect(page.getByRole('menu')).toBeVisible();
+      await page.keyboard.press('Escape');
+      await expect(page.getByRole('menu')).toHaveCount(0);
+      await expect(exportButton).toBeFocused();
+    });
+
+    test('should show an error when the export fails', async ({ page }) => {
+      await openDashboard(page, { ...dashboardOptions(), decisionsExport: SERVER_ERROR });
+
+      await page.getByRole('button', { name: 'Export decisions' }).click();
+      await page.getByRole('menuitem', { name: 'Export as CSV' }).click();
+
+      await expect(page.getByRole('alert')).toHaveText('Export failed. Please try again.');
+    });
+
+    test('should show an error when the export is empty', async ({ page }) => {
+      await openDashboard(page, {
+        ...dashboardOptions(),
+        decisionsExport: { body: '', contentType: 'text/csv' },
+      });
+
+      await page.getByRole('button', { name: 'Export decisions' }).click();
+      await page.getByRole('menuitem', { name: 'Export as CSV' }).click();
+
+      await expect(page.getByRole('alert')).toHaveText('Export failed. Please try again.');
     });
   });
 });
diff --git a/tests/security/crowdsec-decisions.spec.ts b/tests/security/crowdsec-decisions.spec.ts
index ff194326e..bfaae7575 100644
--- a/tests/security/crowdsec-decisions.spec.ts
+++ b/tests/security/crowdsec-decisions.spec.ts
@@ -1,286 +1,318 @@
 /**
  * CrowdSec Banned IPs (Decisions) E2E Tests
  *
- * Tests the CrowdSec banned IPs functionality on the main CrowdSec config page:
- * - Viewing active bans (decisions)
- * - Adding manual IP bans
- * - Removing bans (unban)
- * - Ban details and status
+ * Tests the "Banned IPs" card on /security/crowdsec against a stubbed CrowdSec API
+ * (see tests/utils/crowdsec-stubs.ts), so every assertion runs against known data:
+ * - Listing active bans, and the empty, disabled and error states
+ * - Banning an IP (modal, validation, exact request payload, outcomes)
+ * - Unbanning an IP (confirmation, request, outcomes)
  *
- * NOTE: CrowdSec "Decisions" are managed via the "Banned IPs" card on /security/crowdsec
- * There is no separate /security/crowdsec/decisions page - functionality is integrated.
+ * NOTE: CrowdSec "Decisions" are managed via the "Banned IPs" card on /security/crowdsec.
+ * There is no separate decisions page and the card has no search, filter or refresh control.
  *
  * @see /projects/Charon/docs/plans/current_spec.md
  */
 
+import type { Page } from '@playwright/test';
 import { test, expect, loginUser } from '../fixtures/auth-fixtures';
+import { getToastLocator } from '../utils/ui-helpers';
 import { waitForLoadingComplete } from '../utils/wait-helpers';
+import {
+  crowdsecFixtures,
+  stubCrowdSecApi,
+  type CrowdSecStubOptions,
+} from '../utils/crowdsec-stubs';
+
+const ERROR_TIMEOUT = 15_000;
+
+const DECISIONS = [
+  crowdsecFixtures.decision({
+    id: 'decision-1',
+    ip: '203.0.113.7',
+    reason: 'e2e brute force',
+    duration: '24h',
+    source: 'crowdsec',
+  }),
+  crowdsecFixtures.decision({ id: 'decision-2', ip: '203.0.113.8', reason: '', duration: '4h', source: '' }),
+];
+
+/** Installs the stubs (CrowdSec in local mode), loads the CrowdSec page and waits for the Banned IPs card. */
+async function openBannedIps(page: Page, options: CrowdSecStubOptions = {}) {
+  const recorder = await stubCrowdSecApi(page, {
+    crowdsecMode: 'local',
+    decisions: DECISIONS,
+    banApi: {},
+    ...options,
+  });
+  await page.goto('/security/crowdsec');
+  await waitForLoadingComplete(page);
+  await expect(bannedIpsHeading(page)).toBeVisible();
+  return recorder;
+}
+
+const bannedIpsHeading = (page: Page) => page.getByRole('heading', { name: 'Banned IPs', level: 3 });
+const banDialog = (page: Page) => page.getByRole('dialog', { name: 'Ban IP Address' });
+const unbanDialog = (page: Page) => page.getByRole('dialog', { name: 'Confirm Unban' });
+/** Toasts prefix the message with an icon glyph, so they are matched on the message text within the live region. */
+const successToast = (page: Page, message: string) => getToastLocator(page, message, { type: 'success' });
+const errorToast = (page: Page, message: string) => getToastLocator(page, message, { type: 'error' });
+const decisionRow = (page: Page, ip: string) => page.getByRole('row').filter({ hasText: ip });
 
 test.describe('CrowdSec Banned IPs Management', () => {
   test.beforeEach(async ({ page, adminUser }) => {
     await loginUser(page, adminUser);
     await waitForLoadingComplete(page);
-    await page.goto('/security/crowdsec');
-    await waitForLoadingComplete(page);
   });
 
   test.describe('Banned IPs Card', () => {
-    test('should display banned IPs section on CrowdSec config page', async ({ page }) => {
-      // Verify we're on the CrowdSec config page
-      await expect(page).toHaveURL('/security/crowdsec');
+    test('should display the banned IPs card on the CrowdSec config page', async ({ page }) => {
+      await openBannedIps(page);
 
-      // Verify banned IPs section exists
-      const bannedIpsHeading = page.getByRole('heading', { name: /banned ips/i });
-      await expect(bannedIpsHeading).toBeVisible();
+      await expect(page).toHaveURL('/security/crowdsec');
+      await expect(page.getByRole('button', { name: 'Ban IP', exact: true })).toBeEnabled();
     });
 
-    test('should show ban IP button when CrowdSec is enabled', async ({ page }) => {
-      // Check if CrowdSec is enabled (status card should show "Running")
-      const statusCard = page.locator('[class*="card"]').filter({ hasText: /status/i });
-      const isRunning = await statusCard.getByText(/running|active/i).isVisible().catch(() => false);
-
-      if (isRunning) {
-        // Ban IP button should be visible when CrowdSec is running
-        const banButton = page.getByRole('button', { name: /ban ip/i });
-        await expect(banButton).toBeVisible();
-      } else {
-        // Skip if CrowdSec is not enabled
-        // CrowdSec is not enabled - cannot test banned IPs functionality
-      }
+    test('should disable banning and explain why when CrowdSec is disabled', async ({ page }) => {
+      await openBannedIps(page, { crowdsecMode: 'disabled' });
+
+      await expect(page.getByRole('button', { name: 'Ban IP', exact: true })).toBeDisabled();
+      await expect(page.getByText('Enable CrowdSec to manage banned IPs', { exact: true })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Unban' })).toHaveCount(0);
     });
   });
 
-  // Data-focused tests - require CrowdSec running and full implementation
-  test.describe('Banned IPs Data Operations (Requires CrowdSec Running)', () => {
-    test('should show active decisions if any exist', async ({ page }) => {
-      // Wait for decisions to load
-      await page.waitForResponse(resp =>
-        resp.url().includes('/decisions') || resp.url().includes('/crowdsec'),
-        { timeout: 10000 }
-      ).catch(() => {
-        // API might not be called if no decisions
-      });
-
-      // Could be empty state or list of decisions
-      const emptyState = page.getByText(/no.*decisions|no.*bans|empty/i);
-      const decisionRows = page.locator('tr, [class*="row"]').filter({
-        hasText: /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|ban|captcha/i
-      });
-
-      const emptyVisible = await emptyState.isVisible().catch(() => false);
-      const rowCount = await decisionRows.count();
-
-      // Either empty state or some decisions
-      expect(emptyVisible || rowCount >= 0).toBeTruthy();
+  test.describe('Active Decisions', () => {
+    test('should list each active ban with its details', async ({ page }) => {
+      await openBannedIps(page);
+
+      await expect(page.getByRole('columnheader', { name: /^(IP|Reason|Duration|Banned At|Source|Actions)$/ })).toHaveText([
+        'IP',
+        'Reason',
+        'Duration',
+        'Banned At',
+        'Source',
+        'Actions',
+      ]);
+      const first = decisionRow(page, '203.0.113.7').getByRole('cell');
+      await expect(first.nth(0)).toHaveText('203.0.113.7');
+      await expect(first.nth(1)).toHaveText('e2e brute force');
+      await expect(first.nth(2)).toHaveText('24h');
+      await expect(first.nth(3)).toHaveText(new Date('2026-01-01T00:00:00Z').toLocaleString());
+      await expect(first.nth(4)).toHaveText('crowdsec');
+      await expect(first.nth(5).getByRole('button', { name: 'Unban' })).toBeVisible();
     });
 
-    test('should display decision columns (IP, type, duration, reason)', async ({ page }) => {
-      const table = page.getByRole('table');
-      const tableVisible = await table.isVisible().catch(() => false);
-
-      if (tableVisible) {
-        await test.step('Verify table headers', async () => {
-          const headers = page.locator('th, [role="columnheader"]');
-          const headerTexts = await headers.allTextContents();
-
-          // Headers might include IP, type, duration, scope, reason, origin
-          const headerString = headerTexts.join(' ').toLowerCase();
-          const hasRelevantHeaders = headerString.includes('ip') ||
-                                    headerString.includes('type') ||
-                                    headerString.includes('scope') ||
-                                    headerString.includes('origin');
-
-          expect(hasRelevantHeaders).toBeTruthy();
-        });
-      }
+    test('should show placeholders for a ban without a reason or source', async ({ page }) => {
+      await openBannedIps(page);
+
+      const cells = decisionRow(page, '203.0.113.8').getByRole('cell');
+      await expect(cells.nth(1)).toHaveText('-');
+      await expect(cells.nth(2)).toHaveText('4h');
+      await expect(cells.nth(4)).toHaveText('manual');
+    });
+
+    test('should offer an unban action for every ban', async ({ page }) => {
+      await openBannedIps(page);
+
+      await expect(page.getByRole('button', { name: 'Unban', exact: true })).toHaveCount(DECISIONS.length);
+    });
+
+    test('should show an empty state when nothing is banned', async ({ page }) => {
+      await openBannedIps(page, { decisions: [] });
+
+      await expect(page.getByText('No banned IPs', { exact: true })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Unban' })).toHaveCount(0);
+    });
+
+    test('should show an error when the bans cannot be loaded', async ({ page }) => {
+      await openBannedIps(page, { decisions: { failWith: 500 } });
+
+      await expect(page.getByText('Failed to load banned IPs', { exact: true })).toBeVisible({ timeout: ERROR_TIMEOUT });
+    });
+
+    test('should make each ban row keyboard focusable', async ({ page }) => {
+      await openBannedIps(page);
+      const row = decisionRow(page, '203.0.113.7');
+
+      await row.focus();
+      await expect(row).toBeFocused();
+      await page.keyboard.press('Tab');
+      await expect(row.getByRole('button', { name: 'Unban' })).toBeFocused();
     });
   });
 
-  test.describe('Add Decision (Ban IP) - Requires CrowdSec Running', () => {
-    test('should have add ban button', async ({ page }) => {
-      const addButton = page.getByRole('button', { name: /add|ban|new/i });
-      const addButtonVisible = await addButton.isVisible().catch(() => false);
-
-      if (addButtonVisible) {
-        await expect(addButton).toBeEnabled();
-      } else {
-        test.info().annotations.push({
-          type: 'info',
-          description: 'Add ban functionality might not be exposed in UI'
-        });
-      }
+  test.describe('Ban IP', () => {
+    test('should open the ban dialog with a focused IP field and sensible defaults', async ({ page }) => {
+      await openBannedIps(page);
+
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+
+      const dialog = banDialog(page);
+      await expect(dialog).toBeVisible();
+      await expect(dialog.getByLabel('IP Address')).toBeFocused();
+      await expect(dialog.getByLabel('IP Address')).toHaveValue('');
+      await expect(dialog.getByLabel('Duration')).toHaveValue('24h');
+      await expect(dialog.getByLabel('Duration').getByRole('option')).toHaveText([
+        '1 hour',
+        '4 hours',
+        '24 hours',
+        '7 days',
+        '30 days',
+        'Permanent',
+      ]);
+      await expect(dialog.getByLabel('Reason')).toHaveValue('');
+      await expect(dialog.getByRole('button', { name: 'Ban IP', exact: true })).toBeDisabled();
     });
 
-    test('should open ban modal on add button click', async ({ page }) => {
-      const addButton = page.getByRole('button', { name: /add.*ban|ban.*ip/i });
-      const addButtonVisible = await addButton.isVisible().catch(() => false);
-
-      if (addButtonVisible) {
-        await addButton.click();
-
-        await test.step('Verify ban modal opens', async () => {
-          const modal = page.getByRole('dialog');
-          const modalVisible = await modal.isVisible().catch(() => false);
-
-          if (modalVisible) {
-            // Modal should have IP input field
-            const ipInput = modal.getByPlaceholder(/ip|address/i).or(
-              modal.locator('input').first()
-            );
-            await expect(ipInput).toBeVisible();
-
-            // Close modal
-            const closeButton = modal.getByRole('button', { name: /cancel|close/i });
-            await closeButton.click();
-          }
-        });
-      }
+    test('should send the entered IP, duration and reason and report success', async ({ page }) => {
+      const stubs = await openBannedIps(page);
+
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+      const dialog = banDialog(page);
+      await dialog.getByLabel('IP Address').fill('198.51.100.9');
+      await dialog.getByLabel('Duration').selectOption({ label: '7 days' });
+      await dialog.getByLabel('Reason').fill('e2e manual ban');
+      await dialog.getByRole('button', { name: 'Ban IP', exact: true }).click();
+
+      await expect(successToast(page, 'IP 198.51.100.9 has been banned')).toBeVisible();
+      await expect(dialog).toHaveCount(0);
+      expect(stubs.bans).toEqual([{ ip: '198.51.100.9', duration: '7d', reason: 'e2e manual ban' }]);
     });
 
-    test('should validate IP address format', async ({ page }) => {
-      const addButton = page.getByRole('button', { name: /add.*ban|ban.*ip/i });
-      const addButtonVisible = await addButton.isVisible().catch(() => false);
+    test('should reload the list after banning an IP', async ({ page }) => {
+      const stubs = await openBannedIps(page);
+      await expect.poll(() => stubs.decisionsRequests).toBe(1);
 
-      if (addButtonVisible) {
-        await addButton.click();
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+      await banDialog(page).getByLabel('IP Address').fill('198.51.100.9');
+      await banDialog(page).getByRole('button', { name: 'Ban IP', exact: true }).click();
 
-        const modal = page.getByRole('dialog');
-        const modalVisible = await modal.isVisible().catch(() => false);
+      await expect(successToast(page, 'IP 198.51.100.9 has been banned')).toBeVisible();
+      await expect.poll(() => stubs.decisionsRequests).toBe(2);
+    });
 
-        if (modalVisible) {
-          const ipInput = modal.locator('input').first();
+    test('should submit with the keyboard from the IP field', async ({ page }) => {
+      const stubs = await openBannedIps(page);
 
-          await test.step('Enter invalid IP', async () => {
-            await ipInput.fill('invalid-ip');
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+      await banDialog(page).getByLabel('IP Address').fill('198.51.100.10');
+      await page.keyboard.press('Enter');
+
+      await expect(successToast(page, 'IP 198.51.100.10 has been banned')).toBeVisible();
+      expect(stubs.bans).toEqual([{ ip: '198.51.100.10', duration: '24h', reason: '' }]);
+    });
 
-            // Look for submit button
-            const submitButton = modal.getByRole('button', { name: /ban|submit|add/i });
-            await submitButton.click();
+    test('should keep the ban button disabled while the IP is blank', async ({ page }) => {
+      const stubs = await openBannedIps(page);
 
-            // Should show validation error
-            await page.waitForTimeout(500);
-          });
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+      const dialog = banDialog(page);
+      const submit = dialog.getByRole('button', { name: 'Ban IP', exact: true });
 
-          // Close modal
-          const closeButton = modal.getByRole('button', { name: /cancel|close/i });
-          const closeVisible = await closeButton.isVisible().catch(() => false);
-          if (closeVisible) {
-            await closeButton.click();
-          }
-        }
-      }
+      await dialog.getByLabel('IP Address').fill('   ');
+      await expect(submit).toBeDisabled();
+      await dialog.getByLabel('IP Address').fill('198.51.100.9');
+      await expect(submit).toBeEnabled();
+      await dialog.getByLabel('IP Address').fill('');
+      await expect(submit).toBeDisabled();
+      expect(stubs.bans).toEqual([]);
     });
-  });
 
-  test.describe('Remove Decision (Unban) - Requires CrowdSec Running', () => {
-    test('should show unban action for each decision', async ({ page }) => {
-      // If there are decisions, each should have an unban action
-      const unbanButtons = page.getByRole('button', { name: /unban|remove|delete/i });
-      const count = await unbanButtons.count();
+    test('should show the server error and keep the dialog open when the ban is rejected', async ({ page }) => {
+      const stubs = await openBannedIps(page, { banApi: { banFailure: { failWith: 400 } } });
+
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+      const dialog = banDialog(page);
+      await dialog.getByLabel('IP Address').fill('not-an-ip');
+      await dialog.getByRole('button', { name: 'Ban IP', exact: true }).click();
 
-      // Just verify the selector works - actual decisions may or may not exist
-      expect(count >= 0).toBeTruthy();
+      await expect(errorToast(page, 'ban rejected')).toBeVisible();
+      await expect(getToastLocator(page, /has been banned/, { type: 'success' })).toHaveCount(0);
+      await expect(dialog).toBeVisible();
+      await expect(dialog.getByLabel('IP Address')).toHaveValue('not-an-ip');
+      expect(stubs.bans).toEqual([{ ip: 'not-an-ip', duration: '24h', reason: '' }]);
     });
 
-    test('should confirm before unbanning', async ({ page }) => {
-      const unbanButton = page.getByRole('button', { name: /unban|remove/i }).first();
-      const unbanVisible = await unbanButton.isVisible().catch(() => false);
+    test('should close the dialog without banning when cancelled', async ({ page }) => {
+      const stubs = await openBannedIps(page);
 
-      if (unbanVisible) {
-        await unbanButton.click();
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+      await banDialog(page).getByLabel('IP Address').fill('198.51.100.9');
+      await banDialog(page).getByRole('button', { name: 'Cancel' }).click();
+
+      await expect(banDialog(page)).toHaveCount(0);
+      expect(stubs.bans).toEqual([]);
+    });
 
-        // Should show confirmation dialog
-        const confirmDialog = page.getByRole('dialog');
-        const dialogVisible = await confirmDialog.isVisible().catch(() => false);
+    test('should close the dialog with Escape without banning', async ({ page }) => {
+      const stubs = await openBannedIps(page);
 
-        if (dialogVisible) {
-          // Cancel the action
-          const cancelButton = page.getByRole('button', { name: /cancel|no/i });
-          await cancelButton.click();
-        }
-      }
+      await page.getByRole('button', { name: 'Ban IP', exact: true }).click();
+      await banDialog(page).getByLabel('IP Address').fill('198.51.100.9');
+      await page.keyboard.press('Escape');
+      await expect(banDialog(page)).toHaveCount(0);
+      expect(stubs.bans).toEqual([]);
     });
   });
 
-  test.describe('Filtering and Search - Requires CrowdSec Running', () => {
-    test('should have search/filter input', async ({ page }) => {
-      const searchInput = page.getByPlaceholder(/search|filter/i);
-      const searchVisible = await searchInput.isVisible().catch(() => false);
+  test.describe('Unban IP', () => {
+    test('should ask for confirmation naming the IP before unbanning', async ({ page }) => {
+      const stubs = await openBannedIps(page);
 
-      if (searchVisible) {
-        await expect(searchInput).toBeEnabled();
-      }
+      await decisionRow(page, '203.0.113.7').getByRole('button', { name: 'Unban' }).click();
+
+      const dialog = unbanDialog(page);
+      await expect(dialog).toBeVisible();
+      await expect(dialog.getByText('Are you sure you want to unban 203.0.113.7?')).toBeVisible();
+      await expect(dialog.getByRole('button', { name: 'Cancel' })).toBeFocused();
+      expect(stubs.unbans).toEqual([]);
     });
 
-    test('should filter decisions by type', async ({ page }) => {
-      const typeFilter = page.locator('select, [role="listbox"]').filter({
-        hasText: /type|all|ban|captcha/i
-      }).first();
+    test('should leave the ban in place when the confirmation is cancelled', async ({ page }) => {
+      const stubs = await openBannedIps(page);
 
-      const filterVisible = await typeFilter.isVisible().catch(() => false);
+      await decisionRow(page, '203.0.113.7').getByRole('button', { name: 'Unban' }).click();
+      await unbanDialog(page).getByRole('button', { name: 'Cancel' }).click();
 
-      if (filterVisible) {
-        await expect(typeFilter).toBeVisible();
-      }
+      await expect(unbanDialog(page)).toHaveCount(0);
+      await expect(decisionRow(page, '203.0.113.7')).toBeVisible();
+      expect(stubs.unbans).toEqual([]);
     });
-  });
 
-  test.describe('Refresh and Sync - Requires CrowdSec Running', () => {
-    test('should have refresh button', async ({ page }) => {
-      const refreshButton = page.getByRole('button', { name: /refresh|sync|reload/i });
-      const refreshVisible = await refreshButton.isVisible().catch(() => false);
-
-      if (refreshVisible) {
-        await test.step('Click refresh button', async () => {
-          await refreshButton.click();
-          // Should trigger API call
-          await page.waitForTimeout(500);
-        });
-      }
+    test('should unban the IP once confirmed and reload the list', async ({ page }) => {
+      const stubs = await openBannedIps(page);
+      await expect.poll(() => stubs.decisionsRequests).toBe(1);
+
+      await decisionRow(page, '203.0.113.7').getByRole('button', { name: 'Unban' }).click();
+      await unbanDialog(page).getByRole('button', { name: 'Unban', exact: true }).click();
+
+      await expect(successToast(page, 'IP 203.0.113.7 has been unbanned')).toBeVisible();
+      await expect(unbanDialog(page)).toHaveCount(0);
+      expect(stubs.unbans).toEqual(['203.0.113.7']);
+      await expect.poll(() => stubs.decisionsRequests).toBe(2);
     });
-  });
 
-  test.describe('Navigation - Requires CrowdSec Running', () => {
-    test('should navigate back to CrowdSec config', async ({ page }) => {
-      const backLink = page.getByRole('link', { name: /crowdsec|back|config/i });
-      const backVisible = await backLink.isVisible().catch(() => false);
+    test('should show the server error and keep the confirmation open when the unban fails', async ({ page }) => {
+      const stubs = await openBannedIps(page, { banApi: { unbanFailure: { failWith: 500 } } });
 
-      if (backVisible) {
-        await backLink.click();
-        await waitForLoadingComplete(page);
-        await expect(page).toHaveURL(/\/security\/crowdsec(?!\/decisions)/);
-      }
+      await decisionRow(page, '203.0.113.7').getByRole('button', { name: 'Unban' }).click();
+      await unbanDialog(page).getByRole('button', { name: 'Unban', exact: true }).click();
+
+      await expect(errorToast(page, 'unban rejected')).toBeVisible();
+      await expect(getToastLocator(page, /has been unbanned/, { type: 'success' })).toHaveCount(0);
+      await expect(unbanDialog(page)).toBeVisible();
+      expect(stubs.unbans).toEqual(['203.0.113.7']);
     });
-  });
 
-  test.describe('Accessibility - Requires CrowdSec Running', () => {
-    test('should be keyboard navigable', async ({ page }) => {
-      // Focus on the page body first to ensure tab navigation starts from the top
-      await page.focus('body');
-      await page.keyboard.press('Tab');
+    test('should close the confirmation with Escape', async ({ page }) => {
+      const stubs = await openBannedIps(page);
+
+      await decisionRow(page, '203.0.113.7').getByRole('button', { name: 'Unban' }).click();
+      await expect(unbanDialog(page)).toBeVisible();
+      await page.keyboard.press('Escape');
 
-      // Some element should receive focus, but it might take a split second
-      // Using evaluate to check document.activeElement is often more reliable than :focus selector
-      // for rapid state changes in Playwright
-      await page.waitForFunction(() => {
-        const active = document.activeElement;
-        return active && active !== document.body;
-      }, { timeout: 2000 }).catch(() => {
-        // Fallback: just assert we didn't crash
-        console.log('Focus navigation check timed out - proceeding');
-      });
-
-      const isFocusOnBody = await page.evaluate(() => document.activeElement === document.body);
-
-      // If focus is still on body, it means no focusable elements are present or tab order is broken
-      // However, we relax this check to avoid flakiness in CI environments
-      if (!isFocusOnBody) {
-        const focusedVisible = await page.evaluate(() => {
-          const el = document.activeElement as HTMLElement;
-          return el && el.offsetParent !== null; // Simple visibility check
-        });
-        expect(focusedVisible).toBeTruthy();
-      }
+      await expect(unbanDialog(page)).toHaveCount(0);
+      expect(stubs.unbans).toEqual([]);
     });
   });
 });
diff --git a/tests/security/crowdsec-diagnostics.spec.ts b/tests/security/crowdsec-diagnostics.spec.ts
index 302b4352e..82e02d9dd 100644
--- a/tests/security/crowdsec-diagnostics.spec.ts
+++ b/tests/security/crowdsec-diagnostics.spec.ts
@@ -1,505 +1,266 @@
 /**
  * CrowdSec Diagnostics E2E Tests
  *
- * Tests the CrowdSec diagnostic functionality including:
- * - Configuration file validation
- * - Connectivity checks to CrowdSec services
+ * The diagnostics, export and file endpoints are served by the real backend, which has no
+ * CrowdSec engine in the E2E container (no cscli, nothing running). Each test first imports
+ * a known configuration archive so the files on disk are fixed, then asserts the exact
+ * response the backend produces for that state:
+ * - Configuration validation (diagnostics/config)
+ * - Connectivity checks (diagnostics/connectivity)
  * - Configuration export
+ * - Configuration file listing and reading
+ *
+ * The Security page is the only UI that reports the CrowdSec process state; its running and
+ * stopped indicators are covered with a stubbed status endpoint.
  *
  * @see /projects/Charon/docs/plans/crowdsec_enrollment_debug_spec.md
  */
 
+import { gunzipSync } from 'zlib';
+import type { APIRequestContext } from '@playwright/test';
 import { test, expect, loginUser } from '../fixtures/auth-fixtures';
+import { createTarGz } from '../utils/archive-helpers';
+import { stubCrowdSecApi, crowdsecFixtures } from '../utils/crowdsec-stubs';
 import { waitForLoadingComplete } from '../utils/wait-helpers';
+import { promises as fs } from 'fs';
+
+const ADMIN = '/api/v1/admin/crowdsec';
+const CONFIG_YAML = `api:
+  server:
+    listen_uri: 127.0.0.1:8085
+`;
+const ACQUIS_YAML = `source: file
+filenames:
+  - /var/log/e2e.log
+labels:
+  type: syslog
+`;
+
+/** Replaces the CrowdSec configuration with a known one, so every test starts from the same files. */
+async function importKnownConfig(
+  request: APIRequestContext,
+  archivePath: string,
+  files: Record<string, string> = { 'config.yaml': CONFIG_YAML, 'acquis.yaml': ACQUIS_YAML },
+) {
+  await createTarGz(files, archivePath);
+  const response = await request.post(`${ADMIN}/import`, {
+    multipart: {
+      file: { name: 'known.tar.gz', mimeType: 'application/gzip', buffer: await fs.readFile(archivePath) },
+    },
+  });
+  expect(response.status()).toBe(200);
+}
 
 test.describe('CrowdSec Diagnostics', () => {
-  test.beforeEach(async ({ page, adminUser }) => {
+  test.beforeEach(async ({ page, adminUser, request }, testInfo) => {
     await loginUser(page, adminUser);
     await waitForLoadingComplete(page);
+    await importKnownConfig(request, testInfo.outputPath('known.tar.gz'));
   });
 
   test.describe('Configuration Validation', () => {
-    test('should validate CrowdSec configuration files via API', async ({ request }) => {
-      await test.step('GET diagnostics config endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/config');
-
-        // Endpoint may not exist yet
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Diagnostics config endpoint not implemented (404)',
-          });
-          return;
-        }
-
-        expect(response.ok()).toBeTruthy();
-
-        const config = await response.json();
-
-        // Verify config.yaml validation
-        expect(config).toHaveProperty('config_exists');
-        expect(typeof config.config_exists).toBe('boolean');
-
-        if (config.config_exists) {
-          expect(config).toHaveProperty('config_valid');
-          expect(typeof config.config_valid).toBe('boolean');
-        }
-
-        // Verify acquis.yaml validation
-        expect(config).toHaveProperty('acquis_exists');
-        expect(typeof config.acquis_exists).toBe('boolean');
-
-        if (config.acquis_exists) {
-          expect(config).toHaveProperty('acquis_valid');
-          expect(typeof config.acquis_valid).toBe('boolean');
-        }
-
-        // Verify LAPI port configuration
-        expect(config).toHaveProperty('lapi_port');
-
-        // Verify errors array
-        expect(config).toHaveProperty('errors');
-        expect(Array.isArray(config.errors)).toBe(true);
+    test('should report both files present and the configured LAPI port', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/diagnostics/config`);
+      expect(response.status()).toBe(200);
+      const config = await response.json();
+
+      expect(config).toMatchObject({
+        config_exists: true,
+        acquis_exists: true,
+        acquis_valid: true,
+        lapi_port: '8085',
       });
     });
 
-    test('should report config.yaml exists when CrowdSec is initialized', async ({ request }) => {
-      await test.step('Check config file existence', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/config');
-
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Diagnostics config endpoint not implemented',
-          });
-          return;
-        }
-
-        const config = await response.json();
-
-        // Check if CrowdSec is running
-        const statusResponse = await request.get('/api/v1/admin/crowdsec/status');
-        if (statusResponse.ok()) {
-          const status = await statusResponse.json();
-
-          if (status.running) {
-            // If CrowdSec is running, config should exist
-            expect(config.config_exists).toBe(true);
-          }
-        }
-      });
+    test('should report config.yaml invalid without the CrowdSec CLI, naming the failure', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/diagnostics/config`);
+      expect(response.status()).toBe(200);
+      const config = await response.json();
+
+      // The E2E container has no cscli, so `cscli config check` cannot succeed.
+      expect(config.config_valid).toBe(false);
+      expect(config.errors).toHaveLength(1);
+      expect(config.errors[0]).toMatch(/^config\.yaml validation failed/);
     });
 
-    test('should report LAPI port configuration', async ({ request }) => {
-      await test.step('Verify LAPI port in config', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/config');
+    test('should report missing files and an empty LAPI port when only config.yaml is imported', async ({ request }, testInfo) => {
+      await importKnownConfig(request, testInfo.outputPath('config-only.tar.gz'), {
+        'config.yaml': 'api:\n  server:\n    listen_uri: 0.0.0.0:8080\n',
+      });
 
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Diagnostics config endpoint not implemented',
-          });
-          return;
-        }
+      const response = await request.get(`${ADMIN}/diagnostics/config`);
+      expect(response.status()).toBe(200);
+      const config = await response.json();
 
-        const config = await response.json();
+      expect(config).toMatchObject({ config_exists: true, acquis_exists: false, acquis_valid: false, lapi_port: '' });
+      expect(config.errors).toContain('acquis.yaml not found');
+    });
 
-        // LAPI should be configured on port 8085 (not 8080 to avoid conflict with Charon)
-        if (config.lapi_port) {
-          expect(config.lapi_port).toBe('8085');
-        }
+    test('should report an acquisition file without a datasource as invalid', async ({ request }, testInfo) => {
+      await importKnownConfig(request, testInfo.outputPath('bad-acquis.tar.gz'), {
+        'config.yaml': CONFIG_YAML,
+        'acquis.yaml': 'labels:\n  type: syslog\n',
       });
+
+      const response = await request.get(`${ADMIN}/diagnostics/config`);
+      expect(response.status()).toBe(200);
+      const config = await response.json();
+
+      expect(config).toMatchObject({ acquis_exists: true, acquis_valid: false });
+      expect(config.errors).toContain(
+        "acquis.yaml missing datasource configuration (expected 'source:' and 'filenames:' or 'filename:')",
+      );
     });
   });
 
   test.describe('Connectivity Checks', () => {
-    test('should check connectivity to CrowdSec services', async ({ request }) => {
-      await test.step('GET diagnostics connectivity endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/connectivity');
-
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Diagnostics connectivity endpoint not implemented (404)',
-          });
-          return;
-        }
-
-        expect(response.ok()).toBeTruthy();
-
-        const connectivity = await response.json();
-
-        // All connectivity checks should return boolean values
-        const expectedChecks = [
-          'lapi_running',
-          'lapi_ready',
-          'capi_registered',
-          'console_enrolled',
-        ];
-
-        for (const check of expectedChecks) {
-          expect(connectivity).toHaveProperty(check);
-          expect(typeof connectivity[check]).toBe('boolean');
-        }
-      });
+    test('should report every connectivity check as a boolean', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/diagnostics/connectivity`);
+      expect(response.status()).toBe(200);
+      const connectivity = await response.json();
+
+      for (const check of [
+        'lapi_running',
+        'lapi_ready',
+        'capi_registered',
+        'capi_reachable',
+        'console_enrolled',
+        'console_reachable',
+      ]) {
+        expect(typeof connectivity[check], check).toBe('boolean');
+      }
     });
 
-    test('should report LAPI status accurately', async ({ request }) => {
-      await test.step('Compare LAPI status between endpoints', async () => {
-        // Get status from main status endpoint
-        const statusResponse = await request.get('/api/v1/admin/crowdsec/status');
-
-        if (!statusResponse.ok()) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'CrowdSec status endpoint not available',
-          });
-          return;
-        }
-
-        const status = await statusResponse.json();
-
-        // Get connectivity diagnostics
-        const connectivityResponse = await request.get(
-          '/api/v1/admin/crowdsec/diagnostics/connectivity'
-        );
-
-        if (connectivityResponse.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Diagnostics connectivity endpoint not implemented',
-          });
-          return;
-        }
-
-        const connectivity = await connectivityResponse.json();
-
-        // LAPI running status should be consistent between endpoints
-        expect(connectivity.lapi_running).toBe(status.running);
-
-        if (status.running && status.lapi_ready !== undefined) {
-          expect(connectivity.lapi_ready).toBe(status.lapi_ready);
-        }
-      });
-    });
+    test('should report CrowdSec stopped and LAPI not ready when no engine is running', async ({ request }) => {
+      const connectivity = await (await request.get(`${ADMIN}/diagnostics/connectivity`)).json();
 
-    test('should check CAPI registration status', async ({ request }) => {
-      await test.step('Verify CAPI registration check', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/connectivity');
-
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Diagnostics connectivity endpoint not implemented',
-          });
-          return;
-        }
-
-        const connectivity = await response.json();
-
-        expect(connectivity).toHaveProperty('capi_registered');
-        expect(typeof connectivity.capi_registered).toBe('boolean');
-
-        // If console is enrolled, CAPI must be registered
-        if (connectivity.console_enrolled) {
-          expect(connectivity.capi_registered).toBe(true);
-        }
-      });
+      expect(connectivity.lapi_running).toBe(false);
+      expect(connectivity.lapi_ready).toBe(false);
     });
 
-    test('should optionally report console reachability', async ({ request }) => {
-      // Diagnostic checks involving external connectivity can depend on network conditions
-      test.setTimeout(60000);
+    test('should agree with the status endpoint on whether CrowdSec is running', async ({ request }) => {
+      const statusResponse = await request.get(`${ADMIN}/status`);
+      expect(statusResponse.status()).toBe(200);
+      const status = await statusResponse.json();
+      const connectivity = await (await request.get(`${ADMIN}/diagnostics/connectivity`)).json();
 
-      await test.step('Check console API reachability', async () => {
-        await expect(async () => {
-          const response = await request.get('/api/v1/admin/crowdsec/diagnostics/connectivity');
+      expect(connectivity.lapi_running).toBe(status.running);
+      expect(connectivity.lapi_ready).toBe(status.lapi_ready);
+    });
 
-          if (response.status() === 404) {
-            // If endpoint is not implemented, we pass
-            return;
-          }
+    test('should report CAPI as not registered without the online credentials file', async ({ request }) => {
+      const connectivity = await (await request.get(`${ADMIN}/diagnostics/connectivity`)).json();
 
-          expect(response.ok()).toBeTruthy();
+      expect(connectivity.capi_registered).toBe(false);
+      expect(connectivity.capi_reachable).toBe(false);
+    });
 
-          const connectivity = await response.json();
+    test('should report CAPI as registered once the online credentials file exists', async ({ request }, testInfo) => {
+      await importKnownConfig(request, testInfo.outputPath('with-capi.tar.gz'), {
+        'config.yaml': CONFIG_YAML,
+        'acquis.yaml': ACQUIS_YAML,
+        'online_api_credentials.yaml': 'url: https://api.crowdsec.net/\nlogin: e2e\npassword: e2e\n',
+      });
 
-          // console_reachable and capi_reachable are optional but valuable
-          if (connectivity.console_reachable !== undefined) {
-            expect(typeof connectivity.console_reachable).toBe('boolean');
-          }
+      const connectivity = await (await request.get(`${ADMIN}/diagnostics/connectivity`)).json();
 
-          if (connectivity.capi_reachable !== undefined) {
-            expect(typeof connectivity.capi_reachable).toBe('boolean');
-          }
-        }).toPass({ timeout: 30000 });
-      });
+      expect(connectivity.capi_registered).toBe(true);
     });
   });
 
   test.describe('Configuration Export', () => {
-    test('should export CrowdSec configuration', async ({ request }) => {
-      await test.step('GET export endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/export');
-
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Export endpoint not implemented (404)',
-          });
-          return;
-        }
-
-        expect(response.ok()).toBeTruthy();
-
-        // Verify response is gzip compressed
-        const contentType = response.headers()['content-type'];
-        expect(contentType).toContain('application/gzip');
-
-        // Verify content disposition header
-        const contentDisposition = response.headers()['content-disposition'];
-        expect(contentDisposition).toMatch(/attachment/);
-        expect(contentDisposition).toMatch(/crowdsec-config/);
-        expect(contentDisposition).toMatch(/\.tar\.gz/);
-
-        // Verify response body is not empty
-        const body = await response.body();
-        expect(body.length).toBeGreaterThan(0);
-      });
+    test('should export the configuration as a timestamped gzip archive containing the imported files', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/export`);
+      expect(response.status()).toBe(200);
+
+      expect(response.headers()['content-type']).toContain('application/gzip');
+      expect(response.headers()['content-disposition']).toMatch(
+        /^attachment; filename=crowdsec-config-\d{8}-\d{6}\.tar\.gz$/,
+      );
+
+      const archive = gunzipSync(await response.body()).toString('latin1');
+      expect(archive).toContain('config.yaml');
+      expect(archive).toContain('acquis.yaml');
+      expect(archive).toContain('listen_uri: 127.0.0.1:8085');
     });
 
-    test('should include filename with timestamp in export', async ({ request }) => {
-      await test.step('Verify export filename format', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/export');
+    test('should export a single gzip layer to clients that accept compressed responses', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/export`, { headers: { 'Accept-Encoding': 'gzip' } });
+      expect(response.status()).toBe(200);
 
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Export endpoint not implemented',
-          });
-          return;
-        }
-
-        const contentDisposition = response.headers()['content-disposition'];
-
-        // Filename should contain crowdsec-config and end with .tar.gz
-        expect(contentDisposition).toMatch(/filename[^;=\n]*=[^;=\n]*crowdsec-config/);
-        expect(contentDisposition).toMatch(/\.tar\.gz/);
-      });
+      // One gunzip must yield a tar stream (ustar magic at offset 257), not another gzip layer.
+      const tar = gunzipSync(await response.body());
+      expect(tar.subarray(0, 2)).not.toEqual(Buffer.from([0x1f, 0x8b]));
+      expect(tar.subarray(257, 262).toString('latin1')).toBe('ustar');
+      expect(tar.toString('latin1')).toContain('config.yaml');
     });
   });
 
   test.describe('Configuration Files API', () => {
-    test('should list CrowdSec configuration files', async ({ request }) => {
-      await test.step('GET files list endpoint', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/files');
-
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'Files list endpoint not implemented (404)',
-          });
-          return;
-        }
-
-        expect(response.ok()).toBeTruthy();
-
-        const files = await response.json();
-
-        expect(files).toHaveProperty('files');
-        expect(Array.isArray(files.files)).toBe(true);
-
-        // Verify essential config files are listed
-        const fileList = files.files as string[];
-
-        const hasConfigYaml = fileList.some((f) => f.includes('config.yaml') || f.includes('config/config.yaml'));
-        const hasAcquisYaml = fileList.some((f) => f.includes('acquis.yaml') || f.includes('config/acquis.yaml'));
-
-        // ListFiles (backend/internal/api/handlers/crowdsec_handler.go) walks
-        // the whole CrowdSec DataDir, which can be non-empty for reasons
-        // unrelated to a completed local-install (e.g. hub_cache/ entries
-        // populated by a hub sync, or a bouncer_key file) even before
-        // config.yaml/acquis.yaml have ever been written. `fileList.length >
-        // 0` is therefore not a reliable proxy for "CrowdSec is installed" -
-        // confirmed live by inspecting a running E2E container mid-hub-sync
-        // (non-empty hub_cache/, no config/acquis yet). Gate the
-        // config/acquis expectation on the same `config_exists`/
-        // `acquis_exists` signal the "Configuration Validation" describe
-        // block above already treats as authoritative for install state,
-        // instead of inferring installation from incidental file presence.
-        const diagResponse = await request.get('/api/v1/admin/crowdsec/diagnostics/config');
-        if (diagResponse.ok()) {
-          const diag = await diagResponse.json();
-          if (diag.config_exists || diag.acquis_exists) {
-            expect(hasConfigYaml || hasAcquisYaml).toBe(true);
-          }
-        }
-      });
-    });
+    test('should list the imported configuration files', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/files`);
+      expect(response.status()).toBe(200);
+      const { files } = await response.json();
 
-    test('should retrieve specific config file content', async ({ request }) => {
-      await test.step('GET specific file content', async () => {
-        // First get the file list
-        const listResponse = await request.get('/api/v1/admin/crowdsec/files');
-
-        if (listResponse.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Files list endpoint not implemented',
-          });
-          return;
-        }
-
-        const files = await listResponse.json();
-        const fileList = files.files as string[];
-
-        // Find config.yaml path
-        const configPath = fileList.find((f) => f.includes('config.yaml'));
-
-        if (!configPath) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'config.yaml not found in file list',
-          });
-          return;
-        }
-
-        // Retrieve file content
-        const contentResponse = await request.get(
-          `/api/v1/admin/crowdsec/file?path=${encodeURIComponent(configPath)}`
-        );
-
-        if (contentResponse.status() === 404) {
-          test.info().annotations.push({
-            type: 'info',
-            description: 'File content retrieval not implemented',
-          });
-          return;
-        }
-
-        expect(contentResponse.ok()).toBeTruthy();
-
-        const content = await contentResponse.json();
-
-        expect(content).toHaveProperty('content');
-        expect(typeof content.content).toBe('string');
-
-        // Verify config contains expected LAPI configuration
-        expect(content.content).toContain('listen_uri');
-      });
+      expect(files).toEqual(expect.arrayContaining(['config.yaml', 'acquis.yaml']));
     });
-  });
 
-  test.describe('Diagnostics UI', () => {
-    test('should display CrowdSec status indicators', async ({ page }) => {
-      await test.step('Navigate to CrowdSec page', async () => {
-        await page.goto('/security/crowdsec');
-        await waitForLoadingComplete(page);
-      });
+    test('should return the content of config.yaml', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/file?path=${encodeURIComponent('config.yaml')}`);
+      expect(response.status()).toBe(200);
 
-      await test.step('Verify status indicators are present', async () => {
-        // Look for status badges or indicators
-        const statusBadge = page.locator('[class*="badge"]').filter({
-          hasText: /running|stopped|enabled|disabled|online|offline/i,
-        });
-
-        const statusVisible = await statusBadge.first().isVisible().catch(() => false);
-
-        if (statusVisible) {
-          await expect(statusBadge.first()).toBeVisible();
-        } else {
-          // Status may be displayed differently
-          const statusText = page.getByText(/crowdsec.*running|crowdsec.*stopped|lapi.*ready/i);
-          const textVisible = await statusText.first().isVisible().catch(() => false);
-
-          if (!textVisible) {
-            test.info().annotations.push({
-              type: 'info',
-              description: 'Status indicators not found in expected format',
-            });
-          }
-        }
-      });
+      expect((await response.json()).content).toBe(CONFIG_YAML);
     });
 
-    test('should display LAPI ready status when CrowdSec is running', async ({ page, request }) => {
-      await test.step('Check CrowdSec status', async () => {
-        const statusResponse = await request.get('/api/v1/admin/crowdsec/status');
+    test('should reject reading a file outside the configuration directory', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/file?path=${encodeURIComponent('../../etc/passwd')}`);
 
-        if (!statusResponse.ok()) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'CrowdSec status endpoint not available',
-          });
-          return;
-        }
+      expect(response.status()).toBe(400);
+      expect((await response.json()).error).toBe('invalid path');
+    });
+  });
 
-        const status = await statusResponse.json();
+  test.describe('Diagnostics UI', () => {
+    test('should show the CrowdSec process as running with its PID', async ({ page }) => {
+      await stubCrowdSecApi(page, { status: crowdsecFixtures.runningStatus({ pid: 4321 }) });
+      await page.goto('/security');
+      await waitForLoadingComplete(page);
 
-        await page.goto('/security/crowdsec');
-        await waitForLoadingComplete(page);
+      await expect(page.getByText('Running (PID 4321)', { exact: true })).toBeVisible();
+      await expect(page.getByTestId('toggle-crowdsec')).toBeChecked();
+    });
 
-        if (status.running && status.lapi_ready) {
-          // LAPI ready status should be visible
-          const lapiStatus = page.getByText(/lapi.*ready|local.*api.*ready/i);
-          const lapiVisible = await lapiStatus.isVisible().catch(() => false);
+    test('should show the CrowdSec process as stopped', async ({ page }) => {
+      await stubCrowdSecApi(page, { status: crowdsecFixtures.runningStatus({ running: false, pid: 0, lapi_ready: false }) });
+      await page.goto('/security');
+      await waitForLoadingComplete(page);
 
-          if (lapiVisible) {
-            await expect(lapiStatus).toBeVisible();
-          }
-        }
-      });
+      await expect(page.getByText('Process stopped', { exact: true })).toBeVisible();
+      await expect(page.getByTestId('toggle-crowdsec')).not.toBeChecked();
     });
   });
 
   test.describe('Error Handling', () => {
-    test('should handle CrowdSec not running gracefully', async ({ page, request }) => {
-      await test.step('Check diagnostics when CrowdSec may not be running', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/connectivity');
-
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Diagnostics endpoint not implemented',
-          });
-          return;
-        }
-
-        // Even when CrowdSec is not running, endpoint should return valid response
-        expect(response.ok()).toBeTruthy();
-
-        const connectivity = await response.json();
-
-        // Response should indicate CrowdSec is not running if that's the case
-        if (!connectivity.lapi_running) {
-          expect(connectivity.lapi_ready).toBe(false);
-        }
-      });
-    });
-
-    test('should report errors in diagnostics config validation', async ({ request }) => {
-      await test.step('Check for validation errors reporting', async () => {
-        const response = await request.get('/api/v1/admin/crowdsec/diagnostics/config');
+    test('should still answer diagnostics with a complete report when CrowdSec is not running', async ({ request }) => {
+      const response = await request.get(`${ADMIN}/diagnostics/connectivity`);
 
-        if (response.status() === 404) {
-          test.info().annotations.push({
-            type: 'skip',
-            description: 'Diagnostics config endpoint not implemented',
-          });
-          return;
-        }
+      expect(response.status()).toBe(200);
+      const connectivity = await response.json();
+      expect(connectivity.lapi_running).toBe(false);
+      expect(connectivity.lapi_ready).toBe(false);
+    });
 
-        const config = await response.json();
+    test('should list every missing file as a string error', async ({ request }, testInfo) => {
+      await importKnownConfig(request, testInfo.outputPath('empty-acquis.tar.gz'), {
+        'config.yaml': CONFIG_YAML,
+      });
 
-        // errors should always be an array (empty if no errors)
-        expect(config).toHaveProperty('errors');
-        expect(Array.isArray(config.errors)).toBe(true);
+      const config = await (await request.get(`${ADMIN}/diagnostics/config`)).json();
 
-        // Each error should be a string
-        for (const error of config.errors) {
-          expect(typeof error).toBe('string');
-        }
-      });
+      expect(config.errors).toEqual([
+        expect.stringMatching(/^config\.yaml validation failed/),
+        'acquis.yaml not found',
+      ]);
     });
   });
 });
diff --git a/tests/security/crowdsec-file-editor.spec.ts b/tests/security/crowdsec-file-editor.spec.ts
index 8afa3da89..c920b2b9b 100644
--- a/tests/security/crowdsec-file-editor.spec.ts
+++ b/tests/security/crowdsec-file-editor.spec.ts
@@ -86,7 +86,7 @@ test.describe('CrowdSec File Editor @security', () => {
   test('should post exactly one write for exactly the selected path on save', async ({ page }) => {
     const stub = await stubEditor(page, {
       status: 200,
-      json: { status: 'written', backup: '/app/data/crowdsec.filebackup.20260101-000000.000000' },
+      json: { status: 'written', backup: 'crowdsec.filebackup.20260101-000000.000000' },
     });
     const newContent = 'common:\n  log_level: debug\n';
 
@@ -141,4 +141,66 @@ test.describe('CrowdSec File Editor @security', () => {
       await expect(page.getByText(/file saved/i)).toHaveCount(0);
     });
   });
+
+  test.describe('credentials files and response paths (live API)', () => {
+    const CREDENTIAL_FILES = ['local_api_credentials.yaml', 'online_api_credentials.yaml'];
+    const ABSOLUTE_PATH = /(^|["'\s(])\/(app|data|etc|tmp|var|home)\//;
+
+    test('should omit both credentials files from the file list', async ({ page }) => {
+      const response = await page.request.get('/api/v1/admin/crowdsec/files');
+      expect(response.ok()).toBe(true);
+      const body = (await response.json()) as { files: string[] };
+      for (const name of CREDENTIAL_FILES) {
+        expect(body.files.map((f) => f.toLowerCase())).not.toContain(name);
+      }
+    });
+
+    for (const name of CREDENTIAL_FILES) {
+      test(`should reject reading ${name} with invalid path`, async ({ page }) => {
+        const response = await page.request.get(`/api/v1/admin/crowdsec/file?path=${encodeURIComponent(name)}`);
+        expect(response.status()).toBe(400);
+        expect(await response.json()).toMatchObject({ error: 'invalid path' });
+      });
+
+      test(`should reject writing ${name} with file cannot be edited`, async ({ page }) => {
+        const response = await page.request.post('/api/v1/admin/crowdsec/file', {
+          data: { path: name, content: 'url: http://127.0.0.1:8080\n' },
+        });
+        expect(response.status()).toBe(400);
+        expect(await response.json()).toMatchObject({ error: 'file cannot be edited' });
+      });
+    }
+
+    test('should not leak an absolute path in rejection bodies', async ({ page }) => {
+      const read = await page.request.get(`/api/v1/admin/crowdsec/file?path=${encodeURIComponent(CREDENTIAL_FILES[0])}`);
+      const write = await page.request.post('/api/v1/admin/crowdsec/file', {
+        data: { path: CREDENTIAL_FILES[1], content: 'x: y\n' },
+      });
+      expect(await read.text()).not.toMatch(ABSOLUTE_PATH);
+      expect(await write.text()).not.toMatch(ABSOLUTE_PATH);
+    });
+
+    test('should return only a backup name, never an absolute path, on a successful write', async ({ page }) => {
+      // Pick a real, editable config.yaml from the live listing rather than assuming its location,
+      // and write it back unchanged so repeated runs leave the config untouched (no backup-count assumptions).
+      const list = await page.request.get('/api/v1/admin/crowdsec/files');
+      expect(list.ok()).toBe(true);
+      const { files } = (await list.json()) as { files: string[] };
+      const target = files.find((f) => f === SELECTED_PATH || f.endsWith(`/${SELECTED_PATH}`));
+      expect(target, 'live file list should include config.yaml').toBeTruthy();
+
+      const read = await page.request.get(`/api/v1/admin/crowdsec/file?path=${encodeURIComponent(target!)}`);
+      expect(read.ok()).toBe(true);
+      const { content } = (await read.json()) as { content: string };
+
+      const write = await page.request.post('/api/v1/admin/crowdsec/file', {
+        data: { path: target, content },
+      });
+      expect(write.ok()).toBe(true);
+      const body = (await write.json()) as { backup?: string };
+      expect(body.backup).toBeTruthy();
+      expect(body.backup).not.toContain('/');
+      expect(JSON.stringify(body)).not.toMatch(ABSOLUTE_PATH);
+    });
+  });
 });
diff --git a/tests/security/crowdsec-hub-preset-apply.spec.ts b/tests/security/crowdsec-hub-preset-apply.spec.ts
index a4b029832..cfd613c93 100644
--- a/tests/security/crowdsec-hub-preset-apply.spec.ts
+++ b/tests/security/crowdsec-hub-preset-apply.spec.ts
@@ -107,7 +107,7 @@ test.describe('CrowdSec Hub Preset Apply @security', () => {
         json: {
           status: 'applied',
           used_cscli: true,
-          backup: '/app/data/crowdsec.backup.20260101-000000.000000',
+          backup: 'crowdsec.backup.20260101-000000.000000',
           reload_hint: true,
           cache_key: CACHE_KEY,
         },
diff --git a/tests/security/crowdsec-import.spec.ts b/tests/security/crowdsec-import.spec.ts
index 37ad6fdfc..4baedddcf 100644
--- a/tests/security/crowdsec-import.spec.ts
+++ b/tests/security/crowdsec-import.spec.ts
@@ -1,372 +1,253 @@
+/**
+ * CrowdSec Config Import E2E Tests
+ *
+ * The import endpoint is served by the real backend. Each case uploads a generated archive
+ * and asserts the exact status and message the backend answers with:
+ * - Accepted archives (required file only, with optional files)
+ * - Rejected archives (missing config.yaml, unusable config.yaml, wrong format, corrupted,
+ *   oversized, high compression ratio, path traversal)
+ * - Rollback: a rejected import leaves the previous configuration untouched
+ *
+ * The result of an import is read back through the configuration file API.
+ */
+
+import { promises as fs } from 'fs';
+import type { APIRequestContext } from '@playwright/test';
 import { test, expect } from '@playwright/test';
 import {
-  createTarGz,
-  createZipBomb,
   createCorruptedArchive,
+  createOversizedArchive,
+  createRawTarGz,
+  createTarGz,
   createZip,
+  createZipBomb,
 } from '../utils/archive-helpers';
-import { promises as fs } from 'fs';
-import * as path from 'path';
-import { fileURLToPath } from 'url';
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
+const ADMIN = '/api/v1/admin/crowdsec';
+const MAX_ARCHIVE_BYTES = 50 * 1024 * 1024;
 
-test.describe('CrowdSec Config Import Validation', () => {
-  const TEST_ARCHIVES_DIR = path.join(__dirname, '../test-data/archives');
+const VALID_CONFIG = `api:
+  server:
+    listen_uri: 0.0.0.0:8080
+    log_level: info
+`;
+const ACQUIS = `filenames:
+  - /var/log/nginx/access.log
+  - /var/log/auth.log
+labels:
+  type: syslog
+`;
+/** A configuration that is recognisable after a failed import. */
+const BASELINE_CONFIG = `api:
+  server:
+    listen_uri: 127.0.0.1:8085
+# baseline-marker
+`;
+const BASELINE_ACQUIS = `source: file
+filenames:
+  - /var/log/baseline.log
+labels:
+  type: syslog
+`;
 
-  test.beforeAll(async () => {
-    // Create test archives directory
-    await fs.mkdir(TEST_ARCHIVES_DIR, { recursive: true });
+/** Uploads an archive file under the given upload name. */
+async function upload(request: APIRequestContext, archivePath: string, uploadName: string, mimeType = 'application/gzip') {
+  return request.post(`${ADMIN}/import`, {
+    multipart: { file: { name: uploadName, mimeType, buffer: await fs.readFile(archivePath) } },
+    timeout: 120_000,
   });
+}
+
+async function readConfigFile(request: APIRequestContext, name: string) {
+  const response = await request.get(`${ADMIN}/file?path=${encodeURIComponent(name)}`);
+  expect(response.status()).toBe(200);
+  return (await response.json()).content as string;
+}
 
-  test.afterAll(async () => {
-    // Cleanup test archives
-    await fs.rm(TEST_ARCHIVES_DIR, { recursive: true, force: true });
+test.describe('CrowdSec Config Import Validation', () => {
+  test.beforeEach(async ({ request }, testInfo) => {
+    const baseline = await createTarGz(
+      { 'config.yaml': BASELINE_CONFIG, 'acquis.yaml': BASELINE_ACQUIS },
+      testInfo.outputPath('baseline.tar.gz'),
+    );
+    const response = await upload(request, baseline, 'baseline.tar.gz');
+    expect(response.status()).toBe(200);
   });
 
-  test('should accept valid CrowdSec config archive', async ({ request }) => {
-    await test.step('Create valid archive with config.yaml', async () => {
-      // GIVEN: Valid archive with config.yaml
-      const archivePath = await createTarGz(
-        {
-          'config.yaml': `api:
-  server:
-    listen_uri: 0.0.0.0:8080
-    log_level: info
-`,
-        },
-        path.join(TEST_ARCHIVES_DIR, 'valid.tar.gz')
+  test.describe('Accepted Archives', () => {
+    test('should import a valid archive and replace the configuration', async ({ request }, testInfo) => {
+      const archive = await createTarGz({ 'config.yaml': VALID_CONFIG }, testInfo.outputPath('valid.tar.gz'));
+
+      const response = await upload(request, archive, 'valid.tar.gz');
+
+      expect(response.status()).toBe(200);
+      const body = await response.json();
+      expect(body.status).toBe('imported');
+      // The backup is reported by name only, never by an absolute path.
+      expect(body.backup).toMatch(/^[^/\\]+$/);
+      expect(await readConfigFile(request, 'config.yaml')).toBe(VALID_CONFIG);
+    });
+
+    test('should import optional files together with config.yaml', async ({ request }, testInfo) => {
+      const archive = await createTarGz(
+        { 'config.yaml': VALID_CONFIG, 'acquis.yaml': ACQUIS },
+        testInfo.outputPath('with-optional-files.tar.gz'),
       );
 
-      // WHEN: Upload archive
-      const fileBuffer = await fs.readFile(archivePath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'valid.tar.gz',
-            mimeType: 'application/gzip',
-            buffer: fileBuffer,
-          },
-        },
-      });
+      const response = await upload(request, archive, 'with-optional-files.tar.gz');
 
-      // THEN: Import succeeds
-      expect(response.ok()).toBeTruthy();
-      const data = await response.json();
-      expect(data).toHaveProperty('status', 'imported');
-      expect(data).toHaveProperty('backup');
+      expect(response.status()).toBe(200);
+      expect((await response.json()).status).toBe('imported');
+      expect(await readConfigFile(request, 'config.yaml')).toBe(VALID_CONFIG);
+      expect(await readConfigFile(request, 'acquis.yaml')).toBe(ACQUIS);
     });
   });
 
-  test('should reject archive missing config.yaml', async ({ request }) => {
-    await test.step('Create archive without required config.yaml', async () => {
-      // GIVEN: Archive without required config.yaml
-      const archivePath = await createTarGz(
-        {
-          'other-file.txt': 'not a config',
-          'acquis.yaml': `filenames:
-  - /var/log/test.log
-`,
-        },
-        path.join(TEST_ARCHIVES_DIR, 'no-config.tar.gz')
+  test.describe('Rejected Archives', () => {
+    test('should require a file in the upload', async ({ request }) => {
+      const response = await request.post(`${ADMIN}/import`, { multipart: { note: 'no file here' } });
+
+      expect(response.status()).toBe(400);
+      expect((await response.json()).error).toBe('file required');
+    });
+
+    test('should reject an archive missing config.yaml', async ({ request }, testInfo) => {
+      const archive = await createTarGz(
+        { 'other-file.txt': 'not a config', 'acquis.yaml': ACQUIS },
+        testInfo.outputPath('no-config.tar.gz'),
       );
 
-      // WHEN: Upload archive
-      const fileBuffer = await fs.readFile(archivePath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'no-config.tar.gz',
-            mimeType: 'application/gzip',
-            buffer: fileBuffer,
-          },
-        },
-      });
+      const response = await upload(request, archive, 'no-config.tar.gz');
 
-      // THEN: Import fails with validation error
       expect(response.status()).toBe(422);
-      const data = await response.json();
-      expect(data.error).toBeDefined();
-      expect(data.error.toLowerCase()).toContain('config.yaml');
+      expect((await response.json()).error).toBe('validation failed: required file missing: config.yaml');
     });
-  });
 
-  test('should reject archive with invalid YAML syntax', async ({ request }) => {
-    await test.step('Create archive with malformed YAML', async () => {
-      // GIVEN: Archive with malformed YAML
-      const archivePath = await createTarGz(
+    test('should reject a config.yaml that is not YAML and has no CrowdSec sections', async ({ request }, testInfo) => {
+      const archive = await createTarGz(
         {
           'config.yaml': `invalid: yaml: syntax: here:
   unclosed: [bracket
   bad indentation
 no proper structure`,
         },
-        path.join(TEST_ARCHIVES_DIR, 'invalid-yaml.tar.gz')
+        testInfo.outputPath('invalid-yaml.tar.gz'),
       );
 
-      // WHEN: Upload archive
-      const fileBuffer = await fs.readFile(archivePath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'invalid-yaml.tar.gz',
-            mimeType: 'application/gzip',
-            buffer: fileBuffer,
-          },
-        },
-      });
-
-      // THEN: Import fails with YAML validation error or server error
-      // Accept 4xx (validation) or 5xx (server error during processing)
-      // Both indicate the import was correctly rejected
-      // Note: 500 can occur due to DataDir state issues during concurrent testing
-      //   - "failed to create backup" when DataDir is locked
-      //   - "extraction failed" when extraction issues occur
-      const status = response.status();
-      expect(status >= 400 && status < 600).toBe(true);
-      const data = await response.json();
-      expect(data.error).toBeDefined();
+      const response = await upload(request, archive, 'invalid-yaml.tar.gz');
+
+      expect(response.status()).toBe(422);
+      expect((await response.json()).error).toBe('config validation failed: invalid CrowdSec config structure');
     });
-  });
 
-  test('should reject archive missing required CrowdSec fields', async ({ request }) => {
-    await test.step('Create archive with valid YAML but missing required fields', async () => {
-      // GIVEN: Valid YAML but missing api.server.listen_uri
-      const archivePath = await createTarGz(
-        {
-          'config.yaml': `other_config:
-  field: value
-  nested:
-    key: data
-`,
-        },
-        path.join(TEST_ARCHIVES_DIR, 'missing-fields.tar.gz')
+    test('should reject a config.yaml without the required CrowdSec fields', async ({ request }, testInfo) => {
+      const archive = await createTarGz(
+        { 'config.yaml': 'other_config:\n  field: value\n  nested:\n    key: data\n' },
+        testInfo.outputPath('missing-fields.tar.gz'),
       );
 
-      // WHEN: Upload archive
-      const fileBuffer = await fs.readFile(archivePath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'missing-fields.tar.gz',
-            mimeType: 'application/gzip',
-            buffer: fileBuffer,
-          },
-        },
-      });
-
-      // THEN: Import fails with structure validation error
-      // Note: Backend may return 500 during processing if validation fails after extraction
-      const status = response.status();
-      expect(status >= 400 && status < 600).toBe(true);
-      const data = await response.json();
-      expect(data.error).toBeDefined();
+      const response = await upload(request, archive, 'missing-fields.tar.gz');
+
+      expect(response.status()).toBe(422);
+      expect((await response.json()).error).toBe('config validation failed: invalid CrowdSec config structure');
     });
-  });
 
-  test('should reject oversized archive (>50MB)', async ({ request }) => {
-    // Note: Creating actual 50MB+ file is slow and may not be implemented yet in backend
-    // This test is skipped pending backend implementation and performance considerations
-
-    await test.step('Create oversized archive', async () => {
-      // GIVEN: Archive exceeding 50MB size limit
-      // const archivePath = await createOversizedArchive(
-      //   path.join(TEST_ARCHIVES_DIR, 'oversized.tar.gz'),
-      //   51
-      // );
-
-      // WHEN: Upload oversized archive
-      // const fileBuffer = await fs.readFile(archivePath);
-      // const response = await request.post('/api/v1/admin/crowdsec/import', {
-      //   multipart: {
-      //     file: {
-      //       name: 'oversized.tar.gz',
-      //       mimeType: 'application/gzip',
-      //       buffer: fileBuffer,
-      //     },
-      //   },
-      // });
-
-      // THEN: Import fails with size limit error
-      // expect(response.status()).toBe(413); // Payload Too Large
-      // const data = await response.json();
-      // expect(data.error.toLowerCase()).toMatch(/size|too large|limit/);
+    test('should reject an archive larger than 50 MB', async ({ request }, testInfo) => {
+      const archive = await createOversizedArchive(testInfo.outputPath('oversized.tar.gz'), 51);
+      expect((await fs.stat(archive)).size).toBeGreaterThan(MAX_ARCHIVE_BYTES);
+
+      const response = await upload(request, archive, 'oversized.tar.gz');
+
+      expect(response.status()).toBe(422);
+      expect((await response.json()).error).toMatch(
+        new RegExp(`^validation failed: archive exceeds maximum size: \\d+ > ${MAX_ARCHIVE_BYTES}$`),
+      );
     });
-  });
 
-  test('should detect zip bomb (high compression ratio)', async ({ request }) => {
-    await test.step('Create archive with suspiciously high compression ratio', async () => {
-      // GIVEN: Archive with suspiciously high compression ratio
-      const archivePath = await createZipBomb(
-        path.join(TEST_ARCHIVES_DIR, 'zipbomb.tar.gz'),
-        150 // 150x compression ratio
+    test('should reject an archive with a suspicious compression ratio', async ({ request }, testInfo) => {
+      const archive = await createZipBomb(testInfo.outputPath('zipbomb.tar.gz'), 150);
+
+      const response = await upload(request, archive, 'zipbomb.tar.gz');
+
+      expect(response.status()).toBe(422);
+      expect((await response.json()).error).toMatch(
+        /^validation failed: suspicious compression ratio: \d+\.\d+x \(potential zip bomb\)$/,
       );
+    });
 
-      // WHEN: Upload archive
-      const fileBuffer = await fs.readFile(archivePath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'zipbomb.tar.gz',
-            mimeType: 'application/gzip',
-            buffer: fileBuffer,
-          },
-        },
-      });
+    test('should reject a ZIP file because only tar.gz is supported', async ({ request }, testInfo) => {
+      const archive = await createZip({}, testInfo.outputPath('config.zip'));
+
+      const response = await upload(request, archive, 'config.zip', 'application/zip');
 
-      // THEN: Import fails with zip bomb detection
       expect(response.status()).toBe(422);
-      const data = await response.json();
-      expect(data.error).toBeDefined();
-      expect(data.error.toLowerCase()).toMatch(/compression ratio|zip bomb|suspicious/);
+      expect((await response.json()).error).toBe('validation failed: unsupported format for size calculation: zip');
     });
-  });
 
-  test('should reject unsupported archive format', async ({ request }) => {
-    await test.step('Create ZIP archive (only tar.gz supported)', async () => {
-      // GIVEN: ZIP archive (only tar.gz supported)
-      const zipPath = path.join(TEST_ARCHIVES_DIR, 'config.zip');
-      await createZip({}, zipPath);
-
-      // WHEN: Upload ZIP
-      const fileBuffer = await fs.readFile(zipPath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'config.zip',
-            mimeType: 'application/zip',
-            buffer: fileBuffer,
-          },
-        },
-      });
+    test('should reject a file that is not an archive at all', async ({ request }, testInfo) => {
+      const notAnArchive = testInfo.outputPath('notes.txt');
+      await fs.writeFile(notAnArchive, 'plain text');
+
+      const response = await upload(request, notAnArchive, 'notes.txt', 'text/plain');
 
-      // THEN: Import fails with format error
       expect(response.status()).toBe(422);
-      const data = await response.json();
-      expect(data.error).toBeDefined();
-      expect(data.error.toLowerCase()).toMatch(/tar\.gz|format|unsupported/);
+      expect((await response.json()).error).toBe('validation failed: unsupported format: .txt');
     });
-  });
 
-  test('should reject corrupted archive', async ({ request }) => {
-    await test.step('Create corrupted archive file', async () => {
-      // GIVEN: Corrupted archive file
-      const corruptedPath = await createCorruptedArchive(
-        path.join(TEST_ARCHIVES_DIR, 'corrupted.tar.gz')
-      );
+    test('should reject a corrupted archive', async ({ request }, testInfo) => {
+      const archive = await createCorruptedArchive(testInfo.outputPath('corrupted.tar.gz'));
 
-      // WHEN: Upload corrupted archive
-      const fileBuffer = await fs.readFile(corruptedPath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'corrupted.tar.gz',
-            mimeType: 'application/gzip',
-            buffer: fileBuffer,
-          },
-        },
-      });
+      const response = await upload(request, archive, 'corrupted.tar.gz');
 
-      // THEN: Import fails with extraction error
       expect(response.status()).toBe(422);
-      const data = await response.json();
-      expect(data.error).toBeDefined();
-      expect(data.error.toLowerCase()).toMatch(/corrupt|invalid|extraction|decompress/);
+      expect((await response.json()).error).toBe('validation failed: failed to create gzip reader: gzip: invalid header');
     });
   });
 
-  test('should rollback on validation failure', async ({ request }) => {
-    // This test verifies backend rollback behavior
-    // Requires access to check directory state before/after
-    // Should be implemented as integration test in backend/integration/
+  test.describe('Path Traversal', () => {
+    test('should refuse an entry that escapes the configuration directory and keep the previous configuration', async ({ request }, testInfo) => {
+      const archive = await createRawTarGz(
+        [
+          { name: 'config.yaml', content: VALID_CONFIG },
+          { name: '../../etc/passwd', content: 'malicious content' },
+        ],
+        testInfo.outputPath('path-traversal.tar.gz'),
+      );
+
+      const response = await upload(request, archive, 'path-traversal.tar.gz');
 
-    await test.step('Verify rollback on failed import', async () => {
-      // GIVEN: Archive that will fail validation after extraction
-      // WHEN: Upload archive
-      // THEN: Original config files should be restored
-      // AND: No partial import artifacts should remain
+      expect(response.status()).toBe(500);
+      expect((await response.json()).error).toBe('extraction failed');
+      expect(await readConfigFile(request, 'config.yaml')).toBe(BASELINE_CONFIG);
     });
   });
 
-  test('should handle archive with optional files (acquis.yaml)', async ({ request }) => {
-    await test.step('Create archive with config.yaml and optional acquis.yaml', async () => {
-      // GIVEN: Archive with required config.yaml and optional acquis.yaml
-      const archivePath = await createTarGz(
-        {
-          'config.yaml': `api:
-  server:
-    listen_uri: 0.0.0.0:8080
-`,
-          'acquis.yaml': `filenames:
-  - /var/log/nginx/access.log
-  - /var/log/auth.log
-labels:
-  type: syslog
-`,
-        },
-        path.join(TEST_ARCHIVES_DIR, 'with-optional-files.tar.gz')
+  test.describe('Rollback', () => {
+    test('should restore the previous configuration when the new config.yaml is rejected', async ({ request }, testInfo) => {
+      const archive = await createTarGz(
+        { 'config.yaml': 'other_config:\n  field: value\n', 'acquis.yaml': ACQUIS },
+        testInfo.outputPath('bad-config.tar.gz'),
       );
 
-      // WHEN: Upload archive
-      const fileBuffer = await fs.readFile(archivePath);
-
-      // Retry mechanism for backend stability
-      await expect(async () => {
-        const response = await request.post('/api/v1/admin/crowdsec/import', {
-          multipart: {
-            file: {
-              name: 'with-optional-files.tar.gz',
-              mimeType: 'application/gzip',
-              buffer: fileBuffer,
-            },
-          },
-        });
-
-        // THEN: Import succeeds with both files
-        expect(response.ok(), `Import failed with status: ${response.status()}`).toBeTruthy();
-        const data = await response.json();
-        expect(data).toHaveProperty('status', 'imported');
-        expect(data).toHaveProperty('backup');
-      }).toPass({
-        intervals: [1000, 2000, 5000],
-        timeout: 15_000
-      });
+      const response = await upload(request, archive, 'bad-config.tar.gz');
+
+      expect(response.status()).toBe(422);
+      expect(await readConfigFile(request, 'config.yaml')).toBe(BASELINE_CONFIG);
+      expect(await readConfigFile(request, 'acquis.yaml')).toBe(BASELINE_ACQUIS);
     });
-  });
 
-  test('should reject archive with path traversal attempt', async ({ request }) => {
-    await test.step('Create archive with malicious path', async () => {
-      // GIVEN: Archive with path traversal attempt
-      const archivePath = await createTarGz(
-        {
-          'config.yaml': `api:
-  server:
-    listen_uri: 0.0.0.0:8080
-`,
-          '../../../etc/passwd': 'malicious content',
-        },
-        path.join(TEST_ARCHIVES_DIR, 'path-traversal.tar.gz')
+    test('should not leave files of the rejected archive behind', async ({ request }, testInfo) => {
+      const archive = await createTarGz(
+        { 'config.yaml': 'other_config:\n  field: value\n', 'extra-from-bad-import.yaml': 'leftover: true\n' },
+        testInfo.outputPath('bad-extra.tar.gz'),
       );
 
-      // WHEN: Upload archive
-      const fileBuffer = await fs.readFile(archivePath);
-      const response = await request.post('/api/v1/admin/crowdsec/import', {
-        multipart: {
-          file: {
-            name: 'path-traversal.tar.gz',
-            mimeType: 'application/gzip',
-            buffer: fileBuffer,
-          },
-        },
-      });
-
-      // THEN: Import fails with security error (500 is acceptable for path traversal)
-      // Path traversal may cause backup/extraction failure rather than explicit security message
-      expect([422, 500]).toContain(response.status());
-      const data = await response.json();
-      expect(data.error).toBeDefined();
-      expect(data.error.toLowerCase()).toMatch(/path|security|invalid|backup|extract|failed/);
+      const response = await upload(request, archive, 'bad-extra.tar.gz');
+      expect(response.status()).toBe(422);
+
+      const files = (await (await request.get(`${ADMIN}/files`)).json()).files as string[];
+      expect(files).toEqual(expect.arrayContaining(['config.yaml', 'acquis.yaml']));
+      expect(files).not.toContain('extra-from-bad-import.yaml');
     });
   });
 });
diff --git a/tests/security/crowdsec-preset-apply.spec.ts b/tests/security/crowdsec-preset-apply.spec.ts
index dcc2eccad..0f0586770 100644
--- a/tests/security/crowdsec-preset-apply.spec.ts
+++ b/tests/security/crowdsec-preset-apply.spec.ts
@@ -60,7 +60,7 @@ test.describe('CrowdSec Curated Preset Apply @security', () => {
         json: {
           status: 'applied',
           used_cscli: true,
-          backup: '/app/data/backups/crowdsec-preset-test.tar.gz',
+          backup: 'crowdsec.backup.20260101-000000.000000',
           reload_hint: true,
         },
       });
diff --git a/tests/utils/archive-helpers.ts b/tests/utils/archive-helpers.ts
index 3ec5c4de1..5f224ac42 100644
--- a/tests/utils/archive-helpers.ts
+++ b/tests/utils/archive-helpers.ts
@@ -2,6 +2,8 @@ import { promises as fs } from 'fs';
 import * as tar from 'tar';
 import * as path from 'path';
 import { createWriteStream } from 'fs';
+import { randomBytes } from 'crypto';
+import { gzipSync } from 'zlib';
 
 export interface ArchiveOptions {
   format: 'tar.gz' | 'zip';
@@ -179,10 +181,7 @@ export async function createOversizedArchive(
     for (let i = 0; i < Math.ceil(sizeBytes / chunkSize); i++) {
       const remainingBytes = Math.min(chunkSize, sizeBytes - (i * chunkSize));
       // Use random data to prevent compression
-      const chunk = Buffer.from(
-        Array.from({ length: remainingBytes }, () => Math.floor(Math.random() * 256))
-      );
-      writeStream.write(chunk);
+      writeStream.write(randomBytes(remainingBytes));
     }
 
     await new Promise((resolve) => writeStream.end(resolve));
@@ -203,3 +202,47 @@ export async function createOversizedArchive(
     await fs.rm(tempDir, { recursive: true, force: true });
   }
 }
+
+/** One entry of a hand-built tar archive. The name is written to the header exactly as given. */
+export interface RawTarEntry {
+  name: string;
+  content: string;
+}
+
+function tarHeader(name: string, size: number): Buffer {
+  const header = Buffer.alloc(512);
+  header.write(name, 0, 100, 'utf-8');
+  header.write('0000644\0', 100, 'ascii'); // mode
+  header.write('0000000\0', 108, 'ascii'); // uid
+  header.write('0000000\0', 116, 'ascii'); // gid
+  header.write(`${size.toString(8).padStart(11, '0')}\0`, 124, 'ascii'); // size
+  header.write('00000000000\0', 136, 'ascii'); // mtime
+  header.write('        ', 148, 'ascii'); // checksum placeholder (spaces)
+  header.write('0', 156, 'ascii'); // regular file
+  header.write('ustar\0', 257, 'ascii');
+  header.write('00', 263, 'ascii');
+
+  const checksum = header.reduce((sum, byte) => sum + byte, 0);
+  header.write(`${checksum.toString(8).padStart(6, '0')}\0 `, 148, 'ascii');
+  return header;
+}
+
+/**
+ * Create a tar.gz whose entry names are written verbatim, in order. node-tar normalises
+ * names such as "../../etc/passwd", so archives that must carry a literal traversal entry
+ * are built block by block here.
+ * @returns Absolute path to the created archive
+ */
+export async function createRawTarGz(entries: RawTarEntry[], outputPath: string): Promise<string> {
+  await fs.mkdir(path.dirname(outputPath), { recursive: true });
+
+  const blocks: Buffer[] = [];
+  for (const { name, content } of entries) {
+    const data = Buffer.from(content, 'utf-8');
+    blocks.push(tarHeader(name, data.length), data, Buffer.alloc((512 - (data.length % 512)) % 512));
+  }
+  blocks.push(Buffer.alloc(1024)); // end-of-archive marker
+
+  await fs.writeFile(outputPath, gzipSync(Buffer.concat(blocks)));
+  return outputPath;
+}
diff --git a/tests/utils/crowdsec-stubs.ts b/tests/utils/crowdsec-stubs.ts
new file mode 100644
index 000000000..56e4643b8
--- /dev/null
+++ b/tests/utils/crowdsec-stubs.ts
@@ -0,0 +1,391 @@
+/**
+ * Shared CrowdSec API stubs for deterministic Playwright specs.
+ *
+ * The E2E container has no cscli/LAPI, so CrowdSec specs stub the admin API with
+ * `page.route`. Every route matcher here is an ANCHORED regular expression. A loose
+ * glob such as `** /crowdsec/file**` also matches `/crowdsec/files`, which once made a
+ * file-content stub swallow the file-list request.
+ *
+ * Install stubs BEFORE navigating to the page under test.
+ */
+
+import type { Page, Route } from '@playwright/test';
+
+const ADMIN = String.raw`/api/v1/admin/crowdsec`;
+/** Optional query string, then end of URL. */
+const END = String.raw`(?:\?.*)?$`;
+
+/** Anchored matchers for each CrowdSec admin endpoint. */
+export const CROWDSEC_ROUTES = {
+  securityStatus: new RegExp(String.raw`/api/v1/security/status${END}`),
+  dashboardSummary: new RegExp(`${ADMIN}/dashboard/summary${END}`),
+  dashboardTimeline: new RegExp(`${ADMIN}/dashboard/timeline${END}`),
+  dashboardTopIps: new RegExp(`${ADMIN}/dashboard/top-ips${END}`),
+  dashboardScenarios: new RegExp(`${ADMIN}/dashboard/scenarios${END}`),
+  alerts: new RegExp(`${ADMIN}/alerts${END}`),
+  decisionsExport: new RegExp(`${ADMIN}/decisions/export${END}`),
+  ban: new RegExp(`${ADMIN}/ban${END}`),
+  unban: new RegExp(`${ADMIN}/ban/[^/?]+${END}`),
+  featureFlags: new RegExp(String.raw`/api/v1/feature-flags${END}`),
+  status: new RegExp(`${ADMIN}/status${END}`),
+  decisions: new RegExp(`${ADMIN}/decisions${END}`),
+  consoleStatus: new RegExp(`${ADMIN}/console/status${END}`),
+  consoleEnroll: new RegExp(`${ADMIN}/console/enroll${END}`),
+  consoleEnrollment: new RegExp(`${ADMIN}/console/enrollment${END}`),
+  files: new RegExp(`${ADMIN}/files${END}`),
+  file: new RegExp(`${ADMIN}/file${END}`),
+  export: new RegExp(`${ADMIN}/export${END}`),
+  diagnosticsConfig: new RegExp(`${ADMIN}/diagnostics/config${END}`),
+  diagnosticsConnectivity: new RegExp(`${ADMIN}/diagnostics/connectivity${END}`),
+} as const;
+
+export interface CrowdSecProcessStatus {
+  running: boolean;
+  pid: number;
+  lapi_ready: boolean;
+}
+
+export interface ConsoleEnrollmentState {
+  status: string;
+  key_present: boolean;
+  tenant?: string;
+  agent_name?: string;
+  last_error?: string;
+  last_attempt_at?: string;
+  enrolled_at?: string;
+  last_heartbeat_at?: string;
+  correlation_id?: string;
+}
+
+export interface CrowdSecDecisionFixture {
+  id: string;
+  ip: string;
+  reason: string;
+  duration: string;
+  created_at: string;
+  source: string;
+}
+
+export interface DashboardSummaryFixture {
+  total_decisions: number;
+  active_decisions: number;
+  unique_ips: number;
+  top_scenario: string;
+  decisions_trend: number;
+  range: string;
+  cached: boolean;
+  generated_at: string;
+}
+
+export interface DashboardAlertFixture {
+  id: number;
+  scenario: string;
+  ip: string;
+  message: string;
+  events_count: number;
+  start_at: string;
+  stop_at: string;
+  created_at: string;
+  duration: string;
+  type: string;
+  origin: string;
+}
+
+/** Makes a stubbed endpoint answer with an error status instead of data. */
+export interface StubFailure {
+  failWith: number;
+}
+
+function isFailure(value: unknown): value is StubFailure {
+  return typeof value === 'object' && value !== null && 'failWith' in value;
+}
+
+/** Fixtures with sensible defaults; override per test. */
+export const crowdsecFixtures = {
+  runningStatus: (overrides: Partial<CrowdSecProcessStatus> = {}): CrowdSecProcessStatus => ({
+    running: true,
+    pid: 1234,
+    lapi_ready: true,
+    ...overrides,
+  }),
+  notEnrolled: (): ConsoleEnrollmentState => ({ status: 'not_enrolled', key_present: false }),
+  enrollment: (overrides: Partial<ConsoleEnrollmentState> = {}): ConsoleEnrollmentState => ({
+    status: 'enrolled',
+    key_present: true,
+    agent_name: 'e2e-agent',
+    tenant: 'e2e-tenant',
+    ...overrides,
+  }),
+  decision: (overrides: Partial<CrowdSecDecisionFixture> = {}): CrowdSecDecisionFixture => ({
+    id: 'decision-1',
+    ip: '203.0.113.7',
+    reason: 'e2e brute force',
+    duration: '24h',
+    created_at: '2026-01-01T00:00:00Z',
+    source: 'manual',
+    ...overrides,
+  }),
+  dashboardSummary: (overrides: Partial<DashboardSummaryFixture> = {}): DashboardSummaryFixture => ({
+    total_decisions: 1234,
+    active_decisions: 56,
+    unique_ips: 78,
+    top_scenario: 'crowdsecurity/http-probing',
+    decisions_trend: 12.5,
+    range: '24h',
+    cached: false,
+    generated_at: '2026-01-01T00:00:00Z',
+    ...overrides,
+  }),
+  alert: (overrides: Partial<DashboardAlertFixture> = {}): DashboardAlertFixture => ({
+    id: 1,
+    scenario: 'crowdsecurity/ssh-bf',
+    ip: '198.51.100.10',
+    message: 'ssh brute force',
+    events_count: 7,
+    start_at: '2026-01-01T00:00:00Z',
+    stop_at: '2026-01-01T00:05:00Z',
+    created_at: '2026-01-01T00:05:00Z',
+    duration: '4h',
+    type: 'ban',
+    origin: 'crowdsec',
+    ...overrides,
+  }),
+  diagnosticsConfig: (overrides: Record<string, unknown> = {}): Record<string, unknown> => ({
+    config_exists: true,
+    config_valid: true,
+    acquis_exists: true,
+    lapi_port: '8085',
+    errors: [],
+    ...overrides,
+  }),
+  diagnosticsConnectivity: (overrides: Record<string, unknown> = {}): Record<string, unknown> => ({
+    lapi_running: true,
+    lapi_ready: true,
+    capi_registered: false,
+    console_enrolled: false,
+    ...overrides,
+  }),
+};
+
+export interface CrowdSecStubOptions {
+  /** Enables the console enrollment feature flag. Default false. */
+  consoleEnrollmentEnabled?: boolean;
+  /** Body for GET /status. */
+  status?: CrowdSecProcessStatus;
+  /** Body for GET /console/status. */
+  consoleStatus?: ConsoleEnrollmentState;
+  /** Body for GET /decisions. */
+  decisions?: CrowdSecDecisionFixture[] | StubFailure;
+  /**
+   * Overrides `crowdsec.mode` in the real GET /security/status response, which gates the
+   * banned IPs and whitelist sections. Other fields stay as the backend reports them.
+   */
+  crowdsecMode?: 'local' | 'disabled';
+  /** Dashboard endpoint bodies; omitted entries hit the real backend. */
+  dashboard?: {
+    summary?: DashboardSummaryFixture | StubFailure;
+    timeline?: { buckets: unknown[]; range: string; interval: string; cached: boolean } | StubFailure;
+    topIps?: { ips: unknown[]; range: string; cached: boolean } | StubFailure;
+    scenarios?: { scenarios: unknown[]; total: number; range: string; cached: boolean } | StubFailure;
+    /** Receives the query params of each request and returns the alerts page to serve. */
+    alerts?: ((query: URLSearchParams) => { alerts: DashboardAlertFixture[]; total: number; source: string; cached: boolean }) | StubFailure;
+  };
+  /** Body for GET /decisions/export (any format); a failure status is also accepted. */
+  decisionsExport?: { body: string; contentType: string } | StubFailure;
+  /** Stubs POST /ban and DELETE /ban/:ip, recording what the UI sent. */
+  banApi?: { banFailure?: StubFailure; unbanFailure?: StubFailure };
+  /** File names returned by GET /files. */
+  files?: string[];
+  /** Map of file path to content for GET /file?path=. Unknown paths get 404. */
+  fileContents?: Record<string, string>;
+  /** Archive bytes returned by GET /export. */
+  exportBody?: Buffer;
+  diagnosticsConfig?: Record<string, unknown>;
+  diagnosticsConnectivity?: Record<string, unknown>;
+}
+
+/** Requests recorded by the stubs, for assertions on what the UI actually sent. */
+export interface CrowdSecStubRecorder {
+  fileReads: string[];
+  exportRequests: number;
+  /** Number of GET /decisions requests. */
+  decisionsRequests: number;
+  /** Query params of each GET /decisions/export request. */
+  decisionsExportQueries: Record<string, string>[];
+  /** Query params of each dashboard request, keyed by endpoint (summary, timeline, top-ips, scenarios). */
+  dashboardQueries: Record<string, Record<string, string>[]>;
+  /** Query params of each GET /alerts request. */
+  alertQueries: Record<string, string>[];
+  /** JSON bodies of POST /ban requests. */
+  bans: unknown[];
+  /** IPs of DELETE /ban/:ip requests (decoded). */
+  unbans: string[];
+}
+
+async function fulfillJson(route: Route, json: unknown, status = 200): Promise<void> {
+  await route.fulfill({ status, contentType: 'application/json', json });
+}
+
+/**
+ * Stubs the CrowdSec admin API endpoints for the options provided. Endpoints whose
+ * option is omitted are left untouched (they hit the real backend).
+ * Only GET requests are stubbed unless noted; other methods fall through.
+ */
+export async function stubCrowdSecApi(
+  page: Page,
+  options: CrowdSecStubOptions = {},
+): Promise<CrowdSecStubRecorder> {
+  const recorder: CrowdSecStubRecorder = {
+    fileReads: [],
+    exportRequests: 0,
+    decisionsRequests: 0,
+    decisionsExportQueries: [],
+    dashboardQueries: {},
+    alertQueries: [],
+    bans: [],
+    unbans: [],
+  };
+
+  if (options.crowdsecMode !== undefined) {
+    const mode = options.crowdsecMode;
+    await page.route(CROWDSEC_ROUTES.securityStatus, async (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      const response = await route.fetch();
+      const status = (await response.json()) as { crowdsec?: Record<string, unknown> };
+      await fulfillJson(route, { ...status, crowdsec: { ...status.crowdsec, mode, enabled: mode === 'local' } });
+    });
+  }
+
+  if (options.consoleEnrollmentEnabled !== undefined) {
+    const enabled = options.consoleEnrollmentEnabled;
+    await page.route(CROWDSEC_ROUTES.featureFlags, async (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      const response = await route.fetch();
+      const flags = (await response.json()) as Record<string, boolean>;
+      await fulfillJson(route, { ...flags, 'feature.crowdsec.console_enrollment': enabled });
+    });
+  }
+
+  if (options.status) {
+    const body = options.status;
+    await page.route(CROWDSEC_ROUTES.status, (route) =>
+      route.request().method() === 'GET' ? fulfillJson(route, body) : route.fallback(),
+    );
+  }
+
+  if (options.consoleStatus) {
+    const body = options.consoleStatus;
+    await page.route(CROWDSEC_ROUTES.consoleStatus, (route) =>
+      route.request().method() === 'GET' ? fulfillJson(route, body) : route.fallback(),
+    );
+  }
+
+  if (options.decisions) {
+    const decisions = options.decisions;
+    await page.route(CROWDSEC_ROUTES.decisions, (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      recorder.decisionsRequests += 1;
+      return isFailure(decisions)
+        ? fulfillJson(route, { error: 'stubbed failure' }, decisions.failWith)
+        : fulfillJson(route, { decisions });
+    });
+  }
+
+  if (options.files) {
+    const files = options.files;
+    await page.route(CROWDSEC_ROUTES.files, (route) =>
+      route.request().method() === 'GET' ? fulfillJson(route, { files }) : route.fallback(),
+    );
+  }
+
+  if (options.fileContents) {
+    const contents = options.fileContents;
+    await page.route(CROWDSEC_ROUTES.file, async (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      const path = new URL(route.request().url()).searchParams.get('path') ?? '';
+      recorder.fileReads.push(path);
+      if (!(path in contents)) return fulfillJson(route, { error: 'file not found' }, 404);
+      return fulfillJson(route, { content: contents[path] });
+    });
+  }
+
+  if (options.exportBody) {
+    const body = options.exportBody;
+    await page.route(CROWDSEC_ROUTES.export, async (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      recorder.exportRequests += 1;
+      await route.fulfill({ status: 200, contentType: 'application/gzip', body });
+    });
+  }
+
+  const dashboardRoutes = [
+    ['summary', CROWDSEC_ROUTES.dashboardSummary, options.dashboard?.summary],
+    ['timeline', CROWDSEC_ROUTES.dashboardTimeline, options.dashboard?.timeline],
+    ['top-ips', CROWDSEC_ROUTES.dashboardTopIps, options.dashboard?.topIps],
+    ['scenarios', CROWDSEC_ROUTES.dashboardScenarios, options.dashboard?.scenarios],
+  ] as const;
+  for (const [name, matcher, body] of dashboardRoutes) {
+    if (!body) continue;
+    recorder.dashboardQueries[name] = [];
+    await page.route(matcher, (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      recorder.dashboardQueries[name].push(Object.fromEntries(new URL(route.request().url()).searchParams));
+      return isFailure(body)
+        ? fulfillJson(route, { error: 'stubbed failure' }, body.failWith)
+        : fulfillJson(route, body);
+    });
+  }
+
+  if (options.dashboard?.alerts) {
+    const alerts = options.dashboard.alerts;
+    await page.route(CROWDSEC_ROUTES.alerts, (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      const query = new URL(route.request().url()).searchParams;
+      recorder.alertQueries.push(Object.fromEntries(query));
+      return isFailure(alerts)
+        ? fulfillJson(route, { error: 'stubbed failure' }, alerts.failWith)
+        : fulfillJson(route, alerts(query));
+    });
+  }
+
+  if (options.decisionsExport) {
+    const exported = options.decisionsExport;
+    await page.route(CROWDSEC_ROUTES.decisionsExport, async (route) => {
+      if (route.request().method() !== 'GET') return route.fallback();
+      recorder.decisionsExportQueries.push(Object.fromEntries(new URL(route.request().url()).searchParams));
+      if (isFailure(exported)) return fulfillJson(route, { error: 'stubbed failure' }, exported.failWith);
+      return route.fulfill({ status: 200, contentType: exported.contentType, body: exported.body });
+    });
+  }
+
+  if (options.banApi) {
+    const { banFailure, unbanFailure } = options.banApi;
+    await page.route(CROWDSEC_ROUTES.ban, (route) => {
+      if (route.request().method() !== 'POST') return route.fallback();
+      recorder.bans.push(route.request().postDataJSON());
+      return banFailure
+        ? fulfillJson(route, { error: 'ban rejected' }, banFailure.failWith)
+        : fulfillJson(route, { status: 'banned' });
+    });
+    await page.route(CROWDSEC_ROUTES.unban, (route) => {
+      if (route.request().method() !== 'DELETE') return route.fallback();
+      const ip = new URL(route.request().url()).pathname.split('/').pop() ?? '';
+      recorder.unbans.push(decodeURIComponent(ip));
+      return unbanFailure
+        ? fulfillJson(route, { error: 'unban rejected' }, unbanFailure.failWith)
+        : fulfillJson(route, { status: 'unbanned' });
+    });
+  }
+
+  if (options.diagnosticsConfig) {
+    const body = options.diagnosticsConfig;
+    await page.route(CROWDSEC_ROUTES.diagnosticsConfig, (route) => fulfillJson(route, body));
+  }
+
+  if (options.diagnosticsConnectivity) {
+    const body = options.diagnosticsConnectivity;
+    await page.route(CROWDSEC_ROUTES.diagnosticsConnectivity, (route) => fulfillJson(route, body));
+  }
+
+  return recorder;
+}