diff --git a/.env.txt b/.env.example
similarity index 100%
rename from .env.txt
rename to .env.example
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d79bef5c1..5f1020550 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,70 @@ All notable changes to Crawl4AI will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.5] - 2026-10-14
+
+0.9.5 is a security release. It closes six coordinated-disclosure advisories in the Docker server's handling of untrusted request bodies: one more SSRF path outside the egress proxy, page JavaScript injection through `css_selector` and `wait_for`, a caller-chosen HuggingFace model in `CosineStrategy`, ReDoS through caller-supplied regexes, unbounded delay fields, and Chromium launched with certificate checks off. It also adds opt-in deep crawling on the Docker server and ships the bug fixes that landed on `develop` since 0.9.4. Users who self-host the Docker server should upgrade.
+
+### Security
+
+- **Blind SSRF via the cache freshness check (CWE-918, medium)**: `CacheValidator.validate()` sent its HEAD and GET requests on its own HTTP client, outside the Docker server's pinning egress proxy. It now goes through the proxy like the seeder and robots.txt fetches fixed in 0.9.4. Credit: [arpe1618](https://github.com/arpe1618). (GHSA-w4xc-px5p-c32w)
+- **Page JavaScript injection via `css_selector` and `wait_for` (CWE-95, medium)**: `css_selector` was pasted into a JavaScript string, and `wait_for` could run as page script, so an untrusted body could run JavaScript in the crawl page even though `js_code` is refused. `css_selector` is now passed to `evaluate()` as an argument, which also makes selectors with quotes work. For untrusted bodies, JavaScript `wait_for` values are refused and a bare value is treated as a CSS selector. Credit: Zhixi "Jace" Sun ([manus-use](https://github.com/manus-use)). (GHSA-qj46-wp7m-rgj8)
+- **Caller-chosen model in `CosineStrategy` (CWE-502, high)**: an untrusted body could set `CosineStrategy.model_name`, so the server downloaded and loaded any HuggingFace repository. With PyTorch older than 2.6 a crafted pickle weight file runs code in the server. `model_name` is now refused from untrusted bodies. The default image does not install PyTorch and is not affected. Credit: Zhixi "Jace" Sun ([manus-use](https://github.com/manus-use)). (GHSA-f856-7xp9-w3cc)
+- **ReDoS via caller-supplied regexes (CWE-1333, medium)**: `RegexExtractionStrategy.custom`, `RegexChunking.patterns`, and `"type": "regex"` fields in extraction schemas let a client send a catastrophic-backtracking pattern. Python's `re` holds the GIL while it matches, so one request froze the whole server. These fields are now refused from untrusted bodies. The built-in patterns stay available. Credit: Zhixi "Jace" Sun ([manus-use](https://github.com/manus-use)). (GHSA-j843-8p47-rhxp)
+- **Unbounded delay fields (CWE-770, medium)**: `delay_before_return_html`, `mean_delay`, and `max_range` were allowed in untrusted bodies with no upper bound, so one request could hold a browser page or stall the rate limiter. They are now capped at 60 seconds, and negative, NaN, and non-numeric values fall back to the default. Credit: Chunyi Liu ([liuchunyi-buaa](https://github.com/liuchunyi-buaa)). (GHSA-rhjm-7hj7-75fx)
+- **Chromium launched with certificate checks off (CWE-295, medium)**: both default launch flag lists carried `--ignore-certificate-errors`, so `ignore_https_errors=False` and the Docker server's TLS-on default had no effect. The flag is gone; insecure mode now comes only from `ignore_https_errors`. `CRAWL4AI_CHROMIUM_SANDBOX=true` now reaches every browser, including ones built from a request body. Credit: Julian Godfrey. (GHSA-j2qh-f73r-mg3q)
+
+Hardening, no advisory (credit: Chunyi Liu, [liuchunyi-buaa](https://github.com/liuchunyi-buaa)):
+
+- `DomainFilter` parses the real host with `urlparse()`, so userinfo, a port, or a trailing dot no longer slips past `blocked_domains`.
+- Webhook header names and artifact ids are checked with `fullmatch`, so a trailing newline no longer passes.
+- `enforce_egress` refuses the crawl with `EgressBlocked` when it cannot pin the browser to the egress proxy, instead of running unpinned. `clamp_deep_crawl` logs a warning when it cannot clamp.
+- Documentation examples: the marketplace backend (`docs/md_v2/marketplace/backend/`) uses bound SQL parameters and returns a generic error, and the LinkedIn graph view example escapes crawled data.
+
+All reporters are credited in `SECURITY-CREDITS.md`. GitHub Security Advisories accompany this release.
+
+### Added
+
+- Docker server: opt-in deep crawling. With `CRAWL4AI_ALLOW_DEEP_CRAWL=true`, requests may set `deep_crawl_strategy` with BFS, DFS, or BestFirst, safe filter and scorer types, and glob-only URL patterns. Page and depth budgets come from `limits.max_pages` and `limits.max_depth` in `config.yml`, a strategy is limited to 20 filters and scorers, and streamed deep crawls get a deadline. Off by default. (#2340, issue #2308, thanks @SohamKukreti)
+- A short Crawl4AI Cloud notice at `crawl4ai-setup`, at first run, and when a crawl is blocked. `CRAWL4AI_NO_CLOUD_NOTICE=1` turns it off.
+
+### Fixed
+
+**Crawler and core**
+
+- Deep crawl: BFS counts URLs already queued for the next level against `max_pages`, so `max_pages=50` no longer fetches hundreds of pages. (#2339, issue #2338, thanks @drakeo338)
+- Deep crawl: a reused strategy resets its page budget on a fresh run. (#2317, issue #2309, thanks @Artechie0806)
+- Scraping: page content nested in an unclosed `<noscript>` is kept in `cleaned_html` and `fit_html`. (#2284, thanks @tommypacker; #2360, #2363, issue #2293)
+- Scraping: a space is kept where a whitespace-only element is removed, so words no longer run together. (#2329, issue #2328, thanks @drakeo338)
+- `CrawlResult.links` and `.media` default to the scraped shape (`internal`, `external`, `images`, ...) on failed results. (#2289, issue #2286, thanks @talelboussetta)
+- PDF: markdown is deterministic with `batch_size > 1`. (#2320, issue #2319, thanks @Kylinny)
+- HTTP crawler: proxy credentials with `#`, `/`, `?`, or `%` work, and `ProxyConfig.from_string` decodes percent-encoded credentials. (#2327, issue #2326, thanks @omarbounawarapy)
+- HTTP crawler: proxy credentials no longer appear in error messages. (#2361, thanks @alkaz-nodemaven)
+
+**CLI**
+
+- `crwl -c cache_mode=...` is honored instead of always bypassing the cache. (#2366, issue #2365)
+- `crwl -o json` without an extraction strategy fails early with a clear message instead of crashing after the crawl. (#2362, #2335, issue #2334, thanks @SohamKukreti and @ege-arhan)
+
+**Docker server**
+
+- `crawler_configs` applies to single-URL and streaming requests, and a per-URL config list decides the PDF crawler. (#2290, issue #2287, thanks @talelboussetta)
+- A seed that fails the destination check is returned as a failed result instead of failing the whole batch with 400. (#2359, issue #2288)
+- An invalid `cache_mode` string returns 400 instead of 500.
+- MCP over SSE: `initialize` is processed before early `tools/call` requests, so fan-out clients no longer get -32602 on connect. (#2273, issue #2233, thanks @SohamKukreti)
+
+### Tests
+
+- `tests/unit/test_egress_policy.py` and `deploy/docker/tests/test_security_ssrf_seeder.py`: the cache freshness check goes through the egress proxy.
+- `tests/unit/test_untrusted_field_sinks.py` and `tests/browser/test_css_selector_injection.py`: `css_selector`, `wait_for`, `model_name`, regex, and delay fields under the untrusted gate.
+- `tests/unit/test_browser_tls_sandbox_flags.py`: launch flags with and without `ignore_https_errors` and the sandbox opt-in.
+- `tests/unit/test_domain_filter_host.py`, `deploy/docker/tests/test_security_hardening_2026_10.py`, `docs/md_v2/marketplace/backend/test_sql_injection.py`: the hardening fixes.
+- Coverage for the deep-crawl, noscript, proxy, CLI, and Docker fixes.
+
+### Breaking Changes
+
+None for library users. On the Docker server, untrusted request bodies that set `CosineStrategy.model_name`, `RegexExtractionStrategy.custom`, `RegexChunking.patterns`, a `"type": "regex"` schema field, or a JavaScript `wait_for` are now refused with 400.
+
 ## [0.9.4] - 2026-09-23
 
 0.9.4 is a security release. It closes three coordinated-disclosure advisories: two SSRF paths that bypassed the Docker server's egress controls, and a trust-boundary bypass that let a non-admin API client read server environment variables. It also makes content pruning about 10x faster with the new lxml-native `PruningContentFilterLXML`, now the default, and ships the bug fixes that accumulated on `develop` since 0.9.3. There are no breaking changes. Users who self-host the Docker server should upgrade.
diff --git a/Dockerfile b/Dockerfile
index d8dee3626..a60eeecc4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 FROM python:3.12-slim-bookworm AS build
 
 # C4ai version
-ARG C4AI_VER=0.9.4
+ARG C4AI_VER=0.9.5
 ENV C4AI_VERSION=$C4AI_VER
 LABEL c4ai.version=$C4AI_VER
 
diff --git a/README.md b/README.md
index 4ab113156..2547419f9 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@
 [![Discord](https://img.shields.io/badge/Discord-join%20us-5865F2?logo=discord&logoColor=white)](https://discord.gg/jP8KfhDhyN)
 [![Crawl4AI Cloud](https://img.shields.io/badge/Crawl4AI_Cloud-try_it_free-f5a300?style=flat&labelColor=0d0d10)](https://crawl4ai.com/?ref=readme-badge)
 
-**Latest: [v0.9.4](https://github.com/unclecode/crawl4ai/releases/tag/v0.9.4) (23 Sep 2026)** · [all releases →](https://github.com/unclecode/crawl4ai/releases)
+**Latest: [v0.9.5](https://github.com/unclecode/crawl4ai/releases/tag/v0.9.5) (14 Oct 2026)** · [all releases →](https://github.com/unclecode/crawl4ai/releases)
 
 <a href="https://crawl4ai.com/?ref=readme-banner">
   <picture>
diff --git a/SECURITY-CREDITS.md b/SECURITY-CREDITS.md
index 781e13ce8..3146a9849 100644
--- a/SECURITY-CREDITS.md
+++ b/SECURITY-CREDITS.md
@@ -25,3 +25,7 @@ We thank the following security researchers for their responsible disclosure:
 | arpe1618 | GitHub: [arpe1618](https://github.com/arpe1618) | Blind SSRF via the robots.txt fetch in RobotsParser.can_fetch bypassing the Docker egress controls (0.9.4) | 2026-09-04 |
 | Ibrahim AlJaafreh - Cystack RedTeam | [LinkedIn](https://www.linkedin.com/in/ibrahim-aljaafreh-glitch/), [cystack.ps](https://cystack.ps) | SSRF with response disclosure via link_preview_config through the URL seeder (0.9.4) | 2026-09-04 |
 | Adam Jordan | GitHub: [adamyordan](https://github.com/adamyordan) | Untrusted-config gate bypass via dict-wrapper laundering, leaking server env vars (0.9.4) | 2026-09-08 |
+| arpe1618 | GitHub: [arpe1618](https://github.com/arpe1618) | Blind SSRF via the CacheValidator freshness check bypassing the Docker egress proxy (0.9.5) | 2026-09-29 |
+| Zhixi "Jace" Sun | GitHub: [manus-use](https://github.com/manus-use) | Page JavaScript injection via css_selector and wait_for, HuggingFace model choice via CosineStrategy.model_name, and ReDoS via untrusted regex patterns on the Docker server (0.9.5) | 2026-10-01 |
+| Chunyi Liu | GitHub: [liuchunyi-buaa](https://github.com/liuchunyi-buaa) | SQL injection in the docs marketplace backend, DOM XSS in the LinkedIn graph view example, unbounded delay fields in untrusted config bodies, and Docker hardening gaps (header-name validation, DomainFilter host parsing, silent guard failures) (0.9.5) | 2026-09-21 |
+| Julian Godfrey | Email report | Chromium launched with --ignore-certificate-errors so TLS verification was off, and the Chromium sandbox opt-in had no effect (0.9.5) | 2026-10-04 |
diff --git a/SECURITY.md b/SECURITY.md
index e5d4ecd5f..9ff739827 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -96,6 +96,17 @@ When using Crawl4AI as a Python library:
 
 All issues below are fixed in the version named. Advisories with a GHSA id are published under [Security Advisories](https://github.com/unclecode/crawl4ai/security/advisories). Full detail for every release is in [CHANGELOG.md](CHANGELOG.md); reporter credits are in [SECURITY-CREDITS.md](SECURITY-CREDITS.md).
 
+### Fixed in v0.9.5 (2026-10-14)
+
+| ID | Severity | Component | Description | Fix |
+|----|----------|-----------|-------------|-----|
+| GHSA-w4xc-px5p-c32w | MEDIUM | Library + Docker API | Blind SSRF via the cache freshness check in `CacheValidator.validate`, outside the egress proxy (CWE-918) | Fetch routed through the pinning egress proxy |
+| GHSA-qj46-wp7m-rgj8 | MEDIUM | Docker API | Page JavaScript injection via untrusted `css_selector` and `wait_for` (CWE-95) | `css_selector` passed to `evaluate()` as an argument; JavaScript `wait_for` refused for untrusted bodies |
+| GHSA-f856-7xp9-w3cc | HIGH | Docker API | Untrusted `CosineStrategy.model_name` picks the HuggingFace model the server loads; code execution with PyTorch < 2.6 (CWE-502) | `model_name` refused from untrusted bodies |
+| GHSA-j843-8p47-rhxp | MEDIUM | Docker API | ReDoS via caller-supplied regex patterns freezes the server (CWE-1333) | `RegexExtractionStrategy.custom`, `RegexChunking.patterns`, and schema `regex` fields refused from untrusted bodies |
+| GHSA-rhjm-7hj7-75fx | MEDIUM | Docker API | Unbounded `delay_before_return_html`, `mean_delay`, `max_range` in untrusted bodies (CWE-770) | Capped at 60 seconds |
+| GHSA-j2qh-f73r-mg3q | MEDIUM | Library + Docker API | Chromium launched with `--ignore-certificate-errors`, so TLS verification was off; sandbox opt-in ignored (CWE-295) | Flag removed; insecure mode only from `ignore_https_errors`; `CRAWL4AI_CHROMIUM_SANDBOX` reaches every browser |
+
 ### Fixed in v0.9.4 (2026-09-23)
 
 | ID | Severity | Component | Description | Fix |
@@ -199,6 +210,14 @@ Secure-by-default rework of the Docker API server. The pip library is unchanged.
 
 ## Security Features
 
+### v0.9.5+
+
+- **Cache freshness check through the egress proxy**: `CacheValidator` uses the same pinning proxy as the seeder and robots.txt
+- **More untrusted fields refused**: JavaScript `wait_for`, `CosineStrategy.model_name`, and caller-supplied regexes
+- **Delay caps**: `delay_before_return_html`, `mean_delay`, and `max_range` capped at 60 seconds for untrusted bodies
+- **TLS verification on in Chromium**: `--ignore-certificate-errors` no longer in the default launch flags
+- **Fail-closed egress pinning**: a crawl that cannot be pinned to the egress proxy is refused
+
 ### v0.9.4+
 
 - **Library egress proxy**: `crawl4ai/egress_policy.py` routes the library's own HTTP clients (URL seeder, robots.txt) through the Docker server's pinning proxy, so they get the same resolve-and-pin rule as the browser
diff --git a/crawl4ai/__version__.py b/crawl4ai/__version__.py
index d332e3a47..4431a01a7 100644
--- a/crawl4ai/__version__.py
+++ b/crawl4ai/__version__.py
@@ -1,7 +1,7 @@
 # crawl4ai/__version__.py
 
 # This is the version that will be used for stable releases
-__version__ = "0.9.4"
+__version__ = "0.9.5"
 
 # For nightly builds, this gets set during build process
 __nightly_version__ = None
diff --git a/crawl4ai/async_configs.py b/crawl4ai/async_configs.py
index e76cae18a..15789be1e 100644
--- a/crawl4ai/async_configs.py
+++ b/crawl4ai/async_configs.py
@@ -3,6 +3,7 @@
 import importlib
 import os
 import warnings
+from urllib.parse import unquote
 import requests
 from .config import (
     DEFAULT_PROVIDER,
@@ -198,6 +199,14 @@ class UntrustedConfigError(ValueError):
     "CacheMode", "MatchMode", "DisplayMode",
 }
 
+# Allowed only with CRAWL4AI_ALLOW_DEEP_CRAWL=true; SEOFilter/ContentRelevanceFilter excluded (unguarded httpx fetch).
+UNTRUSTED_DEEP_CRAWL_TYPES = {
+    "BFSDeepCrawlStrategy", "DFSDeepCrawlStrategy", "BestFirstCrawlingStrategy",
+    "FilterChain", "URLPatternFilter", "DomainFilter", "ContentTypeFilter",
+    "KeywordRelevanceScorer", "CompositeScorer", "DomainAuthorityScorer",
+    "FreshnessScorer", "PathDepthScorer",
+}
+
 # Fields that must NEVER come from an untrusted body. Presence => 400 (loud), so
 # a client smuggling these gets an explicit error rather than a silent drop.
 UNTRUSTED_FORBIDDEN_FIELDS = {
@@ -222,8 +231,37 @@ class UntrustedConfigError(ValueError):
     "PDFContentScrapingStrategy": {
         "image_save_dir", "save_images_locally",
     },
+    # resume_state.pending would queue URLs that skip seed validation.
+    **{
+        name: {"resume_state", "logger", "on_state_change", "should_cancel"}
+        for name in ("BFSDeepCrawlStrategy", "DFSDeepCrawlStrategy", "BestFirstCrawlingStrategy")
+    },
+    # Same reason, no scalar allowlist. model_name is a HuggingFace repo id
+    # handed to from_pretrained: the caller would pick the weights the server
+    # downloads and unpickles.
+    "CosineStrategy": {"model_name"},
+    # Caller-supplied regexes. Python's re holds the GIL while it matches, so
+    # one catastrophic-backtracking pattern freezes the whole server, and the
+    # crawl deadline cannot interrupt it. The built-in patterns stay available.
+    "RegexExtractionStrategy": {"custom"},
+    "RegexChunking": {"patterns"},
 }
 
+# Extraction schemas are free-form dicts, so their "regex" field type (a
+# caller-supplied re.search pattern, same ReDoS as above) is checked by walking
+# the schema rather than by field name.
+_SCHEMA_STRATEGIES = {
+    "JsonCssExtractionStrategy", "JsonXPathExtractionStrategy", "JsonLxmlExtractionStrategy",
+}
+
+
+def _has_regex_field(node) -> bool:
+    if isinstance(node, dict):
+        return node.get("type") == "regex" or any(_has_regex_field(v) for v in node.values())
+    if isinstance(node, list):
+        return any(_has_regex_field(v) for v in node)
+    return False
+
 # Field names that must NEVER be set from an untrusted body on ANY allowed
 # type, checked regardless of per-type allowlist. This is the fail-closed
 # backstop: the per-type maps above only cover BrowserConfig/CrawlerRunConfig,
@@ -295,12 +333,16 @@ class UntrustedConfigError(ValueError):
 # Upper bounds applied to attacker-influenced quantities after filtering.
 _DEFAULT_MAX_TIMEOUT_MS = 60_000
 _MAX_SCROLL_STEPS = 1000
+_MAX_DELAY_SECONDS = 60  # ceiling for delay_before_return_html / mean_delay / max_range
 _MAX_VIEWPORT = 4000
 _MAX_PDF_BYTES = 100 * 1024 * 1024
 _MAX_PDF_PAGES = 2000
 _MAX_LINK_PREVIEW_LINKS = 100      # the class default
 _MAX_LINK_PREVIEW_CONCURRENCY = 10  # the class default
 _MAX_LINK_PREVIEW_TIMEOUT_S = 10    # seconds here, not ms
+_MAX_DEEP_CRAWL_LIST = 100          # patterns, keywords, filters, scorers per object
+_MAX_DEEP_CRAWL_OBJECTS = 20        # filters and scorers in one strategy
+_MAX_DEEP_CRAWL_ITEMS = 200         # list and dict items (patterns, keywords, ...) in one strategy
 
 
 def _max_timeout_ms() -> int:
@@ -338,10 +380,28 @@ def _max_timeout_ms() -> int:
     return ceiling
 
 
+def _deep_crawl_allowed() -> bool:
+    """Operator opt-in for deep crawling from untrusted requests."""
+    return os.getenv("CRAWL4AI_ALLOW_DEEP_CRAWL", "false").lower() == "true"
+
+
+def _all_nodes(node):
+    """Yield every value in a request tree. An object's params dict is entered but not yielded."""
+    yield node
+    if _is_typed_shape(node) and isinstance(node.get("params"), dict):
+        node = node["params"]
+    children = node.values() if isinstance(node, dict) else node if isinstance(node, list) else []
+    for child in children:
+        yield from _all_nodes(child)
+
+
 def _filter_untrusted_fields(type_name: str, params: dict) -> dict:
     """Drop non-allowlisted fields and raise on forbidden (power) fields."""
     forbidden = UNTRUSTED_FORBIDDEN_FIELDS.get(type_name, set())
     allowlist = UNTRUSTED_FIELD_ALLOWLIST.get(type_name)  # None => keep all non-forbidden
+    if type_name == "CrawlerRunConfig" and _deep_crawl_allowed():
+        forbidden = forbidden - {"deep_crawl_strategy"}
+        allowlist = allowlist | {"deep_crawl_strategy"}
     out = {}
     for key, value in params.items():
         if key in UNTRUSTED_GLOBAL_FORBIDDEN_FIELDS or key in forbidden:
@@ -351,6 +411,51 @@ def _filter_untrusted_fields(type_name: str, params: dict) -> dict:
         if allowlist is not None and key not in allowlist:
             continue  # silently drop unknown/unsafe fields (forward-compatible)
         out[key] = value
+    if type_name in UNTRUSTED_DEEP_CRAWL_TYPES and any(
+        isinstance(v, list) and len(v) > _MAX_DEEP_CRAWL_LIST for v in out.values()
+    ):
+        raise UntrustedConfigError(
+            f"{type_name} list parameters are limited to {_MAX_DEEP_CRAWL_LIST} items"
+        )
+    if type_name in ("BFSDeepCrawlStrategy", "DFSDeepCrawlStrategy", "BestFirstCrawlingStrategy"):
+        # Filters and scorers run synchronously on the event loop for every discovered link.
+        nodes = [n for value in out.values() for n in _all_nodes(value)]
+        filters_and_scorers = sum(1 for n in nodes if isinstance(n, dict) and n.get("type") in UNTRUSTED_DEEP_CRAWL_TYPES)
+        list_items = sum(len(n) for n in nodes if isinstance(n, (list, dict)) and not _is_typed_shape(n))
+        if filters_and_scorers > _MAX_DEEP_CRAWL_OBJECTS or list_items > _MAX_DEEP_CRAWL_ITEMS:
+            raise UntrustedConfigError(
+                f"{type_name} is limited to {_MAX_DEEP_CRAWL_OBJECTS} filters and scorers "
+                f"and {_MAX_DEEP_CRAWL_ITEMS} list items in total"
+            )
+    if type_name == "URLPatternFilter":
+        # Regex and *.domain:// patterns compile unescaped, and globs not led by * search in
+        # quadratic time; allow only *-led globs, /prefix/* and *.ext.
+        patterns = out.get("patterns")
+        patterns = [patterns] if isinstance(patterns, str) else patterns
+        if not isinstance(patterns, list) or not all(
+            isinstance(p, str)
+            and not (p.startswith("^") or p.endswith("$") or "\\d" in p or "**" in p)
+            and not ("://" in p and p.startswith("*."))
+            and (p.startswith("*") or (p.count("*") == 1 and p.endswith("/*")))
+            for p in patterns
+        ):
+            raise UntrustedConfigError(
+                "URLPatternFilter accepts only globs that start with '*' or end with a "
+                "single '/*' from an untrusted request"
+            )
+    if type_name == "CompositeScorer" and any(
+        isinstance(s, dict) and s.get("type") == "CompositeScorer" for s in out.get("scorers") or []
+    ):
+        raise UntrustedConfigError("CompositeScorer cannot be nested from an untrusted request")
+    if type_name == "CrawlerRunConfig" and out.get("deep_crawl_strategy") and out.get("fetch_ssl_certificate"):
+        # The certificate fetch dials each discovered link directly, outside the egress proxy.
+        raise UntrustedConfigError(
+            "fetch_ssl_certificate cannot be combined with deep_crawl_strategy from an untrusted request"
+        )
+    cache_mode = out.get("cache_mode") if type_name == "CrawlerRunConfig" else None
+    if isinstance(cache_mode, str) and cache_mode.lower() not in {m.value for m in CacheMode}:
+        # CrawlerRunConfig raises ValueError on it, which would surface as a 500.
+        raise UntrustedConfigError(f"invalid cache_mode: {cache_mode!r}")
     return out
 
 
@@ -366,12 +471,42 @@ def _cap_timeout(v):
             return min(_DEFAULT_MAX_TIMEOUT_MS, ceiling)
         return min(int(v), ceiling)
 
+    # delay_before_return_html is held with a browser page open; mean_delay and
+    # max_range seed the arun_many rate limiter. All three are seconds, not ms,
+    # so they get their own cap rather than reusing the ms timeout ceiling.
+    _delay_defaults = {
+        "delay_before_return_html": 0.1,
+        "mean_delay": 0.1,
+        "max_range": 0.3,
+    }
+
+    def _cap_delay(v, default):
+        if not isinstance(v, (int, float)) or isinstance(v, bool) or not v >= 0:  # also NaN
+            return default
+        return min(v, _MAX_DELAY_SECONDS)
+
     if type_name == "CrawlerRunConfig":
         for f in ("page_timeout", "wait_for_timeout", "body_visibility_timeout"):
             if f in params:
                 params[f] = _cap_timeout(params[f])
+        for f, default in _delay_defaults.items():
+            if f in params:
+                params[f] = _cap_delay(params[f], default)
         if isinstance(params.get("max_scroll_steps"), int):
             params["max_scroll_steps"] = min(params["max_scroll_steps"], _MAX_SCROLL_STEPS)
+        # smart_wait runs "js:...", function-shaped values, and any value that
+        # is not a valid selector as page JavaScript -- the js_code ban by
+        # another name. Untrusted callers get CSS selector waits only; the
+        # "css:" branch never falls back to JS.
+        wait_for = params.get("wait_for")
+        if isinstance(wait_for, str) and wait_for.strip():
+            wait_for = wait_for.strip()
+            if wait_for.startswith(("js:", "()", "function")):
+                raise UntrustedConfigError(
+                    "a JavaScript wait_for is not permitted from an untrusted request"
+                )
+            if not wait_for.startswith("css:"):
+                params["wait_for"] = "css:" + wait_for
     elif type_name == "BrowserConfig":
         for f in ("viewport_width", "viewport_height"):
             if isinstance(params.get(f), int):
@@ -387,6 +522,12 @@ def _cap_timeout(v):
         # Rasterizing every page is the most expensive thing this strategy can
         # do, and nothing about untrusted crawling needs it.
         params["extract_images"] = False
+    elif type_name in _SCHEMA_STRATEGIES:
+        if _has_regex_field(params.get("schema")):
+            raise UntrustedConfigError(
+                f"schema fields of type 'regex' are not permitted on {type_name} "
+                "from an untrusted request"
+            )
     elif type_name == "LinkPreviewConfig":
         # Also no field allowlist, and each link is a separate outbound fetch:
         # unclamped, one request body can order millions of them at any
@@ -555,7 +696,11 @@ def from_serializable_dict(data: Any, provenance: "Provenance" = None) -> Any:
 
         # Untrusted bodies may only construct the strict subset of types and
         # may not set forbidden power-fields.
-        if provenance == Provenance.UNTRUSTED and type_name not in UNTRUSTED_ALLOWED_TYPES:
+        if (
+            provenance == Provenance.UNTRUSTED
+            and type_name not in UNTRUSTED_ALLOWED_TYPES
+            and not (type_name in UNTRUSTED_DEEP_CRAWL_TYPES and _deep_crawl_allowed())
+        ):
             raise UntrustedConfigError(
                 f"type '{type_name}' may not be constructed from an untrusted request"
             )
@@ -711,8 +856,8 @@ def from_string(proxy_str: str) -> "ProxyConfig":
                 username, password = credentials.split(":", 1)
                 return ProxyConfig(
                     server=f"{protocol}://{server_part}",
-                    username=username,
-                    password=password,
+                    username=unquote(username),
+                    password=unquote(password),
                 )
         # URL without credentials (keep scheme)
         if "://" in s and "@" not in s:
@@ -1862,7 +2007,8 @@ def __init__(
         self.fetch_ssl_certificate = fetch_ssl_certificate
 
         # Caching Parameters
-        self.cache_mode = cache_mode
+        # Accept "enabled" etc. from CLI -c and YAML/JSON config files
+        self.cache_mode = CacheMode(cache_mode.lower()) if isinstance(cache_mode, str) else cache_mode
         self.session_id = session_id
         self.bypass_cache = bypass_cache
         self.disable_cache = disable_cache
diff --git a/crawl4ai/async_crawler_strategy.py b/crawl4ai/async_crawler_strategy.py
index 6d0fb4769..0b623de0c 100644
--- a/crawl4ai/async_crawler_strategy.py
+++ b/crawl4ai/async_crawler_strategy.py
@@ -13,6 +13,7 @@
 from PIL import Image, ImageDraw, ImageFont
 import hashlib
 import random
+import re
 import uuid
 from .js_snippet import load_js_script
 from .models import AsyncCrawlResponse
@@ -28,7 +29,7 @@
 import aiohttp
 import chardet
 from aiohttp.client import ClientTimeout
-from urllib.parse import urlparse
+from urllib.parse import quote, urlparse
 from types import MappingProxyType
 import contextlib
 from functools import partial
@@ -1099,10 +1100,14 @@ async def handle_request_failed_capture(request):
 
                     for selector in selectors:
                         try:
+                            # Passed as an argument, never pasted into the
+                            # script: a '"' in the selector used to end the
+                            # string literal and run the rest as JavaScript.
                             content = await self.adapter.evaluate(page,
-                                f"""Array.from(document.querySelectorAll("{selector}"))
+                                """(sel) => Array.from(document.querySelectorAll(sel))
                                     .map(el => el.outerHTML)
-                                    .join('')"""
+                                    .join('')""",
+                                selector,
                             )
                             html_parts.append(content)
                         except Error as e:
@@ -2642,6 +2647,8 @@ def _format_proxy_url(self, proxy_config) -> str:
 
         if username and password:
             # Insert credentials into URL: http://user:pass@host:port
+            username = quote(username, safe='')
+            password = quote(password, safe='')
             if '://' in server:
                 protocol, rest = server.split('://', 1)
                 return f"{protocol}://{username}:{password}@{rest}"
@@ -2650,6 +2657,42 @@ def _format_proxy_url(self, proxy_config) -> str:
 
         return server
 
+    # scheme://user:pass@ in any URL inside a message
+    _URL_USERINFO = re.compile(r"([A-Za-z][A-Za-z0-9+.-]*://)[^/\s@]+@")
+
+    @classmethod
+    def _redact_proxy_credentials(cls, message: str, proxy_url: Optional[str]) -> str:
+        """Mask proxy credentials in an error message before it is raised.
+
+        Some aiohttp errors quote the proxy URL (``InvalidURL`` carries all of
+        it), and the errors raised from ``_handle_http`` end up in logs and in
+        crawl results.
+        """
+        if proxy_url and "@" in proxy_url:
+            from urllib.parse import unquote
+
+            userinfo = proxy_url.split("://", 1)[-1].rsplit("@", 1)[0]
+            # The exact string first: a password with "/" or "#" in it is not
+            # matched whole by the pattern below.
+            for secret in {userinfo, unquote(userinfo)}:
+                message = message.replace(secret + "@", "***@")
+        return cls._URL_USERINFO.sub(r"\1***@", message)
+
+    @classmethod
+    def _wrap_error(cls, exc_type, prefix: str, error: BaseException, proxy_url: Optional[str]):
+        """``exc_type(f"{prefix}: {error}")`` with proxy credentials masked.
+
+        When the original message carried credentials, it is also kept out of
+        the traceback, which would otherwise print it under "During handling
+        of the above exception".
+        """
+        text = str(error)
+        safe = cls._redact_proxy_credentials(text, proxy_url)
+        wrapped = exc_type(f"{prefix}: {safe}")
+        if safe != text:
+            wrapped.__suppress_context__ = True
+        return wrapped
+
     # Content types treated as text (decoded into html field)
     _TEXT_CONTENT_TYPES: Final = frozenset({
         'text/csv', 'text/plain', 'text/tab-separated-values', 'text/xml',
@@ -2807,23 +2850,23 @@ async def _handle_http(
 
             except aiohttp.ServerTimeoutError as e:
                 await self.hooks['on_error'](e)
-                raise ConnectionTimeoutError(f"Request timed out: {str(e)}")
+                raise self._wrap_error(ConnectionTimeoutError, "Request timed out", e, proxy_url)
                 
             except aiohttp.ClientConnectorError as e:
                 await self.hooks['on_error'](e)
-                raise ConnectionError(f"Connection failed: {str(e)}")
+                raise self._wrap_error(ConnectionError, "Connection failed", e, proxy_url)
                 
             except aiohttp.ClientError as e:
                 await self.hooks['on_error'](e)
-                raise HTTPCrawlerError(f"HTTP client error: {str(e)}")
+                raise self._wrap_error(HTTPCrawlerError, "HTTP client error", e, proxy_url)
             
             except asyncio.exceptions.TimeoutError as e:
                 await self.hooks['on_error'](e)
-                raise ConnectionTimeoutError(f"Request timed out: {str(e)}")
+                raise self._wrap_error(ConnectionTimeoutError, "Request timed out", e, proxy_url)
             
             except Exception as e:
                 await self.hooks['on_error'](e)
-                raise HTTPCrawlerError(f"HTTP request failed: {str(e)}")
+                raise self._wrap_error(HTTPCrawlerError, "HTTP request failed", e, proxy_url)
 
     async def crawl(
         self, 
diff --git a/crawl4ai/browser_manager.py b/crawl4ai/browser_manager.py
index 17d6f5eb3..fa671c694 100644
--- a/crawl4ai/browser_manager.py
+++ b/crawl4ai/browser_manager.py
@@ -41,6 +41,20 @@
 ]
 
 
+def chromium_sandbox_requested() -> bool:
+    """True when the operator opts into the Chromium sandbox
+    (CRAWL4AI_CHROMIUM_SANDBOX=true). The default keeps --no-sandbox because
+    Chromium cannot start sandboxed in a container without user namespaces."""
+    return os.environ.get("CRAWL4AI_CHROMIUM_SANDBOX", "false").lower() == "true"
+
+
+def apply_sandbox_policy(args: List[str]) -> List[str]:
+    """Drop --no-sandbox, also from extra_args, when the sandbox is requested."""
+    if chromium_sandbox_requested():
+        return [a for a in args if a != "--no-sandbox"]
+    return args
+
+
 class ManagedBrowser:
     """
     Manages the browser process and context. This class allows to connect to the browser using CDP protocol.
@@ -76,8 +90,6 @@ def build_browser_flags(config: BrowserConfig) -> List[str]:
             "--no-default-browser-check",
             "--disable-infobars",
             "--window-position=0,0",
-            "--ignore-certificate-errors",
-            "--ignore-certificate-errors-spki-list",
             "--disable-blink-features=AutomationControlled",
             "--window-position=400,0",
             "--disable-renderer-backgrounding",
@@ -124,7 +136,7 @@ def build_browser_flags(config: BrowserConfig) -> List[str]:
         elif config.proxy_config:
             flags.append(f"--proxy-server={config.proxy_config.server}")
         # dedupe
-        return list(dict.fromkeys(flags))
+        return apply_sandbox_policy(list(dict.fromkeys(flags)))
 
     browser_type: str
     user_data_dir: str
@@ -197,6 +209,7 @@ async def start(self) -> str:
         
         if self.browser_config.extra_args:
             args.extend(self.browser_config.extra_args)
+            args = apply_sandbox_policy(args)
             
 
         # ── make sure no old Chromium instance is owning the same port/profile ──
@@ -395,6 +408,10 @@ async def _get_browser_args(self) -> List[str]:
                 flags.append(f"--window-size={self.browser_config.viewport_width},{self.browser_config.viewport_height}")
             # merge common launch flags
             flags.extend(self.build_browser_flags(self.browser_config))
+            # The default context of a CDP-connected browser takes no
+            # ignore_https_errors option, so insecure mode needs the launch flag.
+            if self.browser_config.ignore_https_errors:
+                flags.append("--ignore-certificate-errors")
         elif self.browser_type == "firefox":
             flags = [
                 "--remote-debugging-port",
@@ -867,7 +884,7 @@ async def _start_impl(self):
 
             launch_kwargs = {
                 "headless": self.config.headless,
-                "args": list(dict.fromkeys(cli_args)),  # dedupe
+                "args": apply_sandbox_policy(list(dict.fromkeys(cli_args))),  # dedupe
                 "viewport": {
                     "width": self.config.viewport_width,
                     "height": self.config.viewport_height,
@@ -876,6 +893,8 @@ async def _start_impl(self):
                 "ignore_https_errors": self.config.ignore_https_errors,
                 "accept_downloads": self.config.accept_downloads,
             }
+            if chromium_sandbox_requested():
+                launch_kwargs["chromium_sandbox"] = True
 
             if self.config.proxy_config:
                 launch_kwargs["proxy"] = {
@@ -1095,8 +1114,6 @@ def _build_browser_args(self) -> dict:
             "--no-default-browser-check",
             "--disable-infobars",
             "--window-position=0,0",
-            "--ignore-certificate-errors",
-            "--ignore-certificate-errors-spki-list",
             "--disable-blink-features=AutomationControlled",
             "--window-position=400,0",
             "--disable-renderer-backgrounding",
@@ -1139,9 +1156,12 @@ def _build_browser_args(self) -> dict:
             args.extend(self.config.extra_args)
 
         # Deduplicate args
-        args = list(dict.fromkeys(args))
+        args = apply_sandbox_policy(list(dict.fromkeys(args)))
         
         browser_args = {"headless": self.config.headless, "args": args}
+        # Playwright adds --no-sandbox itself unless chromium_sandbox is True.
+        if chromium_sandbox_requested():
+            browser_args["chromium_sandbox"] = True
 
         # On Windows, passing channel='chromium' (the default) causes Playwright
         # to look for a system Chrome installation instead of using the bundled
diff --git a/crawl4ai/cache_validator.py b/crawl4ai/cache_validator.py
index b4b170cee..20684277d 100644
--- a/crawl4ai/cache_validator.py
+++ b/crawl4ai/cache_validator.py
@@ -18,6 +18,7 @@
 from typing import Optional, Tuple
 from enum import Enum
 
+from .egress_policy import proxy_url
 from .utils import compute_head_fingerprint
 
 
@@ -72,9 +73,13 @@ def __init__(self, timeout: float = 10.0, user_agent: Optional[str] = None):
     async def _get_client(self) -> httpx.AsyncClient:
         """Get or create the httpx client."""
         if self._client is None:
+            # proxy=None unless an embedder installed one (the Docker server
+            # does). The URL is the caller's crawl URL, so without it this
+            # reached internal hosts directly and followed redirects into them.
             self._client = httpx.AsyncClient(
                 http2=True,
                 timeout=self.timeout,
+                proxy=proxy_url(),
                 follow_redirects=True,
                 headers={"User-Agent": self.user_agent}
             )
diff --git a/crawl4ai/cli.py b/crawl4ai/cli.py
index 4473cd54c..ecf333c23 100644
--- a/crawl4ai/cli.py
+++ b/crawl4ai/cli.py
@@ -175,7 +175,7 @@ def show_examples():
     crwl https://example.com -o markdown
 
     # Verbose JSON output with cache bypass
-    crwl https://example.com -o json -v --bypass-cache
+    crwl https://example.com -o all -v --bypass-cache
 
 2️⃣  Using Config Files:
     # Using browser and crawler configs
@@ -516,7 +516,7 @@ async def crawl_with_profile_cli(profile_path, url):
     # Ask for output format
     output_format = Prompt.ask(
         "[cyan]Output format[/cyan]",
-        choices=["all", "json", "markdown", "md", "title"],
+        choices=["all", "markdown", "md", "title"],
         default="markdown"
     )
     
@@ -1021,9 +1021,9 @@ def cdp_cmd(user_data_dir: Optional[str], port: int, browser_type: str, headless
 @click.option("--schema", "-s", type=click.Path(exists=True), help="JSON schema for extraction")
 @click.option("--browser", "-b", type=str, callback=parse_key_values, help="Browser parameters as key1=value1,key2=value2")
 @click.option("--crawler", "-c", type=str, callback=parse_key_values, help="Crawler parameters as key1=value1,key2=value2")
-@click.option("--output", "-o", type=click.Choice(["all", "json", "markdown", "md", "markdown-fit", "md-fit"]), default="all")
+@click.option("--output", "-o", type=click.Choice(["all", "json", "markdown", "md", "markdown-fit", "md-fit"]), default="all", help="json = extracted data only (needs -j or -e). Use 'all' (default) for the full crawl result.")
 @click.option("--output-file", "-O", type=click.Path(), help="Output file path (default: stdout)")
-@click.option("--bypass-cache", "-bc", is_flag=True, default=True, help="Bypass cache when crawling")
+@click.option("--bypass-cache", "-bc", is_flag=True, default=False, help="Bypass cache when crawling (the default unless -c cache_mode=... is set)")
 @click.option("--question", "-q", help="Ask a question about the crawled content")
 @click.option("--verbose", "-v", is_flag=True)
 @click.option("--profile", "-p", help="Use a specific browser profile (by name)")
@@ -1204,6 +1204,12 @@ def crawl_cmd(url: str, browser_config: str, crawler_config: str, filter_config:
         else:
             ensure_ascii = config.get("JSON_ENSURE_ASCII", USER_SETTINGS["JSON_ENSURE_ASCII"]["default"])
 
+        if output == "json" and not question and crawler_cfg.extraction_strategy is None:
+            raise click.UsageError(
+                "-o json needs an extraction strategy (-j or -e). "
+                "Use -o all for the full crawl result."
+            )
+
         # Run crawler
         result : CrawlResult = anyio.run(
             run_crawler,
@@ -1242,7 +1248,6 @@ def crawl_cmd(url: str, browser_config: str, crawler_config: str, filter_config:
                 else:
                     click.echo(json.dumps(main_result.model_dump(), indent=2, ensure_ascii=ensure_ascii))
             elif output == "json":
-                print(main_result.extracted_content)
                 extracted_items = json.loads(main_result.extracted_content)
                 click.echo(json.dumps(extracted_items, indent=2, ensure_ascii=ensure_ascii))
 
@@ -1292,6 +1297,8 @@ def crawl_cmd(url: str, browser_config: str, crawler_config: str, filter_config:
                     else:
                         f.write(main_result.markdown.fit_markdown)
             
+    except click.ClickException:
+        raise
     except Exception as e:
         raise click.ClickException(str(e))
 
@@ -1579,8 +1586,8 @@ def shrink_cmd(profile_name: str, level: str, dry_run: bool):
 @click.option("--schema", "-s", type=click.Path(exists=True), help="JSON schema for extraction")
 @click.option("--browser", "-b", type=str, callback=parse_key_values, help="Browser parameters as key1=value1,key2=value2")
 @click.option("--crawler", "-c", type=str, callback=parse_key_values, help="Crawler parameters as key1=value1,key2=value2")
-@click.option("--output", "-o", type=click.Choice(["all", "json", "markdown", "md", "markdown-fit", "md-fit"]), default="all")
-@click.option("--bypass-cache", is_flag=True, default=True, help="Bypass cache when crawling")
+@click.option("--output", "-o", type=click.Choice(["all", "json", "markdown", "md", "markdown-fit", "md-fit"]), default="all", help="json = extracted data only (needs -j or -e). Use 'all' (default) for the full crawl result.")
+@click.option("--bypass-cache", is_flag=True, default=False, help="Bypass cache when crawling (the default unless -c cache_mode=... is set)")
 @click.option("--question", "-q", help="Ask a question about the crawled content")
 @click.option("--verbose", "-v", is_flag=True)
 @click.option("--profile", "-p", help="Use a specific browser profile (by name)")
diff --git a/crawl4ai/content_scraping_strategy.py b/crawl4ai/content_scraping_strategy.py
index 67e87250d..ab7bc3efb 100644
--- a/crawl4ai/content_scraping_strategy.py
+++ b/crawl4ai/content_scraping_strategy.py
@@ -36,6 +36,36 @@
 OG_REGEX = re.compile(r"^og:")
 TWITTER_REGEX = re.compile(r"^twitter:")
 DIMENSION_REGEX = re.compile(r"(\d+)(\D*)")
+NOSCRIPT_OPEN_REGEX = re.compile(r"<noscript\b[^>]*>", re.IGNORECASE)
+NOSCRIPT_CLOSE_REGEX = re.compile(r"</noscript\s*>", re.IGNORECASE)
+RAW_TEXT_REGEX = re.compile(
+    r"<script\b.*?(?:</script\s*>|\Z)|<style\b.*?(?:</style\s*>|\Z)|<!--.*?(?:-->|\Z)",
+    re.IGNORECASE | re.DOTALL,
+)
+
+
+def unwrap_orphaned_noscript(html: str) -> str:
+    """Drop <noscript> tags, keeping their contents, when one is left unclosed.
+
+    Pages that nest <noscript> (lazy-load plugins commonly wrap Google Tag
+    Manager's own noscript) lose a closing tag when a scripting-enabled browser
+    serializes them: the browser ends the element at the first </noscript> and
+    discards the stray one. lxml parses with scripting disabled, so it nests the
+    rest of the document inside the still-open element, and the noscript
+    removal below then deletes the whole page.
+
+    Unbalanced tag counts identify that serialization damage, so well-formed
+    documents are returned untouched. Tags inside <script>, <style> and
+    comments are only text, so they are left out of the count. An unclosed
+    one runs to the end of the document, as in a browser, which also keeps
+    the scan linear on pages with many unclosed openers.
+    """
+    markup = RAW_TEXT_REGEX.sub("", html)
+    opens = len(NOSCRIPT_OPEN_REGEX.findall(markup))
+    closes = len(NOSCRIPT_CLOSE_REGEX.findall(markup))
+    if opens <= closes:
+        return html
+    return NOSCRIPT_CLOSE_REGEX.sub("", NOSCRIPT_OPEN_REGEX.sub("", html))
 
 
 # Function to parse srcset
@@ -564,6 +594,10 @@ def remove_empty_elements_fast(self, root, word_count_threshold=5):
                 if parent is not None:
                     # Preserve .tail text before removing the element
                     tail = el.tail
+                    if el.text and not text_content:
+                        # A whitespace-only element separates the words around
+                        # it, so keep one space where it was.
+                        tail = " " + (tail or "")
                     if tail:
                         prev = el.getprevious()
                         if prev is not None:
@@ -626,7 +660,7 @@ def _scrap(
 
         success = True
         try:
-            doc = lhtml.document_fromstring(html)
+            doc = lhtml.document_fromstring(unwrap_orphaned_noscript(html))
             # Match BeautifulSoup's behavior of using body or full doc
             # body = doc.xpath('//body')[0] if doc.xpath('//body') else doc
             body = doc
diff --git a/crawl4ai/deep_crawling/bff_strategy.py b/crawl4ai/deep_crawling/bff_strategy.py
index abf53f054..6eb9fd27e 100644
--- a/crawl4ai/deep_crawling/bff_strategy.py
+++ b/crawl4ai/deep_crawling/bff_strategy.py
@@ -235,6 +235,7 @@ async def _arun_best_first(
             await queue.put((-initial_score, 0, start_url, None))
             visited: Set[str] = set()
             depths: Dict[str, int] = {start_url: 0}
+            self._pages_crawled = 0
             # Initialize shadow list if callback is set
             if self._on_state_change:
                 self._queue_shadow = [(-initial_score, 0, start_url, None)]
diff --git a/crawl4ai/deep_crawling/bfs_strategy.py b/crawl4ai/deep_crawling/bfs_strategy.py
index 2b00a6cda..ffee5a1f3 100644
--- a/crawl4ai/deep_crawling/bfs_strategy.py
+++ b/crawl4ai/deep_crawling/bfs_strategy.py
@@ -150,7 +150,7 @@ async def link_discovery(
             return
 
         # If we've reached the max pages limit, don't discover new links
-        remaining_capacity = self.max_pages - self._pages_crawled
+        remaining_capacity = self.max_pages - self._pages_crawled - len(next_level)
         if remaining_capacity <= 0:
             self.logger.info(f"Max pages limit ({self.max_pages}) reached, stopping link discovery")
             return
@@ -232,6 +232,7 @@ async def _arun_batch(
             # current_level holds tuples: (url, parent_url)
             current_level: List[Tuple[str, Optional[str]]] = [(start_url, None)]
             depths: Dict[str, int] = {start_url: 0}
+            self._pages_crawled = 0
 
         results: List[CrawlResult] = []
 
@@ -247,6 +248,12 @@ async def _arun_batch(
                 break
 
             next_level: List[Tuple[str, Optional[str]]] = []
+            # Siblings in a level queue links before the level's own pages are all
+            # counted, so cap the level to the budget left before fetching it.
+            # max_pages defaults to infinity, which is not a valid slice index.
+            remaining = self.max_pages - self._pages_crawled
+            if remaining < len(current_level):
+                current_level = current_level[:max(int(remaining), 0)]
             urls = [url for url, _ in current_level]
             # reversed() keeps first-parent-wins if a resumed level repeats a URL
             parents = dict(reversed(current_level))
@@ -329,6 +336,7 @@ async def _arun_stream(
             visited: Set[str] = set()
             current_level: List[Tuple[str, Optional[str]]] = [(start_url, None)]
             depths: Dict[str, int] = {start_url: 0}
+            self._pages_crawled = 0
 
         while current_level and not self._cancel_event.is_set():
             # Check external cancellation callback before processing this level
@@ -337,6 +345,15 @@ async def _arun_stream(
                 break
 
             next_level: List[Tuple[str, Optional[str]]] = []
+            # Siblings in a level queue links before the level's own pages are all
+            # counted, so cap the level to the budget left before fetching it.
+            # max_pages defaults to infinity, which is not a valid slice index.
+            remaining = self.max_pages - self._pages_crawled
+            if remaining < len(current_level):
+                current_level = current_level[:max(int(remaining), 0)]
+            if not current_level:
+                self.logger.info(f"Max pages limit ({self.max_pages}) reached, stopping crawl")
+                break
             urls = [url for url, _ in current_level]
             # reversed() keeps first-parent-wins if a resumed level repeats a URL
             parents = dict(reversed(current_level))
diff --git a/crawl4ai/deep_crawling/dfs_strategy.py b/crawl4ai/deep_crawling/dfs_strategy.py
index 3e4987f25..10b36657a 100644
--- a/crawl4ai/deep_crawling/dfs_strategy.py
+++ b/crawl4ai/deep_crawling/dfs_strategy.py
@@ -60,6 +60,7 @@ async def _arun_batch(
             stack: List[Tuple[str, Optional[str], int]] = [(start_url, None, 0)]
             depths: Dict[str, int] = {start_url: 0}
             results: List[CrawlResult] = []
+            self._pages_crawled = 0
             self._reset_seen(start_url)
 
         while stack and not self._cancel_event.is_set():
@@ -169,6 +170,7 @@ async def _arun_stream(
             visited: Set[str] = set()
             stack: List[Tuple[str, Optional[str], int]] = [(start_url, None, 0)]
             depths: Dict[str, int] = {start_url: 0}
+            self._pages_crawled = 0
             self._reset_seen(start_url)
 
         while stack and not self._cancel_event.is_set():
diff --git a/crawl4ai/deep_crawling/filters.py b/crawl4ai/deep_crawling/filters.py
index 2fb819ecc..e89cc8948 100644
--- a/crawl4ai/deep_crawling/filters.py
+++ b/crawl4ai/deep_crawling/filters.py
@@ -209,7 +209,8 @@ def _add_pattern(self, pattern: str, pattern_type: int):
                         lambda m: f'({"|".join(m.group(1).split(","))})',
                         pattern,
                     )
-                pattern = fnmatch.translate(pattern)
+                # A leading * already matches any prefix; \A stops search() retrying every offset.
+                pattern = ("\\A" if pattern.startswith("*") else "") + fnmatch.translate(pattern)
             self._path_patterns.append(
                 pattern if isinstance(pattern, Pattern) else re.compile(pattern)
             )
@@ -427,9 +428,6 @@ class DomainFilter(URLFilter):
 
     __slots__ = ("_allowed_domains", "_blocked_domains", "_domain_cache")
 
-    # Regex for fast domain extraction
-    _DOMAIN_REGEX = re.compile(r"://([^/]+)")
-
     def __init__(
         self,
         allowed_domains: Union[str, List[str]] = None,
@@ -450,12 +448,17 @@ def __init__(
         )
 
     @staticmethod
-    def _normalize_domains(domains: Union[str, List[str]]) -> Set[str]:
+    def _normalize_domain(domain: str) -> str:
+        """Lowercase a domain and strip a trailing dot"""
+        return domain.lower().rstrip(".")
+
+    @classmethod
+    def _normalize_domains(cls, domains: Union[str, List[str]]) -> Set[str]:
         """Fast domain normalization"""
         if isinstance(domains, str):
-            return {domains.lower()}
-        return {d.lower() for d in domains}
-    
+            return {cls._normalize_domain(domains)}
+        return {cls._normalize_domain(d) for d in domains}
+
     @staticmethod
     def _is_subdomain(domain: str, parent_domain: str) -> bool:
         """Check if domain is a subdomain of parent_domain"""
@@ -464,9 +467,12 @@ def _is_subdomain(domain: str, parent_domain: str) -> bool:
     @staticmethod
     @lru_cache(maxsize=10000)
     def _extract_domain(url: str) -> str:
-        """Ultra-fast domain extraction with regex and caching"""
-        match = DomainFilter._DOMAIN_REGEX.search(url)
-        return match.group(1).lower() if match else ""
+        """Extract the host from a URL, dropping userinfo/port and trailing dot"""
+        try:
+            host = urlparse(url).hostname
+        except ValueError:
+            return ""
+        return host.rstrip(".") if host else ""
 
     def apply(self, url: str) -> bool:
         """Optimized domain checking with early returns"""
diff --git a/crawl4ai/models.py b/crawl4ai/models.py
index 7ab3794cc..14098980b 100644
--- a/crawl4ai/models.py
+++ b/crawl4ai/models.py
@@ -133,8 +133,15 @@ class CrawlResult(BaseModel):
     fit_html: Optional[str] = None
     success: bool
     cleaned_html: Optional[str] = None
-    media: Dict[str, List[Dict]] = {}
-    links: Dict[str, List[Dict]] = {}
+    # The keys a scraped page gets (arun moves media's "tables" to .tables), so
+    # a result built without them -- robots.txt refusal, a failed fetch --
+    # keeps the shape.
+    media: Dict[str, List[Dict]] = Field(
+        default_factory=lambda: {"images": [], "videos": [], "audios": []}
+    )
+    links: Dict[str, List[Dict]] = Field(
+        default_factory=lambda: {"internal": [], "external": []}
+    )
     downloaded_files: Optional[List[str]] = None
     js_execution_result: Optional[Dict[str, Any]] = None
     screenshot: Optional[str] = None
diff --git a/crawl4ai/processors/pdf/processor.py b/crawl4ai/processors/pdf/processor.py
index 96ff0d260..ebcd53df1 100644
--- a/crawl4ai/processors/pdf/processor.py
+++ b/crawl4ai/processors/pdf/processor.py
@@ -66,7 +66,6 @@ def __init__(self, image_dpi: int = 144, image_quality: int = 85, extract_images
             
         self.image_dpi = image_dpi
         self.image_quality = image_quality
-        self.current_page_number = 0
         self.extract_images = extract_images
         self.save_images_locally = save_images_locally
         self.image_save_dir = image_save_dir
@@ -122,8 +121,7 @@ def process(self, pdf_path: Path) -> PDFProcessResult:
                 for page_num, page in enumerate(reader.pages):
                     if page_num >= page_limit:
                         break
-                    self.current_page_number = page_num + 1
-                    pdf_page = self._process_page(page, image_dir)
+                    pdf_page = self._process_page(page, image_dir, page_num + 1)
                     result.pages.append(pdf_page)
 
         except Exception as e:
@@ -186,8 +184,7 @@ def process_page_safely(page_num: int):
                 with pdf_path.open('rb') as file:
                     thread_reader = PdfReader(file)
                     page = thread_reader.pages[page_num]
-                    self.current_page_number = page_num + 1
-                    return self._process_page(page, image_dir)
+                    return self._process_page(page, image_dir, page_num + 1)
 
             # Process pages in parallel batches
             with concurrent.futures.ThreadPoolExecutor(max_workers=self.batch_size) as executor:
@@ -221,9 +218,9 @@ def process_page_safely(page_num: int):
         result.processing_time = time() - start_time
         return result
 
-    def _process_page(self, page, image_dir: Optional[Path]) -> PDFPage:
+    def _process_page(self, page, image_dir: Optional[Path], page_number: int) -> PDFPage:
         pdf_page = PDFPage(
-            page_number=self.current_page_number,
+            page_number=page_number,
         )
 
         # Text and font extraction
@@ -240,18 +237,18 @@ def visitor_text(text, cm, tm, font_dict, font_size):
 
         # Image extraction
         if self.extract_images:
-            pdf_page.images = self._extract_images(page, image_dir)
+            pdf_page.images = self._extract_images(page, image_dir, page_number)
 
         # Link extraction
         pdf_page.links = self._extract_links(page)
         
         # Add markdown content
-        pdf_page.markdown = clean_pdf_text(self.current_page_number, pdf_page.raw_text)
-        pdf_page.html = clean_pdf_text_to_html(self.current_page_number, pdf_page.raw_text)
+        pdf_page.markdown = clean_pdf_text(page_number, pdf_page.raw_text)
+        pdf_page.html = clean_pdf_text_to_html(page_number, pdf_page.raw_text)
 
         return pdf_page
 
-    def _extract_images(self, page, image_dir: Optional[Path]) -> List[Dict]:
+    def _extract_images(self, page, image_dir: Optional[Path], page_number: int) -> List[Dict]:
         # Import pypdf for type checking only when needed
         try:
             from pypdf.generic import IndirectObject
@@ -276,7 +273,7 @@ def _extract_images(self, page, image_dir: Optional[Path]) -> List[Dict]:
                             if xobj.get('/Subtype') == '/Image':
                                 try:
                                     img_count += 1
-                                    img_filename = f"page_{self.current_page_number}_img_{img_count}"
+                                    img_filename = f"page_{page_number}_img_{img_count}"
                                     data = xobj.get_data()
                                     filters = xobj.get('/Filter', [])
                                     if not isinstance(filters, list):
diff --git a/crawl4ai/utils.py b/crawl4ai/utils.py
index 03d557154..b2e2cba7c 100644
--- a/crawl4ai/utils.py
+++ b/crawl4ai/utils.py
@@ -3137,10 +3137,13 @@ def preprocess_html_for_schema(html_content, text_threshold=100, attr_value_thre
     Returns:
         str: Preprocessed HTML content
     """
+    # Local import: content_scraping_strategy imports from this module.
+    from .content_scraping_strategy import unwrap_orphaned_noscript
+
     try:
         # Parse HTML with error recovery
         parser = etree.HTMLParser(remove_comments=True, remove_blank_text=True)
-        tree = lhtml.fromstring(html_content, parser=parser)
+        tree = lhtml.fromstring(unwrap_orphaned_noscript(html_content), parser=parser)
         
         # 1. Remove HEAD section (keep only BODY)
         head_elements = tree.xpath('//head')
diff --git a/deploy/docker/MIGRATION.md b/deploy/docker/MIGRATION.md
index 5123c950f..c389a045e 100644
--- a/deploy/docker/MIGRATION.md
+++ b/deploy/docker/MIGRATION.md
@@ -68,6 +68,10 @@ control):
 `base_url`, `deep_crawl_strategy`, `simulate_user`, `magic`,
 `process_in_browser`, and nested LLM config objects.
 
+`deep_crawl_strategy` can be turned back on by the operator with
+`CRAWL4AI_ALLOW_DEEP_CRAWL=true`, with server-side limits. See "Deep Crawling
+(opt-in)" in the self-hosting guide.
+
 Unknown fields are dropped; timeouts, viewport and scroll counts are clamped to
 safe maximums.
 
diff --git a/deploy/docker/README.md b/deploy/docker/README.md
index a57c857b9..a52816018 100644
--- a/deploy/docker/README.md
+++ b/deploy/docker/README.md
@@ -562,7 +562,62 @@ Crucially, when sending configurations directly via JSON, they **must** follow t
 ```
 
 **LLM Extraction Strategy** *(Keep example, ensure schema uses type/value wrapper)*
-*(Keep Deep Crawler Example)*
+#### Deep Crawling (opt-in)
+
+Deep crawling over the API is **disabled by default**: a request with
+`deep_crawl_strategy` returns HTTP 400. To allow it, start the container with
+`CRAWL4AI_ALLOW_DEEP_CRAWL=true`:
+
+```bash
+docker run -d \
+  -p 11235:11235 \
+  --name crawl4ai \
+  --shm-size=1g \
+  -e CRAWL4AI_API_TOKEN="$CRAWL4AI_API_TOKEN" \
+  -e CRAWL4AI_ALLOW_DEEP_CRAWL=true \
+  unclecode/crawl4ai:latest
+```
+
+With Docker Compose, put `CRAWL4AI_ALLOW_DEEP_CRAWL=true` in the `.env` file in
+the project root, or export it in your shell. The compose file sets this
+variable itself, so a value in `.llm.env` is ignored.
+
+```json
+{
+  "urls": ["https://docs.crawl4ai.com"],
+  "crawler_config": {
+    "type": "CrawlerRunConfig",
+    "params": {
+      "deep_crawl_strategy": {
+        "type": "BFSDeepCrawlStrategy",
+        "params": {
+          "max_depth": 2,
+          "max_pages": 20,
+          "filter_chain": {
+            "type": "FilterChain",
+            "params": {
+              "filters": [
+                {"type": "URLPatternFilter", "params": {"patterns": ["*/core/*"]}},
+                {"type": "DomainFilter", "params": {"allowed_domains": ["docs.crawl4ai.com"]}}
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+Rules the server applies:
+
+- **One start URL** per request, and not inside `crawler_configs`.
+- `max_pages` and `max_depth` are clamped to `limits.max_pages` and `limits.max_depth` in `config.yml` (default 100 and 5; `max_pages: 0` means no limit). The crawl stops after `limits.wall_clock_s`, also on `/crawl/stream`.
+- **Allowed types:** `BFSDeepCrawlStrategy`, `DFSDeepCrawlStrategy`, `BestFirstCrawlingStrategy`; `FilterChain` with `URLPatternFilter`, `DomainFilter`, `ContentTypeFilter`; scorers `KeywordRelevanceScorer`, `CompositeScorer`, `DomainAuthorityScorer`, `FreshnessScorer`, `PathDepthScorer`. `SEOFilter` and `ContentRelevanceFilter` are refused (they fetch pages outside the egress controls).
+- `URLPatternFilter` accepts globs that start with `*` (`*/blog/*`), `/prefix/*` or `*.ext`. Regex patterns are refused.
+- `resume_state` is refused, and so is `fetch_ssl_certificate` together with a deep crawl. Lists (patterns, keywords, filters, scorers) are limited to 100 items. One strategy may have at most 20 filters and scorers and 200 list items in total, and a `CompositeScorer` cannot contain another `CompositeScorer`. Discovered links longer than 2048 characters are skipped.
+
+Turn the flag on only when you accept that one request can fetch many pages.
 
 ### REST API Examples
 
@@ -658,6 +713,29 @@ async def test_stream_crawl(token: str = None): # Made token optional
 # asyncio.run(test_stream_crawl())
 ```
 
+#### Per-URL Configs (`crawler_configs`)
+
+To crawl different URLs with different settings in one request, send `crawler_configs`: a list of `CrawlerRunConfig` payloads, each with a `url_matcher`. Every URL uses the first entry whose `url_matcher` matches it, and an entry without a `url_matcher` matches every URL.
+
+```python
+payload = {
+    "urls": ["https://docs.example.com/guide", "https://example.com/"],
+    "crawler_configs": [
+        {
+            "type": "CrawlerRunConfig",
+            "params": {"url_matcher": "*docs.example.com*", "css_selector": "main"},
+        },
+        # Catch-all: decides every URL the entries above did not match
+        {"type": "CrawlerRunConfig", "params": {"url_matcher": "*"}},
+    ],
+}
+```
+
+- The list is used for one URL or many, on both `/crawl` and `/crawl/stream`.
+- When a list is sent, `crawler_config` is ignored. It is not a fallback: a URL that no entry matches comes back as a failed result (`No matching configuration found for URL: ...`), so end the list with a catch-all entry (`"url_matcher": "*"`).
+- The server's `crawler.base_config` defaults from `config.yml` are applied to each entry on both endpoints.
+- A list that mixes `PDFContentScrapingStrategy` entries with other scraping strategies is refused with `400`, because one crawler serves every URL of a request.
+
 ### Asynchronous Jobs with Webhooks
 
 For long-running crawls or when you want to avoid keeping connections open, use the job queue endpoints. Instead of polling for results, configure a webhook to receive notifications when jobs complete.
diff --git a/deploy/docker/api.py b/deploy/docker/api.py
index 7c90fb5ba..d4636c412 100644
--- a/deploy/docker/api.py
+++ b/deploy/docker/api.py
@@ -23,7 +23,8 @@
     BrowserConfig,
     MemoryAdaptiveDispatcher,
     RateLimiter, 
-    LLMConfig
+    LLMConfig,
+    CrawlResult,
 )
 from crawl4ai.async_configs import Provenance, UntrustedConfigError
 from hook_registry import build_declarative_hooks, HookValidationError
@@ -640,6 +641,8 @@ async def stream_results(crawler: AsyncWebCrawler, results_gen: AsyncGenerator)
 
         yield json.dumps({"status": "completed"}).encode('utf-8')
         
+    except asyncio.TimeoutError:
+        yield json.dumps({"status": "error", "error": "Crawl exceeded the time limit"}).encode('utf-8')
     except asyncio.CancelledError:
         logger.warning("Client disconnected during streaming")
     finally:
@@ -647,14 +650,93 @@ async def stream_results(crawler: AsyncWebCrawler, results_gen: AsyncGenerator)
             await _dispose_crawler(crawler)
 
 
-def _normalize_and_validate_seeds(urls: List[str]) -> List[str]:
+def _load_crawler_configs(
+    crawler_configs: List[dict],
+    base_config: Optional[dict] = None,
+    stream: bool = False,
+) -> List[CrawlerRunConfig]:
+    """Deserialize a per-URL crawler_configs list under the untrusted gate.
+    Shared by the streaming and non-streaming crawl handlers so both apply the
+    same boundary and wire the PDF URL validator into every entry."""
+    from crawl4ai.processors.pdf import PDFContentScrapingStrategy
+
+    config_list = [
+        CrawlerRunConfig.load(cc, provenance=Provenance.UNTRUSTED)
+        for cc in crawler_configs
+    ]
+    for cfg in config_list:
+        if cfg.deep_crawl_strategy is not None:
+            raise HTTPException(status_code=400, detail="Deep crawling supports exactly one URL per request.")
+        for key, value in (base_config or {}).items():
+            if hasattr(cfg, key):
+                current_value = getattr(cfg, key)
+                if current_value is None or current_value == "":
+                    setattr(cfg, key, value)
+        # SSRF: per-URL PDF strategies need the validator wired too
+        if isinstance(cfg.scraping_strategy, PDFContentScrapingStrategy):
+            cfg.scraping_strategy.url_validator = validate_url_destination
+        if stream:
+            # arun_many takes the stream flag from the first config of a list.
+            cfg.stream = True
+    return config_list
+
+
+def _needs_pdf_crawler(
+    crawler_config: CrawlerRunConfig,
+    config_list: Optional[List[CrawlerRunConfig]] = None,
+) -> bool:
+    """Whether the crawl runs on PDFCrawlerStrategy. A per-URL list decides when
+    present, since it is what arun_many runs. One crawler serves every URL of a
+    request, so a list mixing PDF and browser entries is refused rather than run
+    on the wrong one."""
+    from crawl4ai.processors.pdf import PDFContentScrapingStrategy
+
+    configs = config_list or [crawler_config]
+    pdf = [
+        isinstance(cfg.scraping_strategy, PDFContentScrapingStrategy) for cfg in configs
+    ]
+    if any(pdf) and not all(pdf):
+        raise HTTPException(
+            status_code=400,
+            detail="crawler_configs cannot mix PDFContentScrapingStrategy with other scraping strategies in one request",
+        )
+    return all(pdf)
+
+
+async def _with_deadline(gen: AsyncGenerator, seconds: float) -> AsyncGenerator:
+    """Stop a result stream once its wall-clock budget is spent (raises TimeoutError)."""
+    loop = asyncio.get_running_loop()
+    end = loop.time() + seconds
+    try:
+        while True:
+            try:
+                yield await asyncio.wait_for(gen.__anext__(), max(end - loop.time(), 0))
+            except StopAsyncIteration:
+                return
+    finally:
+        await gen.aclose()
+
+
+def _normalize_and_validate_seeds(urls: List[str]) -> Tuple[List[str], List[CrawlResult]]:
     """Prefix bare hosts with https:// and SSRF-validate every seed URL's
     destination. Shared by the streaming and non-streaming crawl handlers so a
-    new entry point cannot silently skip the destination check."""
+    new entry point cannot silently skip the destination check.
+
+    Returns (allowed, refused): a refused seed becomes a failed CrawlResult so
+    one bad seed does not sink the batch. If no seed is allowed, the first
+    refusal is raised (400), as before."""
     urls = [('https://' + url) if not url.startswith(('http://', 'https://')) and not url.startswith(("raw:", "raw://")) else url for url in urls]
+    allowed, refused, first_error = [], [], None
     for url in urls:
-        validate_url_destination(url)
-    return urls
+        try:
+            validate_url_destination(url)
+            allowed.append(url)
+        except HTTPException as e:
+            first_error = first_error or e
+            refused.append(CrawlResult(url=url, html="", success=False, error_message=e.detail))
+    if first_error and not allowed:
+        raise first_error
+    return allowed, refused
 
 
 async def handle_crawl_request(
@@ -684,13 +766,15 @@ async def handle_crawl_request(
     peak_mem_mb = start_mem_mb
 
     try:
-        urls = _normalize_and_validate_seeds(urls)
+        urls, refused = _normalize_and_validate_seeds(urls)
         browser_config = BrowserConfig.load(browser_config, provenance=Provenance.UNTRUSTED)
         crawler_config = CrawlerRunConfig.load(crawler_config, provenance=Provenance.UNTRUSTED)
         from egress_broker import enforce_egress
         enforce_egress(browser_config)
-        from governor import clamp_deep_crawl
-        clamp_deep_crawl(crawler_config)
+        from governor import clamp_deep_crawl, deep_crawl_limits
+        clamp_deep_crawl(crawler_config, **deep_crawl_limits(config))
+        if crawler_config.deep_crawl_strategy is not None and len(urls) + len(refused) != 1:
+            raise HTTPException(status_code=400, detail="Deep crawling supports exactly one URL per request.")
 
         dispatcher = MemoryAdaptiveDispatcher(
             memory_threshold_percent=config["crawler"]["memory_threshold_percent"],
@@ -699,42 +783,39 @@ async def handle_crawl_request(
             ) if config["crawler"]["rate_limiter"]["enabled"] else None
         )
         
+        base_config = config["crawler"]["base_config"]
+        # Per-URL config list: deserialize each and apply base_config. Loaded
+        # before a crawler is chosen, because the list decides which one runs.
+        config_list = (
+            _load_crawler_configs(crawler_configs, base_config)
+            if crawler_configs
+            else None
+        )
+
         from crawler_pool import get_crawler, release_crawler
         from crawl4ai.processors.pdf import PDFContentScrapingStrategy, PDFCrawlerStrategy
-        is_pdf_crawl = isinstance(crawler_config.scraping_strategy, PDFContentScrapingStrategy)
+        is_pdf_crawl = _needs_pdf_crawler(crawler_config, config_list)
         if is_pdf_crawl:
             if hooks_config:
                 # PDFCrawlerStrategy has no browser page, so hooks can't attach to it
                 raise HTTPException(status_code=400, detail="Hooks are not supported with PDFContentScrapingStrategy")
             # SSRF protection: vet the PDF download URL and every redirect hop
-            crawler_config.scraping_strategy.url_validator = validate_url_destination
+            if isinstance(crawler_config.scraping_strategy, PDFContentScrapingStrategy):
+                crawler_config.scraping_strategy.url_validator = validate_url_destination
             # Use PDFCrawlerStrategy when scraping PDFs, as headless Chromium can't render PDFs inline
             crawler = AsyncWebCrawler(crawler_strategy=PDFCrawlerStrategy())
             await crawler.start()
         else:
             crawler = await get_crawler(browser_config)
-        
+
         # Attach declarative hooks if provided
         hooks_status = {}
         if hooks_config:
             hooks_status = _attach_declarative_hooks(crawler, hooks_config)
             logger.info(f"Hooks attachment status: {hooks_status['status']}")
-        
-        base_config = config["crawler"]["base_config"]
 
         # Build the config(s) to pass to arun/arun_many
-        if crawler_configs and len(urls) > 1:
-            # Per-URL config list: deserialize each and apply base_config
-            config_list = [CrawlerRunConfig.load(cc, provenance=Provenance.UNTRUSTED) for cc in crawler_configs]
-            for cfg in config_list:
-                for key, value in base_config.items():
-                    if hasattr(cfg, key):
-                        current_value = getattr(cfg, key)
-                        if current_value is None or current_value == "":
-                            setattr(cfg, key, value)
-                # SSRF: per-URL PDF strategies need the validator wired too
-                if isinstance(cfg.scraping_strategy, PDFContentScrapingStrategy):
-                    cfg.scraping_strategy.url_validator = validate_url_destination
+        if config_list:
             effective_config = config_list
         else:
             # Single config (original behavior)
@@ -746,9 +827,12 @@ async def handle_crawl_request(
             effective_config = crawler_config
 
         results = []
-        func = getattr(crawler, "arun" if len(urls) == 1 else "arun_many")
+        # arun takes one config, so a per-URL list goes to arun_many even for
+        # a single URL; arun_many matches each URL against the list.
+        use_many = len(urls) > 1 or isinstance(effective_config, list)
+        func = getattr(crawler, "arun_many" if use_many else "arun")
         partial_func = partial(func,
-                                urls[0] if len(urls) == 1 else urls,
+                                urls if use_many else urls[0],
                                 config=effective_config,
                                 dispatcher=dispatcher)
         # Optional per-crawl wall-clock deadline (config limits.wall_clock_s; 0 = none).
@@ -762,6 +846,7 @@ async def handle_crawl_request(
         # Ensure results is always a list
         if not isinstance(results, list):
             results = [results]
+        results = refused + results
 
         end_mem_mb = _get_memory_mb() # <--- Get memory after
         end_time = time.time()
@@ -886,12 +971,19 @@ async def handle_crawl_request(
             else:
                 await release_crawler(crawler)
 
+async def _prepend_results(first: List[CrawlResult], results_gen: AsyncGenerator) -> AsyncGenerator:
+    for result in first:
+        yield result
+    async for result in results_gen:
+        yield result
+
 async def handle_stream_crawl_request(
     urls: List[str],
     browser_config: dict,
     crawler_config: dict,
     config: dict,
-    hooks_config: Optional[dict] = None
+    hooks_config: Optional[dict] = None,
+    crawler_configs: Optional[List[dict]] = None,
 ) -> Tuple[AsyncWebCrawler, AsyncGenerator, Optional[Dict]]:
     """Handle streaming crawl requests with optional hooks."""
     hooks_info = None
@@ -900,7 +992,7 @@ async def handle_stream_crawl_request(
         # SSRF guard: validate every seed URL's destination before fetching,
         # mirroring handle_crawl_request. The streaming path previously skipped
         # this, leaving /crawl/stream (and /crawl with stream=true) unguarded.
-        urls = _normalize_and_validate_seeds(urls)
+        urls, refused = _normalize_and_validate_seeds(urls)
         browser_config = BrowserConfig.load(
             browser_config, provenance=Provenance.UNTRUSTED
         )
@@ -912,29 +1004,37 @@ async def handle_stream_crawl_request(
         crawler_config = CrawlerRunConfig.load(
             crawler_config, provenance=Provenance.UNTRUSTED
         )
-        from governor import clamp_deep_crawl
+        from governor import clamp_deep_crawl, deep_crawl_limits
 
-        clamp_deep_crawl(crawler_config)
+        clamp_deep_crawl(crawler_config, **deep_crawl_limits(config))
         crawler_config.stream = True
+        config_list = (
+            _load_crawler_configs(
+                crawler_configs, config["crawler"]["base_config"], stream=True
+            )
+            if crawler_configs
+            else None
+        )
 
         # Deep crawl streaming supports exactly one start URL
-        if crawler_config.deep_crawl_strategy is not None and len(urls) != 1:
+        if crawler_config.deep_crawl_strategy is not None and len(urls) + len(refused) != 1:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
                 detail=(
                     "Deep crawling with stream currently supports exactly one URL per request. "
-                    f"Received {len(urls)} URLs."
+                    f"Received {len(urls) + len(refused)} URLs."
                 ),
             )
 
         from crawler_pool import get_crawler
         from crawl4ai.processors.pdf import PDFContentScrapingStrategy, PDFCrawlerStrategy
-        if isinstance(crawler_config.scraping_strategy, PDFContentScrapingStrategy):
+        if _needs_pdf_crawler(crawler_config, config_list):
             if hooks_config:
                 # PDFCrawlerStrategy has no browser page, so hooks can't attach to it
                 raise HTTPException(status_code=400, detail="Hooks are not supported with PDFContentScrapingStrategy")
             # SSRF protection: vet the PDF download URL and every redirect hop
-            crawler_config.scraping_strategy.url_validator = validate_url_destination
+            if isinstance(crawler_config.scraping_strategy, PDFContentScrapingStrategy):
+                crawler_config.scraping_strategy.url_validator = validate_url_destination
             # Use PDFCrawlerStrategy when scraping PDFs, as headless Chromium can't render PDFs inline
             crawler = AsyncWebCrawler(crawler_strategy=PDFCrawlerStrategy())
             await crawler.start()
@@ -954,6 +1054,9 @@ async def handle_stream_crawl_request(
                 urls[0],
                 config=crawler_config,
             )
+            from governor import wall_clock_seconds
+            if wall_clock_seconds(config) > 0:
+                results_gen = _with_deadline(results_gen, wall_clock_seconds(config))
         else:
             # Default multi-URL streaming via arun_many
             dispatcher = MemoryAdaptiveDispatcher(
@@ -964,10 +1067,13 @@ async def handle_stream_crawl_request(
             )
             results_gen = await crawler.arun_many(
                 urls=urls,
-                config=crawler_config,
+                config=config_list or crawler_config,
                 dispatcher=dispatcher
             )
 
+        if refused:
+            results_gen = _prepend_results(refused, results_gen)
+
         return crawler, results_gen, hooks_info
 
     except (UntrustedConfigError, HookValidationError) as e:
diff --git a/deploy/docker/artifacts.py b/deploy/docker/artifacts.py
index a5aac1b5a..2f53a5c5c 100644
--- a/deploy/docker/artifacts.py
+++ b/deploy/docker/artifacts.py
@@ -100,7 +100,7 @@ def resolve_artifact(artifact_id: str) -> Tuple[str, str]:
     Raises ArtifactNotFound for an invalid id, a non-regular/symlink file, a
     missing file, or an expired artifact (so existence is never revealed).
     """
-    if not isinstance(artifact_id, str) or not _HEX32.match(artifact_id):
+    if not isinstance(artifact_id, str) or not _HEX32.fullmatch(artifact_id):
         raise ArtifactNotFound()
     for ext, mime in _KIND.values():
         path = os.path.join(ARTIFACT_DIR, artifact_id + ext)
diff --git a/deploy/docker/config.yml b/deploy/docker/config.yml
index 094209899..8bf16a118 100644
--- a/deploy/docker/config.yml
+++ b/deploy/docker/config.yml
@@ -37,7 +37,7 @@ redis:
 # (the pre-hardening behavior), so you can relax or disable each one.
 limits:
   max_body_bytes: 10485760  # 10 MiB request body cap (413 if exceeded); 0 = unbounded
-  max_pages: 100            # deep-crawl page budget clamp (defense in depth)
+  max_pages: 100            # deep-crawl page budget clamp (deep crawl needs CRAWL4AI_ALLOW_DEEP_CRAWL=true); 0 = no limit
   max_depth: 5              # deep-crawl depth clamp
   wall_clock_s: 300         # per-crawl deadline in seconds (504 on timeout); 0 = no deadline
   queue:                    # background job queue for /crawl/job and /llm/job
diff --git a/deploy/docker/egress_broker.py b/deploy/docker/egress_broker.py
index 873b6a125..0729401ea 100644
--- a/deploy/docker/egress_broker.py
+++ b/deploy/docker/egress_broker.py
@@ -25,12 +25,15 @@
 from __future__ import annotations
 
 import ipaddress
+import logging
 import os
 import socket
 from dataclasses import dataclass
 from typing import List, Optional
 from urllib.parse import urlparse
 
+logger = logging.getLogger("crawl4ai.security")
+
 # Operator escape hatch for trusted internal deployments (off by default).
 ALLOW_INTERNAL = os.environ.get("CRAWL4AI_ALLOW_INTERNAL_URLS", "false").lower() == "true"
 
@@ -200,7 +203,16 @@ def enforce_egress(browser_config) -> None:
             from crawl4ai import ProxyConfig
             browser_config.proxy_config = ProxyConfig(server=_EGRESS_PROXY_URL)
         except Exception:
-            pass
+            # Fail closed: a browser_config that can't be pinned must not be
+            # allowed to crawl unpinned (that reopens DNS rebinding). Every
+            # caller of enforce_egress either runs inside a try/except that
+            # turns this into a clean 4xx/5xx response, or (app startup) is
+            # meant to abort loudly rather than serve traffic unprotected.
+            logger.error(
+                "enforce_egress: failed to set the egress pinning proxy; "
+                "refusing to crawl unpinned", exc_info=True
+            )
+            raise EgressBlocked("egress pinning unavailable")
     args = getattr(browser_config, "extra_args", None)
     if args:
         browser_config.extra_args = [
diff --git a/deploy/docker/governor.py b/deploy/docker/governor.py
index 73534e993..d9e469dcc 100644
--- a/deploy/docker/governor.py
+++ b/deploy/docker/governor.py
@@ -1,15 +1,15 @@
 """
 governor.py - server-enforced resource governance (R5).
 
-The deep-crawl DoS via a client-supplied unbounded max_pages is already closed
-upstream: R2 forbids `deep_crawl_strategy` on an untrusted request body, and the
-`urls` list is capped at 100 by the request schema. This module adds the two
-remaining verifiable chokepoints:
+R2 forbids `deep_crawl_strategy` on an untrusted request body unless the
+operator sets CRAWL4AI_ALLOW_DEEP_CRAWL=true, and the `urls` list is capped at
+100 by the request schema. This module adds the two remaining verifiable
+chokepoints:
 
   * a request body-size limit (ASGI middleware) so a giant body / inline `raw:`
     HTML cannot be buffered and processed in-process -> 413;
-  * clamp_deep_crawl(): defense in depth for any *trusted* / server-built config
-    that still carries a deep_crawl strategy with an unbounded page/depth count.
+  * clamp_deep_crawl(): bounds the page/depth budget and URL length of any
+    deep-crawl strategy, whether opted in from a request or server-built.
 
 Heavier governance (bounded work queue replacing BackgroundTasks, per-principal
 Redis quotas, wall-clock deadlines, stream decoupling) is left for the
@@ -19,11 +19,29 @@
 from __future__ import annotations
 
 import json
-import math
+import logging
+
+from crawl4ai.deep_crawling.filters import FilterChain, URLFilter
+
+logger = logging.getLogger("crawl4ai.security")
 
 DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024  # 10 MiB
 DEFAULT_MAX_PAGES = 100
 DEFAULT_MAX_DEPTH = 5
+DEFAULT_MAX_URL_LENGTH = 2048
+
+
+class URLLengthFilter(URLFilter):
+    """Reject discovered URLs too long to filter, score and cache cheaply."""
+
+    def __init__(self, max_length: int = DEFAULT_MAX_URL_LENGTH):
+        super().__init__()
+        self.max_length = max_length
+
+    def apply(self, url: str) -> bool:
+        passed = len(url) <= self.max_length
+        self._update_stats(passed)
+        return passed
 
 
 class BodySizeLimitMiddleware:
@@ -65,27 +83,45 @@ async def _reject(self, send):
 
 def clamp_deep_crawl(crawler_config, *, max_pages: int = DEFAULT_MAX_PAGES,
                      max_depth: int = DEFAULT_MAX_DEPTH) -> None:
-    """Clamp an attached deep-crawl strategy's page/depth budget in place.
+    """Clamp an attached deep-crawl strategy's page/depth budget in place and
+    put a URL-length guard first in its filter chain.
 
-    Defense in depth: untrusted bodies cannot set deep_crawl_strategy at all
-    (R2), but a server/base config might, and the library default for max_pages
-    is infinity.
+    The library default for max_pages is infinity.
     """
     dc = getattr(crawler_config, "deep_crawl_strategy", None)
     if dc is None:
         return
+    # NaN fails every comparison, so test for "inside the range", not "above the cap".
     mp = getattr(dc, "max_pages", None)
-    if mp is None or (isinstance(mp, float) and math.isinf(mp)) or mp > max_pages:
+    # max_pages=0 means no limit, like the other limits in config.yml.
+    if max_pages and (not isinstance(mp, (int, float)) or not 0 <= mp <= max_pages):
         try:
             dc.max_pages = max_pages
         except Exception:
-            pass
+            logger.warning(
+                "clamp_deep_crawl: could not clamp max_pages on %r; "
+                "deep crawl may run with an unbounded page budget", dc, exc_info=True
+            )
     md = getattr(dc, "max_depth", None)
-    if md is None or md > max_depth:
+    if not isinstance(md, (int, float)) or not 0 <= md <= max_depth:
         try:
             dc.max_depth = max_depth
         except Exception:
-            pass
+            logger.warning(
+                "clamp_deep_crawl: could not clamp max_depth on %r; "
+                "deep crawl may run with an unbounded depth budget", dc, exc_info=True
+            )
+    chain = getattr(dc, "filter_chain", None) or FilterChain()
+    dc.filter_chain = FilterChain([URLLengthFilter(), *chain.filters])
+
+
+def deep_crawl_limits(config: dict) -> dict:
+    """Deep-crawl page/depth clamps from config limits."""
+    limits = _limits(config)
+    return {
+        "max_pages": int(limits.get("max_pages", DEFAULT_MAX_PAGES)),
+        "max_depth": int(limits.get("max_depth", DEFAULT_MAX_DEPTH)),
+    }
 
 
 def max_body_bytes_from_config(config: dict) -> int:
diff --git a/deploy/docker/hook_registry.py b/deploy/docker/hook_registry.py
index c20e256db..2aada7b0c 100644
--- a/deploy/docker/hook_registry.py
+++ b/deploy/docker/hook_registry.py
@@ -72,7 +72,7 @@ def _check(cls, v):
         if len(v) > _MAX_HEADERS:
             raise ValueError(f"too many headers (max {_MAX_HEADERS})")
         for name, value in v.items():
-            if not _HEADER_NAME_RE.match(name):
+            if not _HEADER_NAME_RE.fullmatch(name):
                 raise ValueError(f"invalid header name {name!r}")
             if any(c in value for c in "\r\n\x00"):
                 raise ValueError(f"control characters in value for header {name!r}")
diff --git a/deploy/docker/mcp_bridge.py b/deploy/docker/mcp_bridge.py
index 653bc368b..24c14c628 100644
--- a/deploy/docker/mcp_bridge.py
+++ b/deploy/docker/mcp_bridge.py
@@ -247,7 +247,11 @@ async def ws_to_srv():
     class _MCPSseApp:
         async def __call__(self, scope, receive, send):
             async with sse.connect_sse(scope, receive, send) as (read_stream, write_stream):
-                await mcp.run(read_stream, write_stream, init_opts)
+                # Reorder inbound POSTs so the MCP handshake reaches the session first.
+                c2s_send, c2s_recv = anyio.create_memory_object_stream(100)
+                async with anyio.create_task_group() as tg:
+                    tg.start_soon(mcp.run, c2s_recv, write_stream, init_opts)
+                    tg.start_soon(_sse_init_gate, read_stream, c2s_send)
 
     app.routes.append(Route(f"{base}/sse", endpoint=_MCPSseApp()))
     app.routes.append(Mount(f"{base}/messages", app=sse.handle_post_message))
@@ -263,6 +267,39 @@ async def _schema_endpoint():
 
 
 # ── helpers ────────────────────────────────────────────────────
+async def _sse_init_gate(read_stream, c2s_send, timeout: float = 2.0) -> None:
+    """Park inbound SSE messages until initialize and notifications/initialized
+    have been forwarded, then flush them in arrival order.  After timeout seconds,
+    flush regardless so a client that never completes the handshake cannot pin
+    the session.
+    """
+    def rpc_method_name(m):
+        msg = getattr(m, "message", None)          # stream may carry an Exception
+        return getattr(getattr(msg, "root", msg), "method", None)  # mcp 1.x RootModel / 2.x plain union
+
+    parked, want = [], ["initialize", "notifications/initialized"]
+    try:
+        with anyio.move_on_after(timeout) as scope:
+            async for msg in read_stream:
+                if want and rpc_method_name(msg) == want[0]:
+                    await c2s_send.send(msg)
+                    want.pop(0)
+                    if not want:
+                        break
+                else:
+                    parked.append(msg)
+        if want and not scope.cancelled_caught:
+            return  # client disconnected mid-handshake; nothing to flush
+        for msg in parked:
+            await c2s_send.send(msg)
+        async for msg in read_stream:
+            await c2s_send.send(msg)
+    except (anyio.EndOfStream, anyio.ClosedResourceError):
+        pass
+    finally:
+        with anyio.CancelScope(shield=True), suppress(Exception):
+            await c2s_send.aclose()
+
 def _route_name(path: str) -> str:
     return re.sub(r"[/{}}]", "_", path).strip("_")
 
diff --git a/deploy/docker/server.py b/deploy/docker/server.py
index 248155278..0963da11d 100644
--- a/deploy/docker/server.py
+++ b/deploy/docker/server.py
@@ -102,6 +102,8 @@
 # an unprivileged user namespace (unprivileged_userns_clone=1) or a seccomp
 # profile, set CRAWL4AI_CHROMIUM_SANDBOX=true to drop --no-sandbox and run the
 # renderer sandboxed. Verify Chromium still starts after flipping it.
+# crawl4ai.browser_manager reads the same variable at launch, so the sandbox
+# also applies to browsers built from a request body, not only this config.
 CHROMIUM_SANDBOX = os.environ.get("CRAWL4AI_CHROMIUM_SANDBOX", "false").lower() == "true"
 
 # Warn loudly if API token is not set (all endpoints unauthenticated)
@@ -842,8 +844,8 @@ class CrawlResult(BaseModel):
             html: str
             success: bool
             cleaned_html: Optional[str] = None
-            media: Dict[str, List[Dict]] = {}
-            links: Dict[str, List[Dict]] = {}
+            media: Dict[str, List[Dict]] = {"images": [], "videos": [], "audios": []}
+            links: Dict[str, List[Dict]] = {"internal": [], "external": []}
             downloaded_files: Optional[List[str]] = None
             js_execution_result: Optional[Dict[str, Any]] = None
             screenshot: Optional[str] = None
@@ -1032,7 +1034,8 @@ async def stream_process(crawl_request: CrawlRequestWithHooks):
         browser_config=crawl_request.browser_config,
         crawler_config=crawl_request.crawler_config,
         config=config,
-        hooks_config=hooks_config
+        hooks_config=hooks_config,
+        crawler_configs=crawl_request.crawler_configs,
     )
     
     # Add hooks info to response headers if available
diff --git a/deploy/docker/tests/test_crawler_configs_routing.py b/deploy/docker/tests/test_crawler_configs_routing.py
new file mode 100644
index 000000000..9f5336cfa
--- /dev/null
+++ b/deploy/docker/tests/test_crawler_configs_routing.py
@@ -0,0 +1,253 @@
+"""crawler_configs must reach arun_many for one URL and on the streaming path.
+
+The per-URL config list (#1837) was only applied when a non-streaming request
+carried two or more URLs. With one URL the handler called arun(), which takes a
+single config, and /crawl/stream never passed the list down, so both requests
+ran with crawler_config alone and still answered HTTP 200.
+
+With the list applied, it also has to decide the crawler: a list of PDF entries
+runs on PDFCrawlerStrategy, and one crawler cannot serve a list mixing PDF and
+browser entries, so that is refused instead of failing mid-crawl.
+"""
+
+import asyncio
+
+import pytest
+from fastapi import HTTPException
+
+from crawl4ai import CrawlerRunConfig
+from crawl4ai.models import CrawlResult
+
+PER_URL = [
+    {
+        "type": "CrawlerRunConfig",
+        "params": {"url_matcher": "*example.com*", "word_count_threshold": 7},
+    },
+]
+
+
+class RecordingCrawler:
+    def __init__(self):
+        self.calls = []
+
+    async def arun(self, url, config=None, **kwargs):
+        self.calls.append(("arun", url, config))
+        return CrawlResult(url=url, html="", success=True)
+
+    async def arun_many(self, urls, config=None, **kwargs):
+        self.calls.append(("arun_many", urls, config))
+        return [CrawlResult(url=url, html="", success=True) for url in urls]
+
+
+def _install(monkeypatch, crawler):
+    import api
+    import crawler_pool
+
+    async def get_crawler(*args, **kwargs):
+        return crawler
+
+    async def release_crawler(*args, **kwargs):
+        return None
+
+    # Offline: the seed check resolves DNS.
+    monkeypatch.setattr(api, "validate_url_destination", lambda url: None)
+    monkeypatch.setattr(crawler_pool, "get_crawler", get_crawler)
+    monkeypatch.setattr(crawler_pool, "release_crawler", release_crawler)
+    return api
+
+
+def test_single_url_uses_the_config_list(server_module, monkeypatch):
+    crawler = RecordingCrawler()
+    api = _install(monkeypatch, crawler)
+
+    asyncio.run(
+        api.handle_crawl_request(
+            urls=["https://example.com/"],
+            browser_config={},
+            crawler_config={},
+            config=server_module.config,
+            crawler_configs=PER_URL,
+        )
+    )
+
+    [(method, urls, config)] = crawler.calls
+    assert method == "arun_many"
+    assert urls == ["https://example.com/"]
+    assert [c.word_count_threshold for c in config] == [7]
+
+
+def test_single_url_without_a_list_still_uses_arun(server_module, monkeypatch):
+    crawler = RecordingCrawler()
+    api = _install(monkeypatch, crawler)
+
+    asyncio.run(
+        api.handle_crawl_request(
+            urls=["https://example.com/"],
+            browser_config={},
+            crawler_config={},
+            config=server_module.config,
+        )
+    )
+
+    [(method, url, config)] = crawler.calls
+    assert method == "arun"
+    assert url == "https://example.com/"
+    assert isinstance(config, CrawlerRunConfig)
+
+
+def test_stream_passes_the_config_list(server_module, monkeypatch):
+    crawler = RecordingCrawler()
+    api = _install(monkeypatch, crawler)
+
+    asyncio.run(
+        api.handle_stream_crawl_request(
+            urls=["https://example.com/", "https://example.org/"],
+            browser_config={},
+            crawler_config={},
+            config=server_module.config,
+            crawler_configs=PER_URL,
+        )
+    )
+
+    [(method, urls, config)] = crawler.calls
+    assert method == "arun_many"
+    assert [c.word_count_threshold for c in config] == [7]
+    # arun_many takes the stream flag from the first config of a list.
+    assert all(c.stream for c in config)
+
+
+@pytest.mark.parametrize("stream", [False, True])
+def test_base_config_fills_the_list_on_both_paths(server_module, monkeypatch, stream):
+    """/crawl and /crawl/stream give the list the same server defaults."""
+    crawler = RecordingCrawler()
+    api = _install(monkeypatch, crawler)
+    config = {
+        **server_module.config,
+        "crawler": {
+            **server_module.config["crawler"],
+            "base_config": {"css_selector": "main"},
+        },
+    }
+    handler = api.handle_stream_crawl_request if stream else api.handle_crawl_request
+
+    asyncio.run(
+        handler(
+            urls=["https://example.com/", "https://example.org/"],
+            browser_config={},
+            crawler_config={},
+            config=config,
+            crawler_configs=[
+                {
+                    "type": "CrawlerRunConfig",
+                    "params": {"url_matcher": "*example.com*"},
+                },
+                {
+                    "type": "CrawlerRunConfig",
+                    "params": {"url_matcher": "*", "css_selector": "#own"},
+                },
+            ],
+        )
+    )
+
+    [(method, urls, configs)] = crawler.calls
+    assert method == "arun_many"
+    # An entry that leaves the field unset gets base_config's value; one that
+    # sets it keeps its own.
+    assert [c.css_selector for c in configs] == ["main", "#own"]
+
+
+def test_stream_endpoint_forwards_the_list(server_module, monkeypatch):
+    captured = {}
+
+    async def fake_handle_stream(**kwargs):
+        captured.update(kwargs)
+        raise RuntimeError("stop after capture")
+
+    monkeypatch.setattr(
+        server_module, "handle_stream_crawl_request", fake_handle_stream
+    )
+    request = server_module.CrawlRequestWithHooks(
+        urls=["https://example.com/"], crawler_configs=PER_URL
+    )
+
+    try:
+        asyncio.run(server_module.stream_process(crawl_request=request))
+    except RuntimeError:
+        pass
+
+    assert captured["crawler_configs"] == PER_URL
+
+
+PDF = {"type": "PDFContentScrapingStrategy", "params": {}}
+ALL_PDF = [
+    {
+        "type": "CrawlerRunConfig",
+        "params": {"url_matcher": "*.pdf", "scraping_strategy": PDF},
+    },
+]
+MIXED = ALL_PDF + [{"type": "CrawlerRunConfig", "params": {"url_matcher": "*"}}]
+
+
+class RecordingPdfCrawler(RecordingCrawler):
+    """Stands in for AsyncWebCrawler(crawler_strategy=PDFCrawlerStrategy())."""
+
+    def __init__(self, crawler_strategy=None, **kwargs):
+        super().__init__()
+        self.crawler_strategy = crawler_strategy
+
+    async def start(self):
+        return self
+
+    async def close(self):
+        return None
+
+
+def test_a_list_of_pdf_entries_runs_on_the_pdf_crawler(server_module, monkeypatch):
+    from crawl4ai.processors.pdf import PDFCrawlerStrategy
+
+    api = _install(monkeypatch, RecordingCrawler())
+    made = []
+
+    def pdf_crawler(**kwargs):
+        made.append(RecordingPdfCrawler(**kwargs))
+        return made[-1]
+
+    monkeypatch.setattr(api, "AsyncWebCrawler", pdf_crawler)
+
+    asyncio.run(
+        api.handle_crawl_request(
+            urls=["https://example.com/a.pdf"],
+            browser_config={},
+            crawler_config={},
+            config=server_module.config,
+            crawler_configs=ALL_PDF,
+        )
+    )
+
+    [crawler] = made
+    assert isinstance(crawler.crawler_strategy, PDFCrawlerStrategy)
+    [(method, urls, config)] = crawler.calls
+    assert method == "arun_many"
+    # SSRF: every per-URL PDF entry still gets the destination check.
+    assert config[0].scraping_strategy.url_validator is api.validate_url_destination
+
+
+@pytest.mark.parametrize("stream", [False, True])
+def test_a_list_mixing_pdf_and_browser_entries_is_refused(
+    server_module, monkeypatch, stream
+):
+    api = _install(monkeypatch, RecordingCrawler())
+    handler = api.handle_stream_crawl_request if stream else api.handle_crawl_request
+
+    with pytest.raises(HTTPException) as refused:
+        asyncio.run(
+            handler(
+                urls=["https://example.com/a.pdf", "https://example.com/"],
+                browser_config={},
+                crawler_config={},
+                config=server_module.config,
+                crawler_configs=MIXED,
+            )
+        )
+
+    assert refused.value.status_code == 400
diff --git a/deploy/docker/tests/test_playground_config_protocol.py b/deploy/docker/tests/test_playground_config_protocol.py
index 926b113d4..d71529de1 100644
--- a/deploy/docker/tests/test_playground_config_protocol.py
+++ b/deploy/docker/tests/test_playground_config_protocol.py
@@ -90,7 +90,11 @@ def test_every_template_field_reaches_the_config_object(self):
                 obj = CONFIG_CLASSES[name].load(
                     {"type": name, "params": params}, provenance=Provenance.UNTRUSTED
                 )
-                applied = {key: getattr(obj, key) for key in params}
+                # Enum fields (cache_mode) come back as the enum; compare by value.
+                applied = {
+                    key: getattr(getattr(obj, key), "value", getattr(obj, key))
+                    for key in params
+                }
                 self.assertEqual(applied, params)
 
     def test_stream_reaches_the_shape_should_use_stream_reads(self):
diff --git a/deploy/docker/tests/test_security_default_posture.py b/deploy/docker/tests/test_security_default_posture.py
index 96c50afa9..1f4b14820 100644
--- a/deploy/docker/tests/test_security_default_posture.py
+++ b/deploy/docker/tests/test_security_default_posture.py
@@ -162,10 +162,23 @@ def test_no_no_sandbox_flag(self, effective_browser_args):
             "default config launches Chromium with --no-sandbox"
         )
 
-    def test_tls_verification_not_disabled(self, effective_browser_args):
-        """TLS verification must not be disabled by default."""
-        assert "--ignore-certificate-errors" not in effective_browser_args
-        assert "--allow-insecure-localhost" not in effective_browser_args
+    def test_tls_verification_not_disabled(self, effective_browser_args, server_module):
+        """TLS verification must not be disabled by default.
+
+        Checks the flags Chromium is really launched with, not only
+        config.yml: the library adds its own launch flags on every path."""
+        from crawl4ai import BrowserConfig
+        from crawl4ai.browser_manager import BrowserManager, ManagedBrowser
+
+        for bc in (server_module.get_default_browser_config(), BrowserConfig()):
+            launched = (
+                list(effective_browser_args)
+                + BrowserManager(browser_config=bc)._build_browser_args()["args"]
+                + ManagedBrowser.build_browser_flags(bc)
+            )
+            assert "--ignore-certificate-errors" not in launched
+            assert "--ignore-certificate-errors-spki-list" not in launched
+            assert "--allow-insecure-localhost" not in launched
 
     # ───────────────────────── R7: deploy posture ─────────────────────────
 
diff --git a/deploy/docker/tests/test_security_hardening_2026_10.py b/deploy/docker/tests/test_security_hardening_2026_10.py
new file mode 100644
index 000000000..1ba738fa4
--- /dev/null
+++ b/deploy/docker/tests/test_security_hardening_2026_10.py
@@ -0,0 +1,103 @@
+"""
+2026-10 hardening regression tests.
+
+A) Header-name validators used `.match` against a `^...$` pattern. In Python,
+`$` also matches just before a trailing "\n", so "X-Injected\n" passed
+validation (not exploitable today since aiohttp/Chromium reject it later, but
+the validator itself must reject it). Fixed by switching to `.fullmatch`.
+
+B) `governor.clamp_deep_crawl` and `egress_broker.enforce_egress` silently
+swallowed exceptions from hardening guards (`except Exception: pass`). Fixed
+to log a warning (governor) and to fail closed with EgressBlocked (the egress
+pinning proxy - crawling unpinned would reopen DNS rebinding).
+"""
+
+import logging
+
+import pytest
+
+pytestmark = pytest.mark.posture
+
+
+class TestHeaderNameTrailingNewline:
+    def test_hook_registry_rejects_trailing_newline(self):
+        from hook_registry import SetHeadersParams
+
+        with pytest.raises(Exception):
+            SetHeadersParams(headers={"X-Injected\n": "v"})
+
+    def test_hook_registry_accepts_normal_name(self):
+        from hook_registry import SetHeadersParams
+
+        p = SetHeadersParams(headers={"X-Injected": "v"})
+        assert p.headers == {"X-Injected": "v"}
+
+    def test_webhook_rejects_trailing_newline(self):
+        from webhook import sanitize_webhook_headers
+
+        with pytest.raises(ValueError):
+            sanitize_webhook_headers({"X-Custom\n": "v"})
+
+    def test_webhook_accepts_normal_name(self):
+        from webhook import sanitize_webhook_headers
+
+        clean = sanitize_webhook_headers({"X-Custom": "v"})
+        assert clean == {"X-Custom": "v"}
+
+
+class _RaisingDeepCrawl:
+    """Stand-in whose attribute assignment always raises, to exercise the
+    except branch in clamp_deep_crawl without needing a real strategy."""
+
+    max_pages = None
+    max_depth = None
+
+    def __setattr__(self, name, value):
+        if name in ("max_pages", "max_depth"):
+            raise RuntimeError("cannot set attribute")
+        object.__setattr__(self, name, value)
+
+
+class _RaisingConfig:
+    deep_crawl_strategy = _RaisingDeepCrawl()
+
+
+class TestClampDeepCrawlLogsOnFailure(object):
+    def test_logs_warning_when_clamp_fails(self, caplog):
+        from governor import clamp_deep_crawl
+
+        with caplog.at_level(logging.WARNING, logger="crawl4ai.security"):
+            clamp_deep_crawl(_RaisingConfig())
+
+        assert any("clamp_deep_crawl" in r.message for r in caplog.records)
+
+
+class _RaisingBrowserConfig:
+    """hasattr(obj, 'proxy_config') must be True so enforce_egress attempts
+    to set the pinning proxy; the setter then raises."""
+
+    ignore_https_errors = True
+    proxy = None
+    extra_args = None
+
+    @property
+    def proxy_config(self):
+        return None
+
+    @proxy_config.setter
+    def proxy_config(self, value):
+        raise RuntimeError("cannot set proxy_config")
+
+
+class TestEnforceEgressFailsClosed:
+    def test_raises_when_pinning_proxy_cannot_be_set(self, monkeypatch, caplog):
+        import egress_broker
+
+        monkeypatch.setattr(egress_broker, "_EGRESS_PROXY_URL", "http://127.0.0.1:1")
+        try:
+            with caplog.at_level(logging.ERROR, logger="crawl4ai.security"):
+                with pytest.raises(egress_broker.EgressBlocked):
+                    egress_broker.enforce_egress(_RaisingBrowserConfig())
+            assert any("enforce_egress" in r.message for r in caplog.records)
+        finally:
+            monkeypatch.setattr(egress_broker, "_EGRESS_PROXY_URL", None)
diff --git a/deploy/docker/tests/test_security_resource_caps.py b/deploy/docker/tests/test_security_resource_caps.py
index 6cf4f0385..f20d32157 100644
--- a/deploy/docker/tests/test_security_resource_caps.py
+++ b/deploy/docker/tests/test_security_resource_caps.py
@@ -49,6 +49,34 @@ def test_no_deep_crawl_is_noop(self):
         clamp_deep_crawl(cfg)  # must not raise
         assert cfg.deep_crawl_strategy is None
 
+    def test_nan_limits_clamped(self):
+        from governor import clamp_deep_crawl
+        from crawl4ai.deep_crawling import BFSDeepCrawlStrategy
+        from crawl4ai import CrawlerRunConfig
+        nan = float("nan")
+        cfg = CrawlerRunConfig(deep_crawl_strategy=BFSDeepCrawlStrategy(max_depth=nan, max_pages=nan))
+        clamp_deep_crawl(cfg)
+        assert (cfg.deep_crawl_strategy.max_pages, cfg.deep_crawl_strategy.max_depth) == (100, 5)
+
+    def test_url_length_guard_added_even_without_filter_chain(self):
+        from governor import URLLengthFilter, clamp_deep_crawl
+        from crawl4ai.deep_crawling import BFSDeepCrawlStrategy
+        from crawl4ai import CrawlerRunConfig
+        cfg = CrawlerRunConfig(deep_crawl_strategy=BFSDeepCrawlStrategy(max_depth=1, filter_chain=None))
+        clamp_deep_crawl(cfg)
+        guard = cfg.deep_crawl_strategy.filter_chain.filters[0]
+        assert isinstance(guard, URLLengthFilter)
+        assert not guard.apply("https://a.com/" + "x" * 3000)
+        assert guard.apply("https://a.com/blog/post")
+
+    def test_zero_max_pages_means_no_limit(self):
+        from governor import clamp_deep_crawl
+        from crawl4ai.deep_crawling import BFSDeepCrawlStrategy
+        from crawl4ai import CrawlerRunConfig
+        cfg = CrawlerRunConfig(deep_crawl_strategy=BFSDeepCrawlStrategy(max_depth=2))
+        clamp_deep_crawl(cfg, max_pages=0)
+        assert cfg.deep_crawl_strategy.max_pages == float("inf")
+
 
 class TestUntrustedDeepCrawlStillForbidden:
     def test_request_cannot_set_deep_crawl(self):
diff --git a/deploy/docker/tests/test_security_ssrf_seeder.py b/deploy/docker/tests/test_security_ssrf_seeder.py
index b0a83eff1..86144b3cb 100644
--- a/deploy/docker/tests/test_security_ssrf_seeder.py
+++ b/deploy/docker/tests/test_security_ssrf_seeder.py
@@ -23,7 +23,8 @@
 
 from crawl4ai import egress_policy
 from crawl4ai.async_url_seeder import AsyncUrlSeeder
-from crawl4ai.utils import RobotsParser
+from crawl4ai.cache_validator import CacheValidationResult, CacheValidator
+from crawl4ai.utils import RobotsParser, compute_head_fingerprint
 
 pytestmark = pytest.mark.posture
 
@@ -231,3 +232,79 @@ async def public(req):
             await proxy.stop()
             await prunner.cleanup()
             await irunner.cleanup()
+
+
+@pytest.mark.asyncio
+class TestCacheValidatorEgress:
+    """check_cache_freshness is untrusted-allowlisted, so validate() fetches the
+    caller's crawl URL: HEAD with the stored validators, then a streamed GET."""
+
+    async def test_validator_direct_loopback_is_blocked(self):
+        hits = []
+
+        async def internal(req):
+            hits.append(req.path)
+            return web.Response(text=INTERNAL_PAGE, content_type="text/html")
+
+        runner, port = await _serve(internal)
+        proxy = await _start_proxy()
+        try:
+            async with CacheValidator(timeout=5) as v:
+                await v.validate(
+                    f"http://127.0.0.1:{port}/", stored_etag='"x"',
+                    stored_head_fingerprint="abc",
+                )
+            assert hits == [], "the internal service was reached"
+        finally:
+            await proxy.stop()
+            await runner.cleanup()
+
+    async def test_validator_redirect_into_internal_is_blocked(self, monkeypatch):
+        hits = []
+
+        async def internal(req):
+            hits.append(req.path)
+            return web.Response(text=INTERNAL_PAGE, content_type="text/html")
+
+        irunner, iport = await _serve(internal)
+
+        async def public(req):
+            raise web.HTTPFound(f"http://127.0.0.1:{iport}/secret")
+
+        prunner, pport = await _serve(public)
+        _treat_port_as_public(monkeypatch, pport)
+
+        proxy = await _start_proxy()
+        try:
+            async with CacheValidator(timeout=5) as v:
+                await v.validate(
+                    f"http://127.0.0.1:{pport}/page", stored_etag='"x"',
+                    stored_head_fingerprint="abc",
+                )
+            assert hits == [], "the redirect reached the internal service"
+        finally:
+            await proxy.stop()
+            await prunner.cleanup()
+            await irunner.cleanup()
+
+    async def test_validator_public_host_still_works(self, monkeypatch):
+        """The fix must not simply block everything."""
+        page = '<html><head><title>PUBLIC-OK</title></head><body>x</body></html>'
+
+        async def public(req):
+            return web.Response(text=page, content_type="text/html")
+
+        runner, port = await _serve(public)
+        _treat_port_as_public(monkeypatch, port)
+
+        proxy = await _start_proxy()
+        try:
+            async with CacheValidator(timeout=5) as v:
+                r = await v.validate(
+                    f"http://127.0.0.1:{port}/page",
+                    stored_head_fingerprint=compute_head_fingerprint(page),
+                )
+            assert r.status == CacheValidationResult.FRESH
+        finally:
+            await proxy.stop()
+            await runner.cleanup()
diff --git a/deploy/docker/tests/test_seed_refusal.py b/deploy/docker/tests/test_seed_refusal.py
new file mode 100644
index 000000000..e9d398fd9
--- /dev/null
+++ b/deploy/docker/tests/test_seed_refusal.py
@@ -0,0 +1,81 @@
+"""#2288: one refused seed must not sink the whole /crawl or /crawl/stream batch."""
+import json
+
+import pytest
+from fastapi import HTTPException
+
+from crawl4ai import CrawlResult
+
+GOOD = "https://example.com/"
+BAD = "https://no-such-host.example/"
+
+
+@pytest.fixture
+def crawled(monkeypatch):
+    """Refuse BAD, fake the crawler, and record which URLs reached it."""
+    import api
+    import crawler_pool
+
+    seen = []
+
+    def validate(url):
+        if url == BAD:
+            raise HTTPException(400, "URL blocked (SSRF protection): URL blocked")
+
+    class FakeCrawler:
+        async def arun(self, url, **kwargs):
+            seen.append(url)
+            return CrawlResult(url=url, html="ok", success=True)
+
+        async def arun_many(self, urls, config=None, **kwargs):
+            seen.extend(urls)
+            results = [CrawlResult(url=u, html="ok", success=True) for u in urls]
+            if not config.stream:
+                return results
+
+            async def gen():
+                for r in results:
+                    yield r
+            return gen()
+
+    async def get_crawler(*args, **kwargs):
+        return FakeCrawler()
+
+    async def release_crawler(*args, **kwargs):
+        return None
+
+    monkeypatch.setattr(api, "validate_url_destination", validate)
+    monkeypatch.setattr(crawler_pool, "get_crawler", get_crawler)
+    monkeypatch.setattr(crawler_pool, "release_crawler", release_crawler)
+    return seen
+
+
+def _auth():
+    from auth import create_access_token
+    return {"Authorization": f"Bearer {create_access_token({'sub': 'u@x.com'})}"}
+
+
+def test_batch_crawls_allowed_seeds_and_reports_refused(stock_client, crawled):
+    r = stock_client.post("/crawl", json={"urls": [GOOD, BAD]}, headers=_auth())
+    assert r.status_code == 200, r.text
+    by_url = {res["url"]: res for res in r.json()["results"]}
+    assert by_url[GOOD]["success"] is True
+    assert by_url[BAD]["success"] is False
+    assert by_url[BAD]["error_message"] == "URL blocked (SSRF protection): URL blocked"
+    assert crawled == [GOOD]
+
+
+def test_stream_crawls_allowed_seeds_and_reports_refused(stock_client, crawled):
+    r = stock_client.post("/crawl/stream", json={"urls": [GOOD, BAD, GOOD]}, headers=_auth())
+    assert r.status_code == 200, r.text
+    lines = [json.loads(line) for line in r.text.splitlines() if line]
+    results = [l for l in lines if "url" in l]
+    assert [(l["url"], l["success"]) for l in results] == [(BAD, False), (GOOD, True), (GOOD, True)]
+    assert crawled == [GOOD, GOOD]
+
+
+@pytest.mark.parametrize("path", ["/crawl", "/crawl/stream"])
+def test_all_refused_is_still_400(stock_client, crawled, path):
+    r = stock_client.post(path, json={"urls": [BAD, BAD]}, headers=_auth())
+    assert r.status_code == 400
+    assert crawled == []
diff --git a/deploy/docker/utils.py b/deploy/docker/utils.py
index 0fc2e69c0..b1cb709bd 100644
--- a/deploy/docker/utils.py
+++ b/deploy/docker/utils.py
@@ -72,8 +72,6 @@ class FilterType(str, Enum):
                 "--disable-dev-shm-usage",
                 "--disable-gpu",
                 "--disable-software-rasterizer",
-                "--allow-insecure-localhost",
-                "--ignore-certificate-errors",
             ],
         },
     },
diff --git a/deploy/docker/webhook.py b/deploy/docker/webhook.py
index a05e6e40e..4b233f41f 100644
--- a/deploy/docker/webhook.py
+++ b/deploy/docker/webhook.py
@@ -68,7 +68,7 @@ def sanitize_webhook_headers(headers: Optional[Dict[str, str]]) -> Dict[str, str
         raise ValueError("too many webhook headers")
     clean: Dict[str, str] = {}
     for name, value in headers.items():
-        if not isinstance(name, str) or not _WEBHOOK_HEADER_NAME.match(name):
+        if not isinstance(name, str) or not _WEBHOOK_HEADER_NAME.fullmatch(name):
             raise ValueError(f"invalid webhook header name: {name!r}")
         if name.lower() in _WEBHOOK_DENY_HEADERS:
             raise ValueError(f"webhook header not allowed: {name}")
diff --git a/docker-compose.yml b/docker-compose.yml
index 02cbe0584..a0a7aa9af 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,6 +9,8 @@ x-base-config: &base-config
   environment:
     # Auth token passthrough from the host shell (overwrites .llm.env).
     - CRAWL4AI_API_TOKEN=${CRAWL4AI_API_TOKEN:-}
+    # Deep crawling over the API (off unless set to true in the shell or .env).
+    - CRAWL4AI_ALLOW_DEEP_CRAWL=${CRAWL4AI_ALLOW_DEEP_CRAWL:-false}
     # Uncomment to set default environment variables (will overwrite .llm.env)
     # - OPENAI_API_KEY=${OPENAI_API_KEY:-}
     # - DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY:-}
diff --git a/docs/apps/linkdin/templates/graph_view_template.html b/docs/apps/linkdin/templates/graph_view_template.html
index 9d908d8fc..84cb02589 100644
--- a/docs/apps/linkdin/templates/graph_view_template.html
+++ b/docs/apps/linkdin/templates/graph_view_template.html
@@ -9,6 +9,7 @@
     <!-- our tiny OpenAI wrapper -->
     <script src="ai.js"></script>
     <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.1.6/purify.min.js"></script>
     <script src="https://cdnjs.cloudflare.com/ajax/libs/split.js/1.6.5/split.min.js"></script>
     <link href="https://unpkg.com/vis-network@9.1.2/dist/vis-network.min.css" rel="stylesheet" />
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css" />
@@ -252,6 +253,18 @@ <h3 class="text-lg font-semibold mb-2">Organization Details</h3>
     <script>
         // Check localStorage first, otherwise fetch default data
         let data;
+
+        // Escape text before it goes into an innerHTML template (crawled data is untrusted)
+        function esc(s) {
+            return String(s ?? '').replace(/[&<>"']/g, c => ({
+                '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+            }[c]))
+        }
+        // Only allow http(s) URLs for src/href (escaped for the attribute), otherwise a harmless value
+        function safeUrl(u) {
+            return typeof u === 'string' && /^https?:\/\//i.test(u) ? esc(u) : '#'
+        }
+
         // Toast notification function
         function showToast(message, duration = 3000) {
             const toast = document.getElementById('toast');
@@ -499,16 +512,16 @@ <h3 class="text-lg font-semibold mb-2">Organization Details</h3>
                 li.className = 'p-3 rounded bg-neutral-800 hover:bg-neutral-700 border border-neutral-700 transition-colors'
                 li.innerHTML = `
                         <div class="flex justify-between items-start mb-1">
-                            <h3 class="font-semibold text-blue-400 cursor-pointer">${n.name}</h3>
-                            <span class="px-2 py-0.5 bg-neutral-700 rounded-full text-xs">${n.industry || 'N/A'}</span>
+                            <h3 class="font-semibold text-blue-400 cursor-pointer">${esc(n.name)}</h3>
+                            <span class="px-2 py-0.5 bg-neutral-700 rounded-full text-xs">${esc(n.industry || 'N/A')}</span>
                         </div>
-                        <p class="text-xs text-neutral-300 mb-2">${n.about || 'No description available'}</p>
+                        <p class="text-xs text-neutral-300 mb-2">${esc(n.about || 'No description available')}</p>
                         <div class="flex justify-between items-center text-xs">
                             <div class="flex items-center">
                                 <i class="fa fa-users mr-1 text-neutral-400"></i>
                                 <span>${n.followers?.toLocaleString() || '0'} followers</span>
                             </div>
-                            <a href="https://www.linkedin.com${n.handle}" target="_blank" class="text-emerald-400 hover:text-emerald-300">
+                            <a href="https://www.linkedin.com${esc(n.handle || '')}" target="_blank" class="text-emerald-400 hover:text-emerald-300">
                                 <i class="fab fa-linkedin mr-1"></i>View on LinkedIn
                             </a>
                         </div>
@@ -593,7 +606,7 @@ <h3 class="text-lg font-semibold mb-2">Organization Chart Not Found</h3>
                 pane.innerHTML = `
   <div class="p-4 border-b border-neutral-700 bg-neutral-800">
     <div class="flex justify-between items-center">
-      <h2 class="font-semibold text-lg text-blue-400">${companyName}</h2>
+      <h2 class="font-semibold text-lg text-blue-400">${esc(companyName)}</h2>
       <span class="px-2 py-1 bg-neutral-700 rounded-full text-xs">${employeeCount} employees</span>
     </div>
   </div>
@@ -607,12 +620,12 @@ <h3 class="font-semibold">Decision Makers</h3>
        ${decisionMakers.map(n => `
          <li class="p-2 rounded bg-neutral-700 hover:bg-neutral-600 transition-colors flex justify-between items-center">
            <div>
-             <div class="font-medium">${n.name}</div>
-             <div class="text-xs text-neutral-300">${n.title}</div>
+             <div class="font-medium">${esc(n.name)}</div>
+             <div class="text-xs text-neutral-300">${esc(n.title)}</div>
            </div>
            <div class="flex items-center gap-2">
              <span class="text-xs px-2 py-0.5 rounded-full" style="background-color:${colorForScore(n.decision_score)}">${(n.decision_score * 100).toFixed(0)}%</span>
-             <a href="${n.profile_url}" target="_blank" class="text-emerald-400 hover:text-emerald-300 text-xs">
+             <a href="${safeUrl(n.profile_url)}" target="_blank" class="text-emerald-400 hover:text-emerald-300 text-xs">
                <i class="fab fa-linkedin"></i>
              </a>
            </div>
@@ -721,41 +734,41 @@ <h3 class="font-semibold">Decision Makers</h3>
                 box.innerHTML = `
                     <div class="bg-neutral-800 rounded-lg p-4">
                       <div class="flex items-start space-x-3">
-                        <img src="${p.avatar_url || 'https://ui-avatars.com/api/?name=' + encodeURIComponent(p.name)}" 
+                        <img src="${p.avatar_url ? safeUrl(p.avatar_url) : 'https://ui-avatars.com/api/?name=' + encodeURIComponent(p.name)}"
                              class="h-16 w-16 rounded-full object-cover border-2 border-neutral-700"/>
                         <div class="flex-1">
                           <div class="flex justify-between items-start">
                             <div>
-                              <div class="font-semibold text-lg">${p.name}</div>
-                              <div class="text-neutral-300 text-sm">${p.title || 'Employee'}</div>
+                              <div class="font-semibold text-lg">${esc(p.name)}</div>
+                              <div class="text-neutral-300 text-sm">${esc(p.title || 'Employee')}</div>
                             </div>
-                            <span class="px-2 py-1 rounded-full text-sm font-medium" 
+                            <span class="px-2 py-1 rounded-full text-sm font-medium"
                                   style="background-color:${scoreColor}">
                               ${scorePercentage}% influence
                             </span>
                           </div>
-                          
+
                           <div class="mt-3 grid grid-cols-2 gap-2 text-xs text-neutral-300">
                             <div class="flex items-center">
                               <i class="fas fa-sitemap w-5 text-neutral-500"></i>
-                              <span class="ml-1">${p.dept || 'Department not specified'}</span>
+                              <span class="ml-1">${esc(p.dept || 'Department not specified')}</span>
                             </div>
                             <div class="flex items-center">
                               <i class="fas fa-calendar-alt w-5 text-neutral-500"></i>
-                              <span class="ml-1">${p.yoe_current || '?'} years at company</span>
+                              <span class="ml-1">${esc(p.yoe_current || '?')} years at company</span>
                             </div>
                             <div class="flex items-center">
                               <i class="fas fa-briefcase w-5 text-neutral-500"></i>
-                              <span class="ml-1">${p.title_level || 'Level not specified'}</span>
+                              <span class="ml-1">${esc(p.title_level || 'Level not specified')}</span>
                             </div>
                             <div class="flex items-center">
                               <i class="fas fa-user-friends w-5 text-neutral-500"></i>
-                              <span class="ml-1">${p.connection_count || '?'} connections</span>
+                              <span class="ml-1">${esc(p.connection_count || '?')} connections</span>
                             </div>
                           </div>
-                          
+
                           <div class="mt-3 flex justify-end">
-                            <a href="${p.id}" target="_blank" 
+                            <a href="${safeUrl(p.id)}" target="_blank"
                                class="bg-emerald-800 hover:bg-emerald-700 text-emerald-100 px-3 py-1 rounded text-xs flex items-center transition-colors">
                               <i class="fab fa-linkedin mr-1"></i> View on LinkedIn
                             </a>
@@ -841,7 +854,7 @@ <h3 class="font-semibold">Decision Makers</h3>
                 let el = chatBody.lastElementChild
                 if (streaming && el && el.dataset.sender === sender) {
                     // Just append raw text for streaming mode
-                    el.lastChild.innerHTML += text.replace(/\n/g, "<br>")
+                    el.lastChild.innerHTML += esc(text).replace(/\n/g, "<br>")
                 } else {
                     el = document.createElement('div')
                     el.className = 'chat-message'
@@ -856,8 +869,8 @@ <h3 class="font-semibold">Decision Makers</h3>
                     const contentEl = document.createElement('div')
                     contentEl.className = 'ml-1 mt-1'
 
-                    // Apply markdown parsing
-                    contentEl.innerHTML = marked.parse(text)
+                    // Apply markdown parsing (sanitized, since the AI reply can echo back crawled text)
+                    contentEl.innerHTML = DOMPurify.sanitize(marked.parse(text))
 
                     // Style markdown elements
                     const style = document.createElement('style')
@@ -1115,13 +1128,13 @@ <h3 class="font-semibold">Decision Makers</h3>
                     const graphInfoContent = document.getElementById('graphInfoContent');
 
                     graphInfoContent.innerHTML = `
-                            <div class="font-semibold text-neutral-200">${node.name}</div>
-                            <div class="text-neutral-400">${node.industry || 'Industry: N/A'}</div>
+                            <div class="font-semibold text-neutral-200">${esc(node.name)}</div>
+                            <div class="text-neutral-400">${esc(node.industry || 'Industry: N/A')}</div>
                             <div class="flex items-center mt-1">
                                 <i class="fas fa-users mr-1 text-blue-400"></i>
                                 <span>${node.followers?.toLocaleString() || '0'} followers</span>
                             </div>
-                            <div class="mt-1">${node.about || ''}</div>
+                            <div class="mt-1">${esc(node.about || '')}</div>
                         `;
 
                     graphInfo.classList.remove('hidden');
diff --git a/docs/blog/release-v0.9.5.md b/docs/blog/release-v0.9.5.md
new file mode 100644
index 000000000..cadffe449
--- /dev/null
+++ b/docs/blog/release-v0.9.5.md
@@ -0,0 +1,147 @@
+# Crawl4AI v0.9.5: Security Release and Opt-in Deep Crawling on Docker
+
+*October 2026 - 4 min read*
+
+---
+
+I'm releasing Crawl4AI v0.9.5. It closes six coordinated-disclosure advisories, adds opt-in deep crawling to the Docker server, and ships the bug fixes that landed on `develop` since 0.9.4.
+
+All six advisories are in the same place: what the Docker server lets an untrusted request body do. Since 0.9.0 the server refuses `js_code`, refuses dangerous config types, and sends every fetch through one pinning egress proxy. This release closes the gaps where an allowed field still reached one of those sinks: one more HTTP client outside the proxy, two fields that reached page JavaScript, a model name, caller-supplied regexes, delay fields with no ceiling, and a Chromium flag that turned TLS verification off.
+
+If you self-host the Docker server, upgrade.
+
+## What's new at a glance
+
+- **SSRF via the cache freshness check**: `check_cache_freshness` sent requests outside the egress proxy
+- **Page JavaScript injection**: `css_selector` and `wait_for` could run script in the crawl page
+- **Caller-chosen model**: `CosineStrategy.model_name` let a client pick the HuggingFace weights the server loads
+- **ReDoS**: one bad regex could freeze the whole server
+- **Unbounded delays**: one request could hold a browser page for as long as it liked
+- **TLS off in Chromium**: `--ignore-certificate-errors` was in the default launch flags
+- **Opt-in deep crawling on Docker**: `CRAWL4AI_ALLOW_DEEP_CRAWL=true`
+- **Bug fixes**: deep crawl budgets, `<noscript>` pages, proxies with special characters, the CLI, and the Docker server
+
+## Security fixes
+
+### Blind SSRF via the cache freshness check
+
+**GHSA-w4xc-px5p-c32w, CWE-918, medium.** Credit: [arpe1618](https://github.com/arpe1618).
+
+`check_cache_freshness` is allowed in an untrusted body. `CacheValidator` built its own `httpx` client without the egress proxy, so a client could make the server send HEAD and GET requests to internal addresses, directly or through a redirect. This is the same root cause as the robots.txt and seeder fixes in 0.9.4: one more library HTTP client without `proxy=proxy_url()`. It now uses the proxy. A plain library caller sees no change.
+
+### Page JavaScript injection via css_selector and wait_for
+
+**GHSA-qj46-wp7m-rgj8, CWE-95, medium.** Credit: Zhixi "Jace" Sun ([manus-use](https://github.com/manus-use)).
+
+Untrusted bodies may not send `js_code`. But two allowed fields reached the same `page.evaluate()` sink:
+
+1. `_crawl_web` pasted each `css_selector` part into a JavaScript string. A `"` ended the string, and the rest ran as script.
+2. `smart_wait` runs a `wait_for` as JavaScript when it starts with `js:`, looks like a function, or is not a valid selector.
+
+`css_selector` is now passed to the page as an argument, which also makes selectors with quotes such as `p[title="x"]` work. For untrusted bodies, JavaScript `wait_for` values are refused, and a bare value is always treated as a CSS selector.
+
+### Caller-chosen HuggingFace model in CosineStrategy
+
+**GHSA-f856-7xp9-w3cc, CWE-502, high.** Credit: Zhixi "Jace" Sun ([manus-use](https://github.com/manus-use)).
+
+`CosineStrategy` is allowed in an untrusted body, and its `model_name` was not filtered. The server passed it to `from_pretrained()`, so a client chose which repository the server downloaded and loaded. With PyTorch older than 2.6, a crafted pickle weight file runs code in the server process. With current PyTorch the code does not run, but the client still controls what the server downloads and keeps in memory.
+
+`model_name` is now refused from untrusted bodies. The default image does not install PyTorch or transformers and is not affected.
+
+### ReDoS via caller-supplied regexes
+
+**GHSA-j843-8p47-rhxp, CWE-1333, medium.** Credit: Zhixi "Jace" Sun ([manus-use](https://github.com/manus-use)).
+
+`RegexExtractionStrategy.custom`, `RegexChunking.patterns`, and `"type": "regex"` fields in extraction schemas took a pattern from the caller. Python's `re` holds the GIL while it matches, so one catastrophic-backtracking pattern froze the whole server, and the crawl deadline could not interrupt it. These fields are now refused from untrusted bodies. The built-in patterns stay available.
+
+### Unbounded delay fields
+
+**GHSA-rhjm-7hj7-75fx, CWE-770, medium.** Credit: Chunyi Liu ([liuchunyi-buaa](https://github.com/liuchunyi-buaa)).
+
+`delay_before_return_html`, `mean_delay`, and `max_range` are allowed in untrusted bodies, but had no ceiling. One request could hold a browser page open, or stall the `arun_many` rate limiter, for as long as it liked. They are now capped at 60 seconds. Negative, NaN, and non-numeric values fall back to the field default.
+
+### Chromium launched with certificate checks off
+
+**GHSA-j2qh-f73r-mg3q, CWE-295, medium.** Credit: Julian Godfrey.
+
+Both default Chromium launch flag lists carried `--ignore-certificate-errors`. That flag turns TLS verification off for the whole browser, so `ignore_https_errors=False`, and the Docker server's TLS-on default, had no effect.
+
+The flag is gone. Insecure mode now comes only from `ignore_https_errors`. Only the CDP-managed browser, whose default context takes no such option, adds the flag, and only when `ignore_https_errors=True`.
+
+Also in this fix: `CRAWL4AI_CHROMIUM_SANDBOX=true` now reaches every browser, including ones built from a request body.
+
+### Hardening
+
+These came with the reports above but did not need an advisory. Credit: Chunyi Liu ([liuchunyi-buaa](https://github.com/liuchunyi-buaa)).
+
+- `DomainFilter` reads the real host, so `https://user@evil.com/`, `https://evil.com:443/`, and `https://evil.com./` no longer slip past `blocked_domains`.
+- Webhook header names and artifact ids use `fullmatch`, so a trailing newline no longer passes.
+- If the server cannot pin the browser to the egress proxy, it refuses the crawl instead of running unpinned.
+- Two documentation examples are fixed: the marketplace backend uses bound SQL parameters, and the LinkedIn graph view escapes crawled data.
+
+## Opt-in deep crawling on Docker
+
+Since 0.9.0 the Docker server refused any request that set `deep_crawl_strategy`. Now an operator can turn it on:
+
+```bash
+docker run -e CRAWL4AI_ALLOW_DEEP_CRAWL=true -p 11235:11235 unclecode/crawl4ai:0.9.5
+```
+
+Requests may then run BFS, DFS, or BestFirst deep crawls with filters and scorers. The server keeps control: page and depth budgets come from `limits.max_pages` and `limits.max_depth` in `config.yml`, URL patterns are glob only, a strategy may hold at most 20 filters and scorers, and streamed deep crawls get a deadline. It is off by default. (#2340, issue #2308, thanks @SohamKukreti)
+
+## Bug fixes
+
+### Crawler and core
+
+- **BFS overshoots `max_pages`**: BFS did not count URLs already queued for the next level, so `max_pages=50` could fetch 950 pages. (#2339, issue #2338, thanks @drakeo338)
+- **Reused deep-crawl strategy**: a second run shared the first run's page budget. It now starts fresh. (#2317, issue #2309, thanks @Artechie0806)
+- **Missing body on `<noscript>` pages**: content nested in an unclosed `<noscript>` was dropped from `cleaned_html` and `fit_html`. (#2284, thanks @tommypacker; #2360, #2363, issue #2293)
+- **Words run together**: removing `<span> </span>` joined "Hi there" into "Hithere". A space is kept now. (#2329, issue #2328, thanks @drakeo338)
+- **Failed results**: `CrawlResult.links` and `.media` have the normal shape even when the crawl failed. (#2289, issue #2286, thanks @talelboussetta)
+- **PDF**: markdown is the same on every run with `batch_size > 1`. (#2320, issue #2319, thanks @Kylinny)
+- **Proxy credentials**: passwords with `#`, `/`, `?`, or `%` work in the HTTP crawler, and credentials no longer appear in its error messages. (#2327, issue #2326, thanks @omarbounawarapy; #2361, thanks @alkaz-nodemaven)
+
+### CLI
+
+- **`-c cache_mode=...` ignored**: `crwl` always bypassed the cache. It now honors the setting. (#2366, issue #2365)
+- **`-o json` crash**: without an extraction strategy, `crwl` now fails early with a clear message. (#2362, #2335, issue #2334, thanks @SohamKukreti and @ege-arhan)
+
+### Docker server
+
+- **`crawler_configs`**: now applies to single-URL and streaming requests too. (#2290, issue #2287, thanks @talelboussetta)
+- **One bad seed**: a seed that fails the destination check is a failed result, not a 400 for the whole batch. (#2359, issue #2288)
+- **Invalid `cache_mode`**: returns 400, not 500.
+- **MCP over SSE**: `initialize` is processed before early tool calls, so fan-out clients no longer get -32602 on connect. (#2273, issue #2233, thanks @SohamKukreti)
+
+## Breaking changes
+
+None for library users.
+
+On the Docker server, untrusted request bodies that set `CosineStrategy.model_name`, `RegexExtractionStrategy.custom`, `RegexChunking.patterns`, a `"type": "regex"` schema field, or a JavaScript `wait_for` are now refused with 400.
+
+## Upgrade
+
+```bash
+pip install -U crawl4ai
+crawl4ai-doctor  # verify installation
+```
+
+Docker users: pull the new image once the Docker release workflow finishes.
+
+```bash
+docker pull unclecode/crawl4ai:0.9.5
+```
+
+## Acknowledgments
+
+Thank you to [arpe1618](https://github.com/arpe1618), Zhixi "Jace" Sun ([manus-use](https://github.com/manus-use)), Chunyi Liu ([liuchunyi-buaa](https://github.com/liuchunyi-buaa)), and Julian Godfrey for reporting these issues privately and giving us time to fix them before disclosure. All reporters are listed in [SECURITY-CREDITS.md](https://github.com/unclecode/crawl4ai/blob/main/SECURITY-CREDITS.md).
+
+Thanks to the community contributors behind this release: @SohamKukreti (#2340, #2362, #2273), @drakeo338 (#2339, #2329), @talelboussetta (#2290, #2289), @tommypacker (#2284), @Kylinny (#2320), @Artechie0806 (#2317), @omarbounawarapy (#2327), @alkaz-nodemaven (#2361), and @ege-arhan (#2335).
+
+If you find a security issue in Crawl4AI, please report it privately. See [SECURITY.md](https://github.com/unclecode/crawl4ai/blob/main/SECURITY.md).
+
+## Support & Resources
+
+- [Documentation](https://docs.crawl4ai.com)
+- [GitHub Issues](https://github.com/unclecode/crawl4ai/issues)
+- [Discord Community](https://discord.gg/crawl4ai)
diff --git a/JOURNAL.md b/docs/deprecated/JOURNAL.md
similarity index 100%
rename from JOURNAL.md
rename to docs/deprecated/JOURNAL.md
diff --git a/docs/md_v2/api/crawl-result.md b/docs/md_v2/api/crawl-result.md
index f061836c9..a7345e217 100644
--- a/docs/md_v2/api/crawl-result.md
+++ b/docs/md_v2/api/crawl-result.md
@@ -11,8 +11,8 @@ class CrawlResult(BaseModel):
     success: bool
     cleaned_html: Optional[str] = None
     fit_html: Optional[str] = None  # Preprocessed HTML optimized for extraction
-    media: Dict[str, List[Dict]] = {}
-    links: Dict[str, List[Dict]] = {}
+    media: Dict[str, List[Dict]] = {"images": [], "videos": [], "audios": []}
+    links: Dict[str, List[Dict]] = {"internal": [], "external": []}
     downloaded_files: Optional[List[str]] = None
     screenshot: Optional[str] = None
     pdf : Optional[bytes] = None
diff --git a/docs/md_v2/complete-sdk-reference.md b/docs/md_v2/complete-sdk-reference.md
index 2e86db1e7..afa6a8650 100644
--- a/docs/md_v2/complete-sdk-reference.md
+++ b/docs/md_v2/complete-sdk-reference.md
@@ -1077,8 +1077,8 @@ class CrawlResult(BaseModel):
     success: bool
     cleaned_html: Optional[str] = None
     fit_html: Optional[str] = None  # Preprocessed HTML optimized for extraction
-    media: Dict[str, List[Dict]] = {}
-    links: Dict[str, List[Dict]] = {}
+    media: Dict[str, List[Dict]] = {"images": [], "videos": [], "audios": []}
+    links: Dict[str, List[Dict]] = {"internal": [], "external": []}
     downloaded_files: Optional[List[str]] = None
     screenshot: Optional[str] = None
     pdf : Optional[bytes] = None
diff --git a/docs/md_v2/core/crawler-result.md b/docs/md_v2/core/crawler-result.md
index 79f723185..2a3f5e922 100644
--- a/docs/md_v2/core/crawler-result.md
+++ b/docs/md_v2/core/crawler-result.md
@@ -22,8 +22,8 @@ class CrawlResult(BaseModel):
     fit_html: Optional[str] = None
     success: bool
     cleaned_html: Optional[str] = None
-    media: Dict[str, List[Dict]] = {}
-    links: Dict[str, List[Dict]] = {}
+    media: Dict[str, List[Dict]] = {"images": [], "videos": [], "audios": []}
+    links: Dict[str, List[Dict]] = {"internal": [], "external": []}
     downloaded_files: Optional[List[str]] = None
     js_execution_result: Optional[Dict[str, Any]] = None
     screenshot: Optional[str] = None
diff --git a/docs/md_v2/core/self-hosting.md b/docs/md_v2/core/self-hosting.md
index 68a8a1065..5f6ae1c41 100644
--- a/docs/md_v2/core/self-hosting.md
+++ b/docs/md_v2/core/self-hosting.md
@@ -1290,7 +1290,61 @@ Crucially, when sending configurations directly via JSON, they **must** follow t
 ```
 
 **LLM Extraction Strategy** *(Keep example, ensure schema uses type/value wrapper)*
-*(Keep Deep Crawler Example)*
+#### Deep Crawling (opt-in)
+
+Deep crawling over the API is **disabled by default**: a request with
+`deep_crawl_strategy` returns HTTP 400. To allow it, start the container with
+`CRAWL4AI_ALLOW_DEEP_CRAWL=true`:
+
+```bash
+docker run -d \
+  -p 11235:11235 \
+  --name crawl4ai \
+  --shm-size=1g \
+  -e CRAWL4AI_API_TOKEN="$CRAWL4AI_API_TOKEN" \
+  -e CRAWL4AI_ALLOW_DEEP_CRAWL=true \
+  unclecode/crawl4ai:latest
+```
+
+With Docker Compose, put `CRAWL4AI_ALLOW_DEEP_CRAWL=true` in the `.env` file in
+the project root, or export it in your shell.
+
+```json
+{
+  "urls": ["https://docs.crawl4ai.com"],
+  "crawler_config": {
+    "type": "CrawlerRunConfig",
+    "params": {
+      "deep_crawl_strategy": {
+        "type": "BFSDeepCrawlStrategy",
+        "params": {
+          "max_depth": 2,
+          "max_pages": 20,
+          "filter_chain": {
+            "type": "FilterChain",
+            "params": {
+              "filters": [
+                {"type": "URLPatternFilter", "params": {"patterns": ["*/core/*"]}},
+                {"type": "DomainFilter", "params": {"allowed_domains": ["docs.crawl4ai.com"]}}
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+Rules the server applies:
+
+- **One start URL** per request, and not inside `crawler_configs`.
+- `max_pages` and `max_depth` are clamped to `limits.max_pages` and `limits.max_depth` in `config.yml` (default 100 and 5; `max_pages: 0` means no limit). The crawl stops after `limits.wall_clock_s`, also on `/crawl/stream`.
+- **Allowed types:** `BFSDeepCrawlStrategy`, `DFSDeepCrawlStrategy`, `BestFirstCrawlingStrategy`; `FilterChain` with `URLPatternFilter`, `DomainFilter`, `ContentTypeFilter`; scorers `KeywordRelevanceScorer`, `CompositeScorer`, `DomainAuthorityScorer`, `FreshnessScorer`, `PathDepthScorer`. `SEOFilter` and `ContentRelevanceFilter` are refused (they fetch pages outside the egress controls).
+- `URLPatternFilter` accepts globs that start with `*` (`*/blog/*`), `/prefix/*` or `*.ext`. Regex patterns are refused.
+- `resume_state` is refused, and so is `fetch_ssl_certificate` together with a deep crawl. Lists (patterns, keywords, filters, scorers) are limited to 100 items. One strategy may have at most 20 filters and scorers and 200 list items in total, and a `CompositeScorer` cannot contain another `CompositeScorer`. Discovered links longer than 2048 characters are skipped.
+
+Turn the flag on only when you accept that one request can fetch many pages.
 
 ### LLM Configuration Examples
 
@@ -1481,6 +1535,29 @@ async def test_stream_crawl(token: str = None): # Made token optional
 # asyncio.run(test_stream_crawl())
 ```
 
+#### Per-URL Configs (`crawler_configs`)
+
+To crawl different URLs with different settings in one request, send `crawler_configs`: a list of `CrawlerRunConfig` payloads, each with a `url_matcher`. Every URL uses the first entry whose `url_matcher` matches it, and an entry without a `url_matcher` matches every URL.
+
+```python
+payload = {
+    "urls": ["https://docs.example.com/guide", "https://example.com/"],
+    "crawler_configs": [
+        {
+            "type": "CrawlerRunConfig",
+            "params": {"url_matcher": "*docs.example.com*", "css_selector": "main"},
+        },
+        # Catch-all: decides every URL the entries above did not match
+        {"type": "CrawlerRunConfig", "params": {"url_matcher": "*"}},
+    ],
+}
+```
+
+- The list is used for one URL or many, on both `/crawl` and `/crawl/stream`.
+- When a list is sent, `crawler_config` is ignored. It is not a fallback: a URL that no entry matches comes back as a failed result (`No matching configuration found for URL: ...`), so end the list with a catch-all entry (`"url_matcher": "*"`).
+- The server's `crawler.base_config` defaults from `config.yml` are applied to each entry on both endpoints.
+- A list that mixes `PDFContentScrapingStrategy` entries with other scraping strategies is refused with `400`, because one crawler serves every URL of a request.
+
 ---
 
 ## Real-time Monitoring & Operations
diff --git a/docs/md_v2/marketplace/backend/database.py b/docs/md_v2/marketplace/backend/database.py
index 8ccfbaf46..0fb86098e 100644
--- a/docs/md_v2/marketplace/backend/database.py
+++ b/docs/md_v2/marketplace/backend/database.py
@@ -77,14 +77,16 @@ def _create_or_update_table(self, table_name: str, columns: Dict):
 
         self.conn.commit()
 
-    def get_all(self, table: str, limit: int = 100, offset: int = 0, where: str = None) -> List[Dict]:
+    def get_all(self, table: str, limit: int = 100, offset: int = 0, where: str = None, params: List = None) -> List[Dict]:
         cursor = self.conn.cursor()
         query = f"SELECT * FROM {table}"
+        query_params = list(params) if params else []
         if where:
             query += f" WHERE {where}"
-        query += f" LIMIT {limit} OFFSET {offset}"
+        query += " LIMIT ? OFFSET ?"
+        query_params += [limit, offset]
 
-        cursor.execute(query)
+        cursor.execute(query, query_params)
         rows = cursor.fetchall()
         return [dict(row) for row in rows]
 
diff --git a/docs/md_v2/marketplace/backend/server.py b/docs/md_v2/marketplace/backend/server.py
index f4935eb6d..d66965a20 100644
--- a/docs/md_v2/marketplace/backend/server.py
+++ b/docs/md_v2/marketplace/backend/server.py
@@ -96,17 +96,22 @@ async def get_apps(
 ):
     """Get apps with optional filters"""
     where_clauses = []
+    params = []
     if category:
-        where_clauses.append(f"category = '{category}'")
+        where_clauses.append("category = ?")
+        params.append(category)
     if type:
-        where_clauses.append(f"type = '{type}'")
+        where_clauses.append("type = ?")
+        params.append(type)
     if featured is not None:
-        where_clauses.append(f"featured = {1 if featured else 0}")
+        where_clauses.append("featured = ?")
+        params.append(1 if featured else 0)
     if sponsored is not None:
-        where_clauses.append(f"sponsored = {1 if sponsored else 0}")
+        where_clauses.append("sponsored = ?")
+        params.append(1 if sponsored else 0)
 
     where = " AND ".join(where_clauses) if where_clauses else None
-    apps = db.get_all('apps', limit=limit, offset=offset, where=where)
+    apps = db.get_all('apps', limit=limit, offset=offset, where=where, params=params)
 
     # Parse JSON fields
     for app in apps:
@@ -118,7 +123,7 @@ async def get_apps(
 @router.get("/apps/{slug}")
 async def get_app(slug: str):
     """Get single app by slug"""
-    apps = db.get_all('apps', where=f"slug = '{slug}'", limit=1)
+    apps = db.get_all('apps', where="slug = ?", params=[slug], limit=1)
     if not apps:
         raise HTTPException(status_code=404, detail="App not found")
 
@@ -135,8 +140,9 @@ async def get_articles(
     offset: int = Query(default=0)
 ):
     """Get articles with optional category filter"""
-    where = f"category = '{category}'" if category else None
-    articles = db.get_all('articles', limit=limit, offset=offset, where=where)
+    where = "category = ?" if category else None
+    params = [category] if category else []
+    articles = db.get_all('articles', limit=limit, offset=offset, where=where, params=params)
 
     # Parse JSON fields
     for article in articles:
@@ -150,7 +156,7 @@ async def get_articles(
 @router.get("/articles/{slug}")
 async def get_article(slug: str):
     """Get single article by slug"""
-    articles = db.get_all('articles', where=f"slug = '{slug}'", limit=1)
+    articles = db.get_all('articles', where="slug = ?", params=[slug], limit=1)
     if not articles:
         raise HTTPException(status_code=404, detail="Article not found")
 
@@ -174,8 +180,9 @@ async def get_categories():
 @router.get("/sponsors")
 async def get_sponsors(active: Optional[bool] = True):
     """Get sponsors, default active only"""
-    where = f"active = {1 if active else 0}" if active is not None else None
-    sponsors = db.get_all('sponsors', where=where, limit=20)
+    where = "active = ?" if active is not None else None
+    params = [1 if active else 0] if active is not None else []
+    sponsors = db.get_all('sponsors', where=where, params=params, limit=20)
 
     # Filter by date if active
     if active:
@@ -228,6 +235,14 @@ def verify_token(credentials: HTTPAuthorizationCredentials = Depends(security)):
     return token
 
 
+def validate_columns(table: str, data: Dict[str, Any]):
+    """Reject any field that isn't a real column on this table"""
+    allowed = db.schema['tables'][table]['columns'].keys()
+    unknown = [k for k in data.keys() if k not in allowed]
+    if unknown:
+        raise HTTPException(status_code=400, detail=f"Unknown field(s): {', '.join(unknown)}")
+
+
 @router.post("/admin/upload-image", dependencies=[Depends(verify_token)])
 async def upload_image(file: UploadFile = File(...), folder: str = Form("sponsors")):
     """Upload image files for admin assets"""
@@ -296,6 +311,7 @@ async def get_admin_stats():
 @router.post("/admin/apps", dependencies=[Depends(verify_token)])
 async def create_app(app_data: Dict[str, Any]):
     """Create new app"""
+    validate_columns('apps', app_data)
     try:
         # Handle JSON fields
         for field in ['screenshots', 'tags']:
@@ -310,11 +326,13 @@ async def create_app(app_data: Dict[str, Any]):
         db.conn.commit()
         return {"id": cursor.lastrowid, "message": "App created"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error creating app: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 @router.put("/admin/apps/{app_id}", dependencies=[Depends(verify_token)])
 async def update_app(app_id: int, app_data: Dict[str, Any]):
     """Update app"""
+    validate_columns('apps', app_data)
     try:
         # Handle JSON fields
         for field in ['screenshots', 'tags']:
@@ -328,7 +346,8 @@ async def update_app(app_id: int, app_data: Dict[str, Any]):
         db.conn.commit()
         return {"message": "App updated"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error updating app: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 @router.delete("/admin/apps/{app_id}", dependencies=[Depends(verify_token)])
 async def delete_app(app_id: int):
@@ -342,6 +361,7 @@ async def delete_app(app_id: int):
 @router.post("/admin/articles", dependencies=[Depends(verify_token)])
 async def create_article(article_data: Dict[str, Any]):
     """Create new article"""
+    validate_columns('articles', article_data)
     try:
         for field in ['related_apps', 'tags']:
             if field in article_data and isinstance(article_data[field], list):
@@ -355,11 +375,13 @@ async def create_article(article_data: Dict[str, Any]):
         db.conn.commit()
         return {"id": cursor.lastrowid, "message": "Article created"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error creating article: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 @router.put("/admin/articles/{article_id}", dependencies=[Depends(verify_token)])
 async def update_article(article_id: int, article_data: Dict[str, Any]):
     """Update article"""
+    validate_columns('articles', article_data)
     try:
         for field in ['related_apps', 'tags']:
             if field in article_data and isinstance(article_data[field], list):
@@ -372,7 +394,8 @@ async def update_article(article_id: int, article_data: Dict[str, Any]):
         db.conn.commit()
         return {"message": "Article updated"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error updating article: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 @router.delete("/admin/articles/{article_id}", dependencies=[Depends(verify_token)])
 async def delete_article(article_id: int):
@@ -386,6 +409,7 @@ async def delete_article(article_id: int):
 @router.post("/admin/categories", dependencies=[Depends(verify_token)])
 async def create_category(category_data: Dict[str, Any]):
     """Create new category"""
+    validate_columns('categories', category_data)
     try:
         category_data = dict(category_data)
         category_data['order_index'] = to_int(category_data.get('order_index'), 0)
@@ -398,11 +422,13 @@ async def create_category(category_data: Dict[str, Any]):
         db.conn.commit()
         return {"id": cursor.lastrowid, "message": "Category created"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error creating category: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 @router.put("/admin/categories/{cat_id}", dependencies=[Depends(verify_token)])
 async def update_category(cat_id: int, category_data: Dict[str, Any]):
     """Update category"""
+    validate_columns('categories', category_data)
     try:
         category_data = dict(category_data)
         if 'order_index' in category_data:
@@ -415,7 +441,8 @@ async def update_category(cat_id: int, category_data: Dict[str, Any]):
         db.conn.commit()
         return {"message": "Category updated"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error updating category: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 
 @router.delete("/admin/categories/{cat_id}", dependencies=[Depends(verify_token)])
@@ -427,12 +454,14 @@ async def delete_category(cat_id: int):
         db.conn.commit()
         return {"message": "Category deleted"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error deleting category: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 # Sponsors CRUD
 @router.post("/admin/sponsors", dependencies=[Depends(verify_token)])
 async def create_sponsor(sponsor_data: Dict[str, Any]):
     """Create new sponsor"""
+    validate_columns('sponsors', sponsor_data)
     try:
         cursor = db.conn.cursor()
         columns = ', '.join(sponsor_data.keys())
@@ -442,11 +471,13 @@ async def create_sponsor(sponsor_data: Dict[str, Any]):
         db.conn.commit()
         return {"id": cursor.lastrowid, "message": "Sponsor created"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error creating sponsor: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 @router.put("/admin/sponsors/{sponsor_id}", dependencies=[Depends(verify_token)])
 async def update_sponsor(sponsor_id: int, sponsor_data: Dict[str, Any]):
     """Update sponsor"""
+    validate_columns('sponsors', sponsor_data)
     try:
         set_clause = ', '.join([f"{k} = ?" for k in sponsor_data.keys()])
         cursor = db.conn.cursor()
@@ -455,7 +486,8 @@ async def update_sponsor(sponsor_id: int, sponsor_data: Dict[str, Any]):
         db.conn.commit()
         return {"message": "Sponsor updated"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error updating sponsor: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 
 @router.delete("/admin/sponsors/{sponsor_id}", dependencies=[Depends(verify_token)])
@@ -467,7 +499,8 @@ async def delete_sponsor(sponsor_id: int):
         db.conn.commit()
         return {"message": "Sponsor deleted"}
     except Exception as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        print(f"Error deleting sponsor: {e}")
+        raise HTTPException(status_code=400, detail="Invalid request")
 
 app.include_router(router)
 
diff --git a/docs/md_v2/marketplace/backend/test_sql_injection.py b/docs/md_v2/marketplace/backend/test_sql_injection.py
new file mode 100644
index 000000000..5f807facd
--- /dev/null
+++ b/docs/md_v2/marketplace/backend/test_sql_injection.py
@@ -0,0 +1,150 @@
+"""SQL injection regression test for the marketplace backend.
+
+Runs the real server.py on a copy of the backend folder, with a throwaway .env,
+same approach as the private repro script. No fixtures, standalone pytest file.
+
+Run with: <python with fastapi/httpx/pyyaml/dotenv/multipart> -m pytest test_sql_injection.py -v
+"""
+import os
+import shutil
+import sys
+import tempfile
+from pathlib import Path
+
+import pytest
+
+SRC = Path(__file__).resolve().parent
+
+
+@pytest.fixture(scope="module")
+def client():
+    work = Path(tempfile.mkdtemp()) / "backend"
+    shutil.copytree(SRC, work, ignore=shutil.ignore_patterns("__pycache__", "uploads", "test_sql_injection.py"))
+    (work / ".env").write_text("MARKETPLACE_ADMIN_PASSWORD=x\nMARKETPLACE_JWT_SECRET=y\n")
+
+    old_cwd = os.getcwd()
+    os.chdir(work)
+    sys.path.insert(0, str(work))
+
+    # Fresh import each run since module state (db connection) is process-global
+    sys.modules.pop("server", None)
+    sys.modules.pop("database", None)
+    sys.modules.pop("config", None)
+    import server
+
+    from fastapi.testclient import TestClient
+    c = TestClient(server.app, raise_server_exceptions=False)
+    c.server_module = server
+    yield c
+
+    os.chdir(old_cwd)
+    sys.path.remove(str(work))
+
+
+@pytest.fixture(scope="module")
+def admin_token(client):
+    r = client.post("/marketplace/api/admin/login", json={"password": "x"})
+    assert r.status_code == 200
+    return r.json()["token"]
+
+
+BASE = "/marketplace/api"
+
+
+def test_apps_category_union_injection_blocked(client):
+    cols = len(client.server_module.db.conn.execute("PRAGMA table_info(apps)").fetchall())
+    union = "' UNION SELECT " + ",".join(["NULL", "sql"] + ["NULL"] * (cols - 2)) + " FROM sqlite_master WHERE type='table'--"
+    r = client.get(f"{BASE}/apps", params={"category": union})
+    assert r.status_code == 200
+    assert r.json() == []  # no app has this literal category string, and no injected rows
+
+
+def test_apps_type_union_injection_blocked(client):
+    cols = len(client.server_module.db.conn.execute("PRAGMA table_info(apps)").fetchall())
+    union = "' UNION SELECT " + ",".join(["NULL", "sql"] + ["NULL"] * (cols - 2)) + " FROM sqlite_master WHERE type='table'--"
+    r = client.get(f"{BASE}/apps", params={"type": union})
+    assert r.status_code == 200
+    assert r.json() == []
+
+
+def test_app_slug_or_true_injection_blocked(client):
+    r = client.get(f"{BASE}/apps/x' OR '1'='1")
+    assert r.status_code == 404
+
+
+def test_articles_category_union_injection_blocked(client):
+    cols = len(client.server_module.db.conn.execute("PRAGMA table_info(articles)").fetchall())
+    union = "' UNION SELECT " + ",".join(["NULL", "sql"] + ["NULL"] * (cols - 2)) + " FROM sqlite_master WHERE type='table'--"
+    r = client.get(f"{BASE}/articles", params={"category": union})
+    assert r.status_code == 200
+    assert r.json() == []
+
+
+def test_article_slug_or_true_injection_blocked(client):
+    r = client.get(f"{BASE}/articles/x' OR '1'='1")
+    assert r.status_code == 404
+
+
+def test_normal_filters_still_work(client):
+    """A real category value must still return its apps."""
+    cur = client.server_module.db.conn
+    cur.execute(
+        "INSERT INTO apps (name, slug, category) VALUES ('Demo App', 'demo-app', 'demo-category')"
+    )
+    cur.commit()
+
+    r = client.get(f"{BASE}/apps", params={"category": "demo-category"})
+    assert r.status_code == 200
+    body = r.json()
+    assert len(body) == 1
+    assert body[0]["slug"] == "demo-app"
+
+
+def test_admin_create_app_rejects_unknown_column(client, admin_token):
+    r = client.post(
+        f"{BASE}/admin/apps",
+        json={"name": "x", "slug) VALUES ('x'); DROP TABLE apps; --": "x"},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    # Rejected before any SQL runs, so the malicious key is never executed
+    assert r.status_code == 400
+    tables = client.server_module.db.conn.execute(
+        "SELECT name FROM sqlite_master WHERE type='table'"
+    ).fetchall()
+    assert any(row[0] == "apps" for row in tables)
+
+
+def test_admin_update_app_rejects_unknown_column(client, admin_token):
+    r = client.post(
+        f"{BASE}/admin/apps",
+        json={"name": "victim", "slug": "victim-app"},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert r.status_code == 200
+    app_id = r.json()["id"]
+
+    r = client.put(
+        f"{BASE}/admin/apps/{app_id}",
+        json={"not_a_real_column": "evil"},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert r.status_code == 400
+    assert r.json()["detail"] != "not_a_real_column"
+
+
+def test_admin_create_app_error_detail_is_generic(client, admin_token):
+    """Forcing a real DB error (duplicate unique slug) must not leak str(e)."""
+    client.post(
+        f"{BASE}/admin/apps",
+        json={"name": "dup", "slug": "dup-app"},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    r = client.post(
+        f"{BASE}/admin/apps",
+        json={"name": "dup2", "slug": "dup-app"},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert r.status_code == 400
+    detail = r.json()["detail"]
+    assert "UNIQUE constraint" not in detail
+    assert "sqlite3" not in detail.lower()
diff --git a/test_llm_webhook_feature.py b/test_llm_webhook_feature.py
deleted file mode 100644
index 98133e82c..000000000
--- a/test_llm_webhook_feature.py
+++ /dev/null
@@ -1,401 +0,0 @@
-#!/usr/bin/env python3
-"""
-Test script to validate webhook implementation for /llm/job endpoint.
-
-This tests that the /llm/job endpoint now supports webhooks
-following the same pattern as /crawl/job.
-"""
-
-import sys
-import os
-
-# Add deploy/docker to path
-sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'deploy', 'docker'))
-
-def test_llm_job_payload_model():
-    """Test that LlmJobPayload includes webhook_config field"""
-    print("=" * 60)
-    print("TEST 1: LlmJobPayload Model")
-    print("=" * 60)
-
-    try:
-        from job import LlmJobPayload
-        from schemas import WebhookConfig
-        from pydantic import ValidationError
-
-        # Test with webhook_config
-        payload_dict = {
-            "url": "https://example.com",
-            "q": "Extract main content",
-            "schema": None,
-            "cache": False,
-            "provider": None,
-            "webhook_config": {
-                "webhook_url": "https://myapp.com/webhook",
-                "webhook_data_in_payload": True,
-                "webhook_headers": {"X-Secret": "token"}
-            }
-        }
-
-        payload = LlmJobPayload(**payload_dict)
-
-        print(f"✅ LlmJobPayload accepts webhook_config")
-        print(f"   - URL: {payload.url}")
-        print(f"   - Query: {payload.q}")
-        print(f"   - Webhook URL: {payload.webhook_config.webhook_url}")
-        print(f"   - Data in payload: {payload.webhook_config.webhook_data_in_payload}")
-
-        # Test without webhook_config (should be optional)
-        minimal_payload = {
-            "url": "https://example.com",
-            "q": "Extract content"
-        }
-
-        payload2 = LlmJobPayload(**minimal_payload)
-        assert payload2.webhook_config is None, "webhook_config should be optional"
-        print(f"✅ LlmJobPayload works without webhook_config (optional)")
-
-        return True
-    except Exception as e:
-        print(f"❌ Failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_handle_llm_request_signature():
-    """Test that handle_llm_request accepts webhook_config parameter"""
-    print("\n" + "=" * 60)
-    print("TEST 2: handle_llm_request Function Signature")
-    print("=" * 60)
-
-    try:
-        from api import handle_llm_request
-        import inspect
-
-        sig = inspect.signature(handle_llm_request)
-        params = list(sig.parameters.keys())
-
-        print(f"Function parameters: {params}")
-
-        if 'webhook_config' in params:
-            print(f"✅ handle_llm_request has webhook_config parameter")
-
-            # Check that it's optional with default None
-            webhook_param = sig.parameters['webhook_config']
-            if webhook_param.default is None or webhook_param.default == inspect.Parameter.empty:
-                print(f"✅ webhook_config is optional (default: {webhook_param.default})")
-            else:
-                print(f"⚠️  webhook_config default is: {webhook_param.default}")
-
-            return True
-        else:
-            print(f"❌ handle_llm_request missing webhook_config parameter")
-            return False
-
-    except Exception as e:
-        print(f"❌ Failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_process_llm_extraction_signature():
-    """Test that process_llm_extraction accepts webhook_config parameter"""
-    print("\n" + "=" * 60)
-    print("TEST 3: process_llm_extraction Function Signature")
-    print("=" * 60)
-
-    try:
-        from api import process_llm_extraction
-        import inspect
-
-        sig = inspect.signature(process_llm_extraction)
-        params = list(sig.parameters.keys())
-
-        print(f"Function parameters: {params}")
-
-        if 'webhook_config' in params:
-            print(f"✅ process_llm_extraction has webhook_config parameter")
-
-            webhook_param = sig.parameters['webhook_config']
-            if webhook_param.default is None or webhook_param.default == inspect.Parameter.empty:
-                print(f"✅ webhook_config is optional (default: {webhook_param.default})")
-            else:
-                print(f"⚠️  webhook_config default is: {webhook_param.default}")
-
-            return True
-        else:
-            print(f"❌ process_llm_extraction missing webhook_config parameter")
-            return False
-
-    except Exception as e:
-        print(f"❌ Failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_webhook_integration_in_api():
-    """Test that api.py properly integrates webhook notifications"""
-    print("\n" + "=" * 60)
-    print("TEST 4: Webhook Integration in process_llm_extraction")
-    print("=" * 60)
-
-    try:
-        api_file = os.path.join(os.path.dirname(__file__), 'deploy', 'docker', 'api.py')
-
-        with open(api_file, 'r') as f:
-            api_content = f.read()
-
-        # Check for WebhookDeliveryService initialization
-        if 'webhook_service = WebhookDeliveryService(config)' in api_content:
-            print("✅ process_llm_extraction initializes WebhookDeliveryService")
-        else:
-            print("❌ Missing WebhookDeliveryService initialization in process_llm_extraction")
-            return False
-
-        # Check for notify_job_completion calls with llm_extraction
-        if 'task_type="llm_extraction"' in api_content:
-            print("✅ Uses correct task_type='llm_extraction' for notifications")
-        else:
-            print("❌ Missing task_type='llm_extraction' in webhook notifications")
-            return False
-
-        # Count webhook notification calls (should have at least 3: success + 2 failure paths)
-        notification_count = api_content.count('await webhook_service.notify_job_completion')
-        # Find only in process_llm_extraction function
-        llm_func_start = api_content.find('async def process_llm_extraction')
-        llm_func_end = api_content.find('\nasync def ', llm_func_start + 1)
-        if llm_func_end == -1:
-            llm_func_end = len(api_content)
-
-        llm_func_content = api_content[llm_func_start:llm_func_end]
-        llm_notification_count = llm_func_content.count('await webhook_service.notify_job_completion')
-
-        print(f"✅ Found {llm_notification_count} webhook notification calls in process_llm_extraction")
-
-        if llm_notification_count >= 3:
-            print(f"✅ Sufficient notification points (success + failure paths)")
-        else:
-            print(f"⚠️  Expected at least 3 notification calls, found {llm_notification_count}")
-
-        return True
-    except Exception as e:
-        print(f"❌ Failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_job_endpoint_integration():
-    """Test that /llm/job endpoint extracts and passes webhook_config"""
-    print("\n" + "=" * 60)
-    print("TEST 5: /llm/job Endpoint Integration")
-    print("=" * 60)
-
-    try:
-        job_file = os.path.join(os.path.dirname(__file__), 'deploy', 'docker', 'job.py')
-
-        with open(job_file, 'r') as f:
-            job_content = f.read()
-
-        # Find the llm_job_enqueue function
-        llm_job_start = job_content.find('async def llm_job_enqueue')
-        llm_job_end = job_content.find('\n\n@router', llm_job_start + 1)
-        if llm_job_end == -1:
-            llm_job_end = job_content.find('\n\nasync def', llm_job_start + 1)
-
-        llm_job_func = job_content[llm_job_start:llm_job_end]
-
-        # Check for webhook_config extraction
-        if 'webhook_config = None' in llm_job_func:
-            print("✅ llm_job_enqueue initializes webhook_config variable")
-        else:
-            print("❌ Missing webhook_config initialization")
-            return False
-
-        if 'if payload.webhook_config:' in llm_job_func:
-            print("✅ llm_job_enqueue checks for payload.webhook_config")
-        else:
-            print("❌ Missing webhook_config check")
-            return False
-
-        if 'webhook_config = payload.webhook_config.model_dump(mode=\'json\')' in llm_job_func:
-            print("✅ llm_job_enqueue converts webhook_config to dict")
-        else:
-            print("❌ Missing webhook_config.model_dump conversion")
-            return False
-
-        if 'webhook_config=webhook_config' in llm_job_func:
-            print("✅ llm_job_enqueue passes webhook_config to handle_llm_request")
-        else:
-            print("❌ Missing webhook_config parameter in handle_llm_request call")
-            return False
-
-        return True
-    except Exception as e:
-        print(f"❌ Failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_create_new_task_integration():
-    """Test that create_new_task stores webhook_config in Redis"""
-    print("\n" + "=" * 60)
-    print("TEST 6: create_new_task Webhook Storage")
-    print("=" * 60)
-
-    try:
-        api_file = os.path.join(os.path.dirname(__file__), 'deploy', 'docker', 'api.py')
-
-        with open(api_file, 'r') as f:
-            api_content = f.read()
-
-        # Find create_new_task function
-        create_task_start = api_content.find('async def create_new_task')
-        create_task_end = api_content.find('\nasync def ', create_task_start + 1)
-        if create_task_end == -1:
-            create_task_end = len(api_content)
-
-        create_task_func = api_content[create_task_start:create_task_end]
-
-        # Check for webhook_config storage
-        if 'if webhook_config:' in create_task_func:
-            print("✅ create_new_task checks for webhook_config")
-        else:
-            print("❌ Missing webhook_config check in create_new_task")
-            return False
-
-        if 'task_data["webhook_config"] = json.dumps(webhook_config)' in create_task_func:
-            print("✅ create_new_task stores webhook_config in Redis task data")
-        else:
-            print("❌ Missing webhook_config storage in task_data")
-            return False
-
-        # Check that webhook_config is passed to process_llm_extraction
-        if 'webhook_config' in create_task_func and 'background_tasks.add_task' in create_task_func:
-            print("✅ create_new_task passes webhook_config to background task")
-        else:
-            print("⚠️  Could not verify webhook_config passed to background task")
-
-        return True
-    except Exception as e:
-        print(f"❌ Failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_pattern_consistency():
-    """Test that /llm/job follows the same pattern as /crawl/job"""
-    print("\n" + "=" * 60)
-    print("TEST 7: Pattern Consistency with /crawl/job")
-    print("=" * 60)
-
-    try:
-        api_file = os.path.join(os.path.dirname(__file__), 'deploy', 'docker', 'api.py')
-
-        with open(api_file, 'r') as f:
-            api_content = f.read()
-
-        # Find handle_crawl_job to compare pattern
-        crawl_job_start = api_content.find('async def handle_crawl_job')
-        crawl_job_end = api_content.find('\nasync def ', crawl_job_start + 1)
-        if crawl_job_end == -1:
-            crawl_job_end = len(api_content)
-        crawl_job_func = api_content[crawl_job_start:crawl_job_end]
-
-        # Find process_llm_extraction
-        llm_extract_start = api_content.find('async def process_llm_extraction')
-        llm_extract_end = api_content.find('\nasync def ', llm_extract_start + 1)
-        if llm_extract_end == -1:
-            llm_extract_end = len(api_content)
-        llm_extract_func = api_content[llm_extract_start:llm_extract_end]
-
-        print("Checking pattern consistency...")
-
-        # Both should initialize WebhookDeliveryService
-        crawl_has_service = 'webhook_service = WebhookDeliveryService(config)' in crawl_job_func
-        llm_has_service = 'webhook_service = WebhookDeliveryService(config)' in llm_extract_func
-
-        if crawl_has_service and llm_has_service:
-            print("✅ Both initialize WebhookDeliveryService")
-        else:
-            print(f"❌ Service initialization mismatch (crawl: {crawl_has_service}, llm: {llm_has_service})")
-            return False
-
-        # Both should call notify_job_completion on success
-        crawl_notifies_success = 'status="completed"' in crawl_job_func and 'notify_job_completion' in crawl_job_func
-        llm_notifies_success = 'status="completed"' in llm_extract_func and 'notify_job_completion' in llm_extract_func
-
-        if crawl_notifies_success and llm_notifies_success:
-            print("✅ Both notify on success")
-        else:
-            print(f"❌ Success notification mismatch (crawl: {crawl_notifies_success}, llm: {llm_notifies_success})")
-            return False
-
-        # Both should call notify_job_completion on failure
-        crawl_notifies_failure = 'status="failed"' in crawl_job_func and 'error=' in crawl_job_func
-        llm_notifies_failure = 'status="failed"' in llm_extract_func and 'error=' in llm_extract_func
-
-        if crawl_notifies_failure and llm_notifies_failure:
-            print("✅ Both notify on failure")
-        else:
-            print(f"❌ Failure notification mismatch (crawl: {crawl_notifies_failure}, llm: {llm_notifies_failure})")
-            return False
-
-        print("✅ /llm/job follows the same pattern as /crawl/job")
-        return True
-
-    except Exception as e:
-        print(f"❌ Failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def main():
-    """Run all tests"""
-    print("\n🧪 LLM Job Webhook Feature Validation")
-    print("=" * 60)
-    print("Testing that /llm/job now supports webhooks like /crawl/job")
-    print("=" * 60 + "\n")
-
-    results = []
-
-    # Run all tests
-    results.append(("LlmJobPayload Model", test_llm_job_payload_model()))
-    results.append(("handle_llm_request Signature", test_handle_llm_request_signature()))
-    results.append(("process_llm_extraction Signature", test_process_llm_extraction_signature()))
-    results.append(("Webhook Integration", test_webhook_integration_in_api()))
-    results.append(("/llm/job Endpoint", test_job_endpoint_integration()))
-    results.append(("create_new_task Storage", test_create_new_task_integration()))
-    results.append(("Pattern Consistency", test_pattern_consistency()))
-
-    # Print summary
-    print("\n" + "=" * 60)
-    print("TEST SUMMARY")
-    print("=" * 60)
-
-    passed = sum(1 for _, result in results if result)
-    total = len(results)
-
-    for test_name, result in results:
-        status = "✅ PASS" if result else "❌ FAIL"
-        print(f"{status} - {test_name}")
-
-    print(f"\n{'=' * 60}")
-    print(f"Results: {passed}/{total} tests passed")
-    print(f"{'=' * 60}")
-
-    if passed == total:
-        print("\n🎉 All tests passed! /llm/job webhook feature is correctly implemented.")
-        print("\n📝 Summary of changes:")
-        print("  1. LlmJobPayload model includes webhook_config field")
-        print("  2. /llm/job endpoint extracts and passes webhook_config")
-        print("  3. handle_llm_request accepts webhook_config parameter")
-        print("  4. create_new_task stores webhook_config in Redis")
-        print("  5. process_llm_extraction sends webhook notifications")
-        print("  6. Follows the same pattern as /crawl/job")
-        return 0
-    else:
-        print(f"\n⚠️  {total - passed} test(s) failed. Please review the output above.")
-        return 1
-
-if __name__ == "__main__":
-    exit(main())
diff --git a/test_webhook_implementation.py b/test_webhook_implementation.py
deleted file mode 100644
index 072db8b33..000000000
--- a/test_webhook_implementation.py
+++ /dev/null
@@ -1,307 +0,0 @@
-"""
-Simple test script to validate webhook implementation without running full server.
-
-This script tests:
-1. Webhook module imports and syntax
-2. WebhookDeliveryService initialization
-3. Payload construction logic
-4. Configuration parsing
-"""
-
-import sys
-import os
-import json
-from datetime import datetime, timezone
-
-# Add deploy/docker to path to import modules
-# sys.path.insert(0, '/home/user/crawl4ai/deploy/docker')
-sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'deploy', 'docker'))
-
-def test_imports():
-    """Test that all webhook-related modules can be imported"""
-    print("=" * 60)
-    print("TEST 1: Module Imports")
-    print("=" * 60)
-
-    try:
-        from webhook import WebhookDeliveryService
-        print("✅ webhook.WebhookDeliveryService imported successfully")
-    except Exception as e:
-        print(f"❌ Failed to import webhook module: {e}")
-        return False
-
-    try:
-        from schemas import WebhookConfig, WebhookPayload
-        print("✅ schemas.WebhookConfig imported successfully")
-        print("✅ schemas.WebhookPayload imported successfully")
-    except Exception as e:
-        print(f"❌ Failed to import schemas: {e}")
-        return False
-
-    return True
-
-def test_webhook_service_init():
-    """Test WebhookDeliveryService initialization"""
-    print("\n" + "=" * 60)
-    print("TEST 2: WebhookDeliveryService Initialization")
-    print("=" * 60)
-
-    try:
-        from webhook import WebhookDeliveryService
-
-        # Test with default config
-        config = {
-            "webhooks": {
-                "enabled": True,
-                "default_url": None,
-                "data_in_payload": False,
-                "retry": {
-                    "max_attempts": 5,
-                    "initial_delay_ms": 1000,
-                    "max_delay_ms": 32000,
-                    "timeout_ms": 30000
-                },
-                "headers": {
-                    "User-Agent": "Crawl4AI-Webhook/1.0"
-                }
-            }
-        }
-
-        service = WebhookDeliveryService(config)
-
-        print(f"✅ Service initialized successfully")
-        print(f"   - Max attempts: {service.max_attempts}")
-        print(f"   - Initial delay: {service.initial_delay}s")
-        print(f"   - Max delay: {service.max_delay}s")
-        print(f"   - Timeout: {service.timeout}s")
-
-        # Verify calculations
-        assert service.max_attempts == 5, "Max attempts should be 5"
-        assert service.initial_delay == 1.0, "Initial delay should be 1.0s"
-        assert service.max_delay == 32.0, "Max delay should be 32.0s"
-        assert service.timeout == 30.0, "Timeout should be 30.0s"
-
-        print("✅ All configuration values correct")
-
-        return True
-    except Exception as e:
-        print(f"❌ Service initialization failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_webhook_config_model():
-    """Test WebhookConfig Pydantic model"""
-    print("\n" + "=" * 60)
-    print("TEST 3: WebhookConfig Model Validation")
-    print("=" * 60)
-
-    try:
-        from schemas import WebhookConfig
-        from pydantic import ValidationError
-
-        # Test valid config
-        valid_config = {
-            "webhook_url": "https://example.com/webhook",
-            "webhook_data_in_payload": True,
-            "webhook_headers": {"X-Secret": "token123"}
-        }
-
-        config = WebhookConfig(**valid_config)
-        print(f"✅ Valid config accepted:")
-        print(f"   - URL: {config.webhook_url}")
-        print(f"   - Data in payload: {config.webhook_data_in_payload}")
-        print(f"   - Headers: {config.webhook_headers}")
-
-        # Test minimal config
-        minimal_config = {
-            "webhook_url": "https://example.com/webhook"
-        }
-
-        config2 = WebhookConfig(**minimal_config)
-        print(f"✅ Minimal config accepted (defaults applied):")
-        print(f"   - URL: {config2.webhook_url}")
-        print(f"   - Data in payload: {config2.webhook_data_in_payload}")
-        print(f"   - Headers: {config2.webhook_headers}")
-
-        # Test invalid URL
-        try:
-            invalid_config = {
-                "webhook_url": "not-a-url"
-            }
-            config3 = WebhookConfig(**invalid_config)
-            print(f"❌ Invalid URL should have been rejected")
-            return False
-        except ValidationError as e:
-            print(f"✅ Invalid URL correctly rejected")
-
-        return True
-    except Exception as e:
-        print(f"❌ Model validation test failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_payload_construction():
-    """Test webhook payload construction logic"""
-    print("\n" + "=" * 60)
-    print("TEST 4: Payload Construction")
-    print("=" * 60)
-
-    try:
-        # Simulate payload construction from notify_job_completion
-        task_id = "crawl_abc123"
-        task_type = "crawl"
-        status = "completed"
-        urls = ["https://example.com"]
-
-        payload = {
-            "task_id": task_id,
-            "task_type": task_type,
-            "status": status,
-            "timestamp": datetime.now(timezone.utc).isoformat(),
-            "urls": urls
-        }
-
-        print(f"✅ Basic payload constructed:")
-        print(json.dumps(payload, indent=2))
-
-        # Test with error
-        error_payload = {
-            "task_id": "crawl_xyz789",
-            "task_type": "crawl",
-            "status": "failed",
-            "timestamp": datetime.now(timezone.utc).isoformat(),
-            "urls": ["https://example.com"],
-            "error": "Connection timeout"
-        }
-
-        print(f"\n✅ Error payload constructed:")
-        print(json.dumps(error_payload, indent=2))
-
-        # Test with data
-        data_payload = {
-            "task_id": "crawl_def456",
-            "task_type": "crawl",
-            "status": "completed",
-            "timestamp": datetime.now(timezone.utc).isoformat(),
-            "urls": ["https://example.com"],
-            "data": {
-                "results": [
-                    {"url": "https://example.com", "markdown": "# Example"}
-                ]
-            }
-        }
-
-        print(f"\n✅ Data payload constructed:")
-        print(json.dumps(data_payload, indent=2))
-
-        return True
-    except Exception as e:
-        print(f"❌ Payload construction failed: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
-
-def test_exponential_backoff():
-    """Test exponential backoff calculation"""
-    print("\n" + "=" * 60)
-    print("TEST 5: Exponential Backoff Calculation")
-    print("=" * 60)
-
-    try:
-        initial_delay = 1.0  # 1 second
-        max_delay = 32.0     # 32 seconds
-
-        print("Backoff delays for 5 attempts:")
-        for attempt in range(5):
-            delay = min(initial_delay * (2 ** attempt), max_delay)
-            print(f"  Attempt {attempt + 1}: {delay}s")
-
-        # Verify the sequence: 1s, 2s, 4s, 8s, 16s
-        expected = [1.0, 2.0, 4.0, 8.0, 16.0]
-        actual = [min(initial_delay * (2 ** i), max_delay) for i in range(5)]
-
-        assert actual == expected, f"Expected {expected}, got {actual}"
-        print("✅ Exponential backoff sequence correct")
-
-        return True
-    except Exception as e:
-        print(f"❌ Backoff calculation failed: {e}")
-        return False
-
-def test_api_integration():
-    """Test that api.py imports webhook module correctly"""
-    print("\n" + "=" * 60)
-    print("TEST 6: API Integration")
-    print("=" * 60)
-
-    try:
-        # Check if api.py can import webhook module
-        api_path = os.path.join(os.path.dirname(__file__), 'deploy', 'docker', 'api.py')
-        with open(api_path, 'r') as f:
-            api_content = f.read()
-
-        if 'from webhook import WebhookDeliveryService' in api_content:
-            print("✅ api.py imports WebhookDeliveryService")
-        else:
-            print("❌ api.py missing webhook import")
-            return False
-
-        if 'WebhookDeliveryService(config)' in api_content:
-            print("✅ api.py initializes WebhookDeliveryService")
-        else:
-            print("❌ api.py doesn't initialize WebhookDeliveryService")
-            return False
-
-        if 'notify_job_completion' in api_content:
-            print("✅ api.py calls notify_job_completion")
-        else:
-            print("❌ api.py doesn't call notify_job_completion")
-            return False
-
-        return True
-    except Exception as e:
-        print(f"❌ API integration check failed: {e}")
-        return False
-
-def main():
-    """Run all tests"""
-    print("\n🧪 Webhook Implementation Validation Tests")
-    print("=" * 60)
-
-    results = []
-
-    # Run tests
-    results.append(("Module Imports", test_imports()))
-    results.append(("Service Initialization", test_webhook_service_init()))
-    results.append(("Config Model", test_webhook_config_model()))
-    results.append(("Payload Construction", test_payload_construction()))
-    results.append(("Exponential Backoff", test_exponential_backoff()))
-    results.append(("API Integration", test_api_integration()))
-
-    # Print summary
-    print("\n" + "=" * 60)
-    print("TEST SUMMARY")
-    print("=" * 60)
-
-    passed = sum(1 for _, result in results if result)
-    total = len(results)
-
-    for test_name, result in results:
-        status = "✅ PASS" if result else "❌ FAIL"
-        print(f"{status} - {test_name}")
-
-    print(f"\n{'=' * 60}")
-    print(f"Results: {passed}/{total} tests passed")
-    print(f"{'=' * 60}")
-
-    if passed == total:
-        print("\n🎉 All tests passed! Webhook implementation is valid.")
-        return 0
-    else:
-        print(f"\n⚠️  {total - passed} test(s) failed. Please review the output above.")
-        return 1
-
-if __name__ == "__main__":
-    exit(main())
diff --git a/tests/browser/test_css_selector_injection.py b/tests/browser/test_css_selector_injection.py
new file mode 100644
index 000000000..1e8f88898
--- /dev/null
+++ b/tests/browser/test_css_selector_injection.py
@@ -0,0 +1,59 @@
+"""css_selector is a selector, never script text.
+
+_crawl_web used to paste each selector into an f-string that it evaluated in
+the page, so a '"' in the value closed the string literal and the rest ran as
+JavaScript (0.9.5 report). The selector is now passed to the page as an
+argument. Loopback only; needs a local Chromium.
+"""
+import asyncio
+import threading
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+import pytest
+
+from crawl4ai import AsyncWebCrawler, BrowserConfig, CrawlerRunConfig
+
+PAGE = b'<html><body><p title="x">quoted</p><p>other</p></body></html>'
+
+
+@pytest.fixture
+def server():
+    hits = []
+
+    class H(BaseHTTPRequestHandler):
+        def do_GET(self):
+            hits.append(self.path)
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html")
+            self.end_headers()
+            self.wfile.write(PAGE)
+
+        def log_message(self, *a):
+            pass
+
+    srv = HTTPServer(("127.0.0.1", 0), H)
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    yield f"http://127.0.0.1:{srv.server_address[1]}", hits
+    srv.shutdown()
+
+
+async def _crawl(url, selector):
+    async with AsyncWebCrawler(config=BrowserConfig(headless=True, verbose=False)) as c:
+        return await c.arun(url=url, config=CrawlerRunConfig(css_selector=selector))
+
+
+@pytest.mark.asyncio
+async def test_css_selector_cannot_inject_javascript(server):
+    base, hits = server
+    payload = f'*"))+fetch("{base}/pwned")+Array.from(document.querySelectorAll("*'
+    await _crawl(f"{base}/page", payload)
+    await asyncio.sleep(0.5)
+    assert "/pwned" not in hits
+
+
+@pytest.mark.asyncio
+async def test_css_selector_with_quotes_still_selects(server):
+    base, _ = server
+    result = await _crawl(f"{base}/page", 'p[title="x"]')
+    assert "quoted" in result.html
+    assert "other" not in result.html
diff --git a/tests/cli/test_cli.py b/tests/cli/test_cli.py
index ed8f6d71a..67770cbdc 100644
--- a/tests/cli/test_cli.py
+++ b/tests/cli/test_cli.py
@@ -253,5 +253,38 @@ def test_single_crawl_markdown_output_unchanged(self, runner):
             assert 'Content here' in result.output
 
 
+def test_json_output_without_extractor_fails_early(runner):
+    with patch("crawl4ai.cli.anyio.run") as run:
+        result = runner.invoke(cli, ["crawl", "https://example.com", "-o", "json"])
+    assert result.exit_code == 2
+    assert "-o json needs an extraction strategy" in result.output
+    run.assert_not_called()  # browser never started
+
+
+def test_json_output_with_question_is_allowed(runner):
+    with patch("crawl4ai.cli.anyio.run") as run, \
+         patch("crawl4ai.cli.setup_llm_config", return_value=("openai/gpt-4o", "x")):
+        runner.invoke(cli, ["crawl", "https://example.com", "-o", "json", "-q", "hi"])
+    run.assert_called()  # no early error
+
+
+def _crawler_cfg(runner, *args):
+    with patch("crawl4ai.cli.anyio.run") as run:
+        runner.invoke(cli, ["crawl", "https://example.com", "-o", "md", *args])
+    return run.call_args.args[3]
+
+
+def test_cache_bypassed_by_default(runner):
+    from crawl4ai import CacheMode
+    assert _crawler_cfg(runner).cache_mode == CacheMode.BYPASS
+
+
+def test_crawler_param_cache_mode_is_honored(runner):
+    # #2365: -c cache_mode=enabled was overridden and kept as a plain string
+    from crawl4ai import CacheMode
+    assert _crawler_cfg(runner, "-c", "cache_mode=enabled").cache_mode == CacheMode.ENABLED
+    assert _crawler_cfg(runner, "-c", "cache_mode=enabled", "-bc").cache_mode == CacheMode.BYPASS
+
+
 if __name__ == '__main__':
     pytest.main(['-v', '-s', '--tb=native', __file__])
diff --git a/tests/deep_crawling/test_bfs_max_pages_next_level.py b/tests/deep_crawling/test_bfs_max_pages_next_level.py
new file mode 100644
index 000000000..973b7852e
--- /dev/null
+++ b/tests/deep_crawling/test_bfs_max_pages_next_level.py
@@ -0,0 +1,111 @@
+"""BFS deep crawl must not fetch more than max_pages pages (#2338)."""
+
+from collections import Counter
+
+import pytest
+
+from crawl4ai import CrawlerRunConfig
+from crawl4ai.deep_crawling import BFSDeepCrawlStrategy
+from crawl4ai.models import CrawlResult
+
+
+def _result(url, links):
+    r = CrawlResult(url=url, html="", success=True)
+    r.links = {"internal": [{"href": h} for h in links], "external": []}
+    return r
+
+
+@pytest.mark.asyncio
+async def test_link_discovery_budget_counts_next_level():
+    strategy = BFSDeepCrawlStrategy(max_depth=2, max_pages=50)
+    strategy._pages_crawled = 36  # 14 pages of budget left
+
+    visited = set()
+    next_level = []
+    depths = {}
+    for p in range(35):
+        parent = f"https://example.com/p{p}"
+        links = [f"https://example.com/p{p}/c{i}" for i in range(30)]
+        await strategy.link_discovery(
+            _result(parent, links), parent, 1, visited, next_level, depths
+        )
+
+    assert len(next_level) == 14
+
+
+# A home page that links to 35 pages, each of which links to 30 more.
+ROOT = "https://example.com/"
+
+
+def _tree_links(url):
+    if url == ROOT:
+        return [f"https://example.com/p{i}" for i in range(35)]
+    if url.count("/") == 3:
+        return [f"{url}/c{j}" for j in range(30)]
+    return []
+
+
+# Every page links to a shared 10-link menu plus 3 pages of its own.
+MENU = [f"https://example.com/m{i}" for i in range(10)]
+
+
+def _menu_links(url):
+    return MENU + [f"{url.rstrip('/')}/n{j}" for j in range(3)]
+
+
+class FakeCrawler:
+    def __init__(self, links=_tree_links):
+        self.links = links
+        self.fetched = 0
+
+    def _results(self, urls):
+        self.fetched += len(urls)
+        return [_result(u, self.links(u)) for u in urls]
+
+    async def arun_many(self, urls, config):
+        results = self._results(urls)
+        if not config.stream:
+            return results
+
+        async def gen():
+            for r in results:
+                yield r
+
+        return gen()
+
+
+@pytest.mark.asyncio
+async def test_batch_crawl_stops_at_max_pages():
+    strategy = BFSDeepCrawlStrategy(max_depth=2, max_pages=50)
+    crawler = FakeCrawler()
+    results = await strategy._arun_batch(ROOT, crawler, CrawlerRunConfig())
+    assert crawler.fetched == 50
+    assert len(results) == 50
+    depths = Counter(r.metadata["depth"] for r in results)
+    assert depths == {0: 1, 1: 35, 2: 14}
+
+
+@pytest.mark.asyncio
+async def test_batch_crawl_stops_at_max_pages_shared_menu():
+    strategy = BFSDeepCrawlStrategy(max_depth=3, max_pages=50)
+    crawler = FakeCrawler(_menu_links)
+    results = await strategy._arun_batch(ROOT, crawler, CrawlerRunConfig())
+    assert crawler.fetched == 50
+    assert len(results) == 50
+
+
+@pytest.mark.asyncio
+async def test_stream_crawl_fetches_at_most_max_pages():
+    strategy = BFSDeepCrawlStrategy(max_depth=2, max_pages=50)
+    crawler = FakeCrawler()
+    config = CrawlerRunConfig(stream=True)
+    [r async for r in strategy._arun_stream(ROOT, crawler, config)]
+    assert crawler.fetched == 50
+
+
+@pytest.mark.asyncio
+async def test_batch_crawl_without_max_pages_crawls_everything():
+    strategy = BFSDeepCrawlStrategy(max_depth=2)
+    crawler = FakeCrawler()
+    results = await strategy._arun_batch(ROOT, crawler, CrawlerRunConfig())
+    assert len(results) == 1 + 35 + 35 * 30
diff --git a/tests/deep_crawling/test_deep_crawl_reuse_2309.py b/tests/deep_crawling/test_deep_crawl_reuse_2309.py
new file mode 100644
index 000000000..3756e2c5d
--- /dev/null
+++ b/tests/deep_crawling/test_deep_crawl_reuse_2309.py
@@ -0,0 +1,98 @@
+"""
+Regression tests for #2309: reusing a deep crawl strategy must not carry the
+previous run's max_pages budget into a fresh run.
+
+A fresh run (no resume_state) starts its page counter at zero; a resumed run
+still continues from the saved pages_crawled.
+"""
+
+import pytest
+from unittest.mock import MagicMock
+
+from crawl4ai.deep_crawling import (
+    BFSDeepCrawlStrategy,
+    DFSDeepCrawlStrategy,
+    BestFirstCrawlingStrategy,
+)
+
+
+STRATEGIES = [BFSDeepCrawlStrategy, DFSDeepCrawlStrategy, BestFirstCrawlingStrategy]
+
+
+def create_mock_config(stream=False):
+    config = MagicMock()
+    config.stream = stream
+
+    def clone_config(**kwargs):
+        new_config = MagicMock()
+        new_config.stream = kwargs.get("stream", stream)
+        new_config.clone = MagicMock(side_effect=clone_config)
+        return new_config
+
+    config.clone = MagicMock(side_effect=clone_config)
+    return config
+
+
+def create_mock_crawler():
+    """Crawler that succeeds on every URL; each start page links to one child."""
+
+    async def mock_arun_many(urls, config):
+        results = []
+        for url in urls:
+            result = MagicMock()
+            result.url = url
+            result.success = True
+            result.metadata = {}
+            links = [] if url.endswith("/child") else [{"href": f"{url}/child"}]
+            result.links = {"internal": links, "external": []}
+            results.append(result)
+
+        if config.stream:
+            async def gen():
+                for r in results:
+                    yield r
+            return gen()
+        return results
+
+    crawler = MagicMock()
+    crawler.arun_many = mock_arun_many
+    return crawler
+
+
+async def run_strategy(strategy, start_url, stream):
+    config = create_mock_config(stream=stream)
+    if stream:
+        gen = await strategy.arun(start_url, create_mock_crawler(), config)
+        return [r async for r in gen]
+    return await strategy.arun(start_url, create_mock_crawler(), config)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("strategy_cls", STRATEGIES)
+@pytest.mark.parametrize("stream", [False, True])
+async def test_reused_strategy_gets_fresh_page_budget(strategy_cls, stream):
+    # Each run crawls two pages (start + child), below max_pages, so only a
+    # counter leaked from the previous run can cut the second run short.
+    strategy = strategy_cls(max_depth=1, max_pages=3)
+
+    for url in ["https://example.test/first", "https://example.test/second"]:
+        results = await run_strategy(strategy, url, stream)
+        assert sorted(r.url for r in results) == [url, f"{url}/child"]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("stream", [False, True])
+async def test_resumed_run_keeps_saved_page_count(stream):
+    saved_state = {
+        "strategy_type": "bfs",
+        "visited": ["https://example.test/"],
+        "pending": [{"url": "https://example.test/next", "parent_url": "https://example.test/"}],
+        "depths": {"https://example.test/": 0, "https://example.test/next": 1},
+        "pages_crawled": 1,
+    }
+    strategy = BFSDeepCrawlStrategy(max_depth=2, max_pages=1, resume_state=saved_state)
+
+    results = await run_strategy(strategy, "https://example.test/", stream)
+
+    # The saved run already used the whole budget, so nothing more is crawled.
+    assert results == []
diff --git a/tests/proxy/test_http_proxy_url_encoding.py b/tests/proxy/test_http_proxy_url_encoding.py
new file mode 100644
index 000000000..9e7515a13
--- /dev/null
+++ b/tests/proxy/test_http_proxy_url_encoding.py
@@ -0,0 +1,27 @@
+import pytest
+from yarl import URL
+
+from crawl4ai.async_configs import ProxyConfig
+from crawl4ai.async_crawler_strategy import AsyncHTTPCrawlerStrategy
+
+
+@pytest.mark.parametrize(
+    "password", ["plainpass", "p@ss", "p#ss", "pa/ss", "p?ss", "p%41ss"]
+)
+def test_proxy_url_roundtrips_credentials(password):
+    strategy = AsyncHTTPCrawlerStrategy()
+    config = ProxyConfig(server="http://host:8080", username="us:er", password=password)
+    url = URL(strategy._format_proxy_url(config))
+    assert url.host == "host"
+    assert url.port == 8080
+    assert url.user == "us:er"
+    assert url.password == password
+
+
+def test_encoded_proxy_string_is_sent_once_encoded():
+    strategy = AsyncHTTPCrawlerStrategy()
+    config = ProxyConfig.from_string("http://user:p%40ss@host:8080")
+    assert config.password == "p@ss"
+    url = URL(strategy._format_proxy_url(config))
+    assert url.user == "user"
+    assert url.password == "p@ss"
diff --git a/tests/test_http_proxy_error_redaction_2326.py b/tests/test_http_proxy_error_redaction_2326.py
new file mode 100644
index 000000000..d501ffebe
--- /dev/null
+++ b/tests/test_http_proxy_error_redaction_2326.py
@@ -0,0 +1,93 @@
+"""
+Tests for #2326: errors raised by AsyncHTTPCrawlerStrategy._handle_http must not
+carry the proxy password, in the message or in the traceback.
+
+Offline: the proxy is 127.0.0.1 on a port nothing listens on.
+"""
+import socket
+import traceback
+
+import pytest
+
+from crawl4ai.async_configs import CrawlerRunConfig, ProxyConfig
+from crawl4ai.async_crawler_strategy import (
+    AsyncHTTPCrawlerStrategy,
+    ConnectionTimeoutError,
+    HTTPCrawlerError,
+)
+
+redact = AsyncHTTPCrawlerStrategy._redact_proxy_credentials
+wrap = AsyncHTTPCrawlerStrategy._wrap_error
+
+
+def closed_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+class TestRedactProxyCredentials:
+    @pytest.mark.parametrize("password", ["s3cret", "s3cret#pw", "pa/ss", "a?b", "50%off", "p@ss"])
+    def test_the_password_does_not_survive(self, password):
+        proxy_url = f"http://user:{password}@127.0.0.1:9"
+        message = f"Cannot connect via {proxy_url}: refused"
+        out = redact(message, proxy_url)
+        assert password not in out
+        assert "127.0.0.1:9" in out
+
+    def test_a_percent_encoded_proxy_url_is_matched_in_its_decoded_form(self):
+        proxy_url = "http://user:s3cret%23pw@127.0.0.1:9"
+        out = redact("http://user:s3cret#pw@127.0.0.1:9", proxy_url)
+        assert "s3cret" not in out
+
+    def test_credentials_in_any_url_are_masked_without_a_proxy_url(self):
+        out = redact("Proxy http://user:secret@host:8080 failed", None)
+        assert out == "Proxy http://***@host:8080 failed"
+
+    def test_a_message_without_credentials_is_unchanged(self):
+        message = "Cannot connect to host 127.0.0.1:9 ssl:default"
+        assert redact(message, "http://127.0.0.1:9") == message
+        assert redact(message, "http://user:secret@127.0.0.1:9") == message
+
+
+class TestWrapError:
+    def test_the_original_is_kept_out_of_the_traceback_when_it_held_credentials(self):
+        proxy_url = "http://user:s3cret#pw@127.0.0.1:9"
+        try:
+            try:
+                raise ValueError(proxy_url)
+            except ValueError as e:
+                raise wrap(HTTPCrawlerError, "HTTP client error", e, proxy_url)
+        except HTTPCrawlerError as err:
+            printed = "".join(traceback.format_exception(err))
+        assert "s3cret" not in printed
+        assert "HTTP client error: http://***@127.0.0.1:9" in printed
+
+    def test_the_original_stays_in_the_traceback_when_it_held_none(self):
+        try:
+            try:
+                raise TimeoutError("read timed out")
+            except TimeoutError as e:
+                raise wrap(ConnectionTimeoutError, "Request timed out", e, None)
+        except ConnectionTimeoutError as err:
+            printed = "".join(traceback.format_exception(err))
+            message = str(err)
+        assert "During handling of the above exception" in printed
+        assert message == "Request timed out: read timed out"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("password", ["s3cret", "s3cret#pw", "pa/ss"])
+async def test_handle_http_raises_without_the_password(password):
+    port = closed_port()
+    config = CrawlerRunConfig(
+        proxy_config=ProxyConfig(
+            server=f"http://127.0.0.1:{port}", username="user", password=password
+        )
+    )
+    strategy = AsyncHTTPCrawlerStrategy()
+    with pytest.raises(Exception) as caught:
+        await strategy._handle_http(f"http://127.0.0.1:{port}/", config)
+    await strategy.close()
+    printed = "".join(traceback.format_exception(caught.value))
+    assert password not in printed
diff --git a/tests/test_issue_1837_config_list.py b/tests/test_issue_1837_config_list.py
index 45150e589..0e017be92 100644
--- a/tests/test_issue_1837_config_list.py
+++ b/tests/test_issue_1837_config_list.py
@@ -88,11 +88,11 @@ class TestConfigListLogic:
     """Verify the branching logic for single vs list configs."""
 
     def test_api_uses_config_list_when_provided(self):
-        """When crawler_configs is provided with multiple URLs, it should be used."""
+        """When crawler_configs is provided, it should be used, for one URL or many."""
         with open("deploy/docker/api.py") as f:
             source = f.read()
         # Should check crawler_configs and build a list
-        assert "if crawler_configs and len(urls) > 1:" in source
+        assert "_load_crawler_configs(crawler_configs, base_config)" in source
         assert "config_list" in source
 
     def test_api_falls_back_to_single_config(self):
@@ -125,12 +125,14 @@ def test_server_passes_crawler_configs(self):
 class TestBackwardCompatibility:
     """Ensure existing single-config requests still work."""
 
-    def test_single_url_ignores_crawler_configs(self):
-        """With a single URL, crawler_configs should be ignored (uses arun, not arun_many)."""
+    def test_single_url_with_config_list_uses_arun_many(self):
+        """A config list goes to arun_many even for a single URL (arun takes one config).
+
+        Behavioral coverage: deploy/docker/tests/test_crawler_configs_routing.py.
+        """
         with open("deploy/docker/api.py") as f:
             source = f.read()
-        # Single URL uses arun which only takes one config
-        assert '"arun" if len(urls) == 1 else "arun_many"' in source
+        assert "use_many = len(urls) > 1 or isinstance(effective_config, list)" in source
 
     def test_no_crawler_configs_uses_single(self):
         """When crawler_configs is None, the original single config path is used."""
diff --git a/tests/test_issue_2233_mcp_sse.py b/tests/test_issue_2233_mcp_sse.py
new file mode 100644
index 000000000..54bad8998
--- /dev/null
+++ b/tests/test_issue_2233_mcp_sse.py
@@ -0,0 +1,96 @@
+"""
+Issue #2233: MCP SSE rejects tool calls that are POSTed before initialize.
+
+Each SSE message is its own HTTP POST, so a fan-out client can land
+tools/call in the session inbox ahead of the handshake and get JSON-RPC
+-32602 ("Received request before initialization was complete").
+_sse_init_gate reorders the inbox so the handshake always goes first.
+"""
+import sys
+from pathlib import Path
+
+import anyio
+import pytest
+from mcp.shared.message import SessionMessage
+from mcp.types import JSONRPCMessage
+from pydantic import TypeAdapter
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "deploy" / "docker"))
+mcp_bridge = pytest.importorskip("mcp_bridge")
+
+
+def _msg(method: str, id_: int | None = None) -> SessionMessage:
+    body = {"jsonrpc": "2.0", "method": method, "params": {}}
+    if id_ is not None:
+        body["id"] = id_
+    return SessionMessage(TypeAdapter(JSONRPCMessage).validate_python(body))
+
+
+def _key(m: SessionMessage) -> tuple:
+    root = getattr(m.message, "root", m.message)
+    return (root.method, getattr(root, "id", None))
+
+
+async def _run_gate(inbound: list[SessionMessage]) -> list[tuple]:
+    """Send every message, close the inbox, return what the gate forwarded."""
+    in_send, in_recv = anyio.create_memory_object_stream(100)
+    out_send, out_recv = anyio.create_memory_object_stream(100)
+    async with anyio.create_task_group() as tg:
+        tg.start_soon(mcp_bridge._sse_init_gate, in_recv, out_send)
+        async with in_send:
+            for m in inbound:
+                await in_send.send(m)
+    return [_key(m) async for m in out_recv]
+
+
+def test_tool_calls_posted_before_initialize_are_reordered():
+    # The race from #2233: three tool calls beat the handshake.
+    out = anyio.run(_run_gate, [
+        _msg("tools/call", 1),
+        _msg("tools/call", 2),
+        _msg("tools/call", 3),
+        _msg("initialize", 0),
+        _msg("notifications/initialized"),
+    ])
+    assert out == [
+        ("initialize", 0),
+        ("notifications/initialized", None),
+        ("tools/call", 1),
+        ("tools/call", 2),
+        ("tools/call", 3),
+    ]
+
+
+def test_well_behaved_client_is_passed_through_unchanged():
+    seq = [
+        _msg("initialize", 0),
+        _msg("notifications/initialized"),
+        _msg("tools/list", 1),
+        _msg("tools/call", 2),
+    ]
+    out = anyio.run(_run_gate, seq)
+    assert out == [_key(m) for m in seq]
+
+
+def test_missing_handshake_is_flushed_after_timeout():
+    # Inbox stays OPEN, so only the timeout can release the parked calls.
+    async def body():
+        in_send, in_recv = anyio.create_memory_object_stream(100)
+        out_send, out_recv = anyio.create_memory_object_stream(100)
+        async with anyio.create_task_group() as tg:
+            tg.start_soon(mcp_bridge._sse_init_gate, in_recv, out_send, 0.2)
+            await in_send.send(_msg("tools/call", 1))
+            await in_send.send(_msg("tools/call", 2))
+            with anyio.fail_after(2):
+                got = [_key(await out_recv.receive()) for _ in range(2)]
+            await in_send.aclose()
+        return got
+
+    assert anyio.run(body) == [("tools/call", 1), ("tools/call", 2)]
+
+
+def test_disconnect_while_parked_drops_parked_messages():
+    # Client hangs up before the handshake: parked calls must not be flushed
+    # into a session whose output stream is already gone.
+    out = anyio.run(_run_gate, [_msg("tools/call", 1), _msg("tools/call", 2)])
+    assert out == []
diff --git a/tests/test_issue_2328_inline_whitespace.py b/tests/test_issue_2328_inline_whitespace.py
new file mode 100644
index 000000000..659975876
--- /dev/null
+++ b/tests/test_issue_2328_inline_whitespace.py
@@ -0,0 +1,38 @@
+"""
+Tests for issue #2328: whitespace-only inline elements removed from
+cleaned_html, merging words in raw_markdown.
+"""
+
+import pytest
+from crawl4ai.content_scraping_strategy import LXMLWebScrapingStrategy
+from crawl4ai.markdown_generation_strategy import DefaultMarkdownGenerator
+
+
+@pytest.fixture
+def strategy():
+    return LXMLWebScrapingStrategy()
+
+
+SPLIT_HTML = (
+    "<html><body><p><span>H</span><span>i</span><span> </span>"
+    "<span>t</span><span>h</span><span>e</span><span>r</span><span>e</span></p>"
+    "<p>plain text stays fine</p></body></html>"
+)
+
+
+def test_whitespace_span_between_words_is_kept_in_markdown(strategy):
+    result = strategy._scrap("http://test.com", SPLIT_HTML)
+    md = DefaultMarkdownGenerator().generate_markdown(
+        input_html=result["cleaned_html"], base_url="http://test.com"
+    )
+    assert "Hi there" in md.raw_markdown
+    assert "plain text stays fine" in md.raw_markdown
+
+
+def test_whitespace_spans_between_several_words(strategy):
+    html = "<html><body><p><span>one</span><span> </span><span>two</span><span> </span><span>three</span></p></body></html>"
+    result = strategy._scrap("http://test.com", html)
+    md = DefaultMarkdownGenerator().generate_markdown(
+        input_html=result["cleaned_html"], base_url="http://test.com"
+    )
+    assert "one two three" in md.raw_markdown
diff --git a/tests/test_unclosed_noscript.py b/tests/test_unclosed_noscript.py
new file mode 100644
index 000000000..27e096813
--- /dev/null
+++ b/tests/test_unclosed_noscript.py
@@ -0,0 +1,113 @@
+"""
+Tests for pages whose body ends up nested inside an unclosed <noscript>.
+
+A page that nests <noscript> (for example a lazy-load plugin wrapping Google Tag
+Manager's own noscript) loses its outer closing tag when a scripting-enabled
+browser serializes it. Re-parsed by lxml, the rest of the document becomes a
+child of the still-open <noscript>, and the scraper's noscript removal used to
+delete the entire page, leaving cleaned_html with an empty body.
+"""
+
+import pytest
+
+from crawl4ai.content_scraping_strategy import (
+    LXMLWebScrapingStrategy,
+    unwrap_orphaned_noscript,
+)
+
+# Shape of page.content() for such a page: two opening tags, one closing tag.
+DAMAGED_CAPTURE = """
+<html>
+<head><title>Example shop</title></head>
+<body>
+<noscript><iframe src="about:blank" height="0" width="0"></iframe><noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-TEST" height="0" width="0"></iframe></noscript>
+<div class="site-content">
+    <h1>Unstunned. Hand slaughtered. Halal certified.</h1>
+    <p>Our entire assortment is strictly halal, prepared by qualified staff.</p>
+</div>
+</body>
+</html>
+"""
+
+
+@pytest.fixture
+def strategy():
+    return LXMLWebScrapingStrategy()
+
+
+def test_body_nested_in_unclosed_noscript_is_kept(strategy):
+    result = strategy.scrap("https://example.com/", DAMAGED_CAPTURE)
+
+    assert "Unstunned. Hand slaughtered. Halal certified." in result.cleaned_html
+    assert "strictly halal" in result.cleaned_html
+
+
+def test_balanced_noscript_is_still_removed(strategy):
+    html = (
+        "<html><body>"
+        "<noscript><p>Please enable JavaScript</p></noscript>"
+        "<p>Real page copy that should be kept.</p>"
+        "</body></html>"
+    )
+
+    result = strategy.scrap("https://example.com/", html)
+
+    assert "Please enable JavaScript" not in result.cleaned_html
+    assert "Real page copy that should be kept." in result.cleaned_html
+
+
+def test_unwrap_leaves_well_formed_documents_untouched():
+    html = "<html><body><noscript><p>fallback</p></noscript><p>copy</p></body></html>"
+
+    assert unwrap_orphaned_noscript(html) == html
+
+
+def test_unwrap_removes_tags_but_keeps_contents():
+    unwrapped = unwrap_orphaned_noscript(DAMAGED_CAPTURE)
+
+    assert "noscript" not in unwrapped
+    assert "<h1>Unstunned. Hand slaughtered. Halal certified.</h1>" in unwrapped
+
+
+def test_fit_html_keeps_body_nested_in_unclosed_noscript():
+    from crawl4ai.utils import preprocess_html_for_schema
+
+    fit_html = preprocess_html_for_schema(DAMAGED_CAPTURE, text_threshold=500, max_size=300_000)
+
+    assert "Unstunned. Hand slaughtered. Halal certified." in fit_html
+
+
+@pytest.mark.parametrize(
+    "decoy",
+    [
+        '<script>const sample = "<noscript>";</script>',
+        "<style>/* <noscript> */</style>",
+        "<!-- <noscript> -->",
+    ],
+)
+def test_noscript_text_in_script_style_or_comment_is_not_counted(strategy, decoy):
+    html = (
+        "<html><body>"
+        f"{decoy}"
+        "<noscript>Please enable JavaScript</noscript>"
+        "<h1>Real heading</h1>"
+        "</body></html>"
+    )
+
+    result = strategy.scrap("https://example.com/", html)
+
+    assert "Please enable JavaScript" not in result.cleaned_html
+    assert "Real heading" in result.cleaned_html
+
+
+@pytest.mark.parametrize("opener", ["<!--", "<script>", "<style>"])
+def test_many_unclosed_raw_text_openers_stay_fast(opener):
+    import time
+
+    html = (opener + "a" * 42) * 20_000  # about 1 MB
+
+    start = time.time()
+    unwrap_orphaned_noscript(html)
+
+    # Quadratic matching took over a minute here; linear takes milliseconds.
+    assert time.time() - start < 2
diff --git a/tests/unit/test_browser_tls_sandbox_flags.py b/tests/unit/test_browser_tls_sandbox_flags.py
new file mode 100644
index 000000000..6034ffda4
--- /dev/null
+++ b/tests/unit/test_browser_tls_sandbox_flags.py
@@ -0,0 +1,139 @@
+"""TLS verification and Chromium sandbox launch flags.
+
+ignore_https_errors=False must really verify certificates. A launch flag like
+--ignore-certificate-errors turns verification off for the whole browser, so
+the context option would have no effect. The end-to-end tests crawl a local
+HTTPS server with a self-signed certificate on every launch path.
+
+CRAWL4AI_CHROMIUM_SANDBOX=true must run Chromium with its sandbox on.
+"""
+
+import asyncio
+import http.server
+import secrets
+import ssl
+import subprocess
+import threading
+
+import pytest
+
+from crawl4ai import AsyncWebCrawler, BrowserConfig, CacheMode, CrawlerRunConfig
+from crawl4ai.browser_manager import BrowserManager, ManagedBrowser
+
+CERT_FLAGS = ("--ignore-certificate-errors", "--ignore-certificate-errors-spki-list")
+
+
+def _has_cert_flag(args):
+    return any(a.split("=", 1)[0] in CERT_FLAGS for a in args)
+
+
+# ── launch flag construction (no browser) ──────────────────────────────
+
+
+@pytest.mark.parametrize("ignore", [True, False])
+def test_build_browser_args_has_no_cert_flag(ignore):
+    bc = BrowserConfig(headless=True, ignore_https_errors=ignore)
+    assert not _has_cert_flag(BrowserManager(browser_config=bc)._build_browser_args()["args"])
+
+
+@pytest.mark.parametrize("ignore", [True, False])
+def test_build_browser_flags_has_no_cert_flag(ignore):
+    bc = BrowserConfig(headless=True, ignore_https_errors=ignore)
+    assert not _has_cert_flag(ManagedBrowser.build_browser_flags(bc))
+
+
+@pytest.mark.parametrize("ignore", [True, False])
+def test_managed_subprocess_cert_flag_follows_config(ignore, monkeypatch):
+    """The CDP default context has no ignore_https_errors option, so the
+    subprocess launch carries the flag only when the config asks for it."""
+    bc = BrowserConfig(headless=True, ignore_https_errors=ignore)
+    mb = ManagedBrowser(browser_type="chromium", headless=True, browser_config=bc)
+
+    async def fake_path():
+        return "chromium"
+
+    monkeypatch.setattr(mb, "_get_browser_path", fake_path)
+    args = asyncio.run(mb._get_browser_args())
+    assert _has_cert_flag(args) is ignore
+
+
+def test_sandbox_off_by_default(monkeypatch):
+    monkeypatch.delenv("CRAWL4AI_CHROMIUM_SANDBOX", raising=False)
+    bc = BrowserConfig(headless=True)
+    launch = BrowserManager(browser_config=bc)._build_browser_args()
+    assert "--no-sandbox" in launch["args"]
+    assert not launch.get("chromium_sandbox")
+    assert "--no-sandbox" in ManagedBrowser.build_browser_flags(bc)
+
+
+def test_sandbox_requested_by_env(monkeypatch):
+    monkeypatch.setenv("CRAWL4AI_CHROMIUM_SANDBOX", "true")
+    bc = BrowserConfig(headless=True, extra_args=["--no-sandbox", "--disable-gpu"])
+    launch = BrowserManager(browser_config=bc)._build_browser_args()
+    assert "--no-sandbox" not in launch["args"]
+    assert "--disable-gpu" in launch["args"]
+    assert launch["chromium_sandbox"] is True
+    assert "--no-sandbox" not in ManagedBrowser.build_browser_flags(bc)
+
+
+# ── end to end: self-signed HTTPS origin ───────────────────────────────
+
+
+@pytest.fixture(scope="module")
+def self_signed_origin(tmp_path_factory):
+    work = tmp_path_factory.mktemp("tls")
+    subprocess.run(
+        ["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1",
+         "-subj", "/CN=localhost", "-keyout", str(work / "k.pem"), "-out", str(work / "c.pem")],
+        check=True, capture_output=True,
+    )
+    marker = "tls-marker-" + secrets.token_hex(6)
+    # Padding keeps the page above the anti-bot near-empty threshold.
+    filler = "<p>" + "Plain test content. " * 100 + "</p>"
+    (work / "index.html").write_text(
+        f"<html><head><title>tls</title></head><body><p>{marker}</p>{filler}</body></html>"
+    )
+
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx.load_cert_chain(str(work / "c.pem"), str(work / "k.pem"))
+
+    class Handler(http.server.SimpleHTTPRequestHandler):
+        def __init__(self, *a, **k):
+            super().__init__(*a, directory=str(work), **k)
+
+        def log_message(self, *a):
+            pass
+
+    srv = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    srv.socket = ctx.wrap_socket(srv.socket, server_side=True)
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    yield f"https://localhost:{srv.server_address[1]}/", marker
+    srv.shutdown()
+
+
+async def _crawl(url, **browser_kwargs):
+    bc = BrowserConfig(headless=True, verbose=False, **browser_kwargs)
+    async with AsyncWebCrawler(config=bc) as crawler:
+        r = await crawler.arun(url, config=CrawlerRunConfig(cache_mode=CacheMode.BYPASS))
+    return r.html or ""
+
+
+LAUNCH_MODES = {
+    "playwright_launch": {},
+    "managed_cdp": {"use_managed_browser": True},
+    "persistent_context": {"use_persistent_context": True},
+}
+
+
+@pytest.mark.parametrize("mode", list(LAUNCH_MODES))
+def test_tls_verified_when_ignore_https_errors_false(self_signed_origin, mode):
+    url, marker = self_signed_origin
+    html = asyncio.run(_crawl(url, ignore_https_errors=False, **LAUNCH_MODES[mode]))
+    assert marker not in html, "untrusted certificate accepted with ignore_https_errors=False"
+
+
+@pytest.mark.parametrize("mode", list(LAUNCH_MODES))
+def test_insecure_tls_when_ignore_https_errors_true(self_signed_origin, mode):
+    url, marker = self_signed_origin
+    html = asyncio.run(_crawl(url, ignore_https_errors=True, **LAUNCH_MODES[mode]))
+    assert marker in html, "ignore_https_errors=True no longer reaches a self-signed origin"
diff --git a/tests/unit/test_config_provenance.py b/tests/unit/test_config_provenance.py
index 49246a8e6..009f6af79 100644
--- a/tests/unit/test_config_provenance.py
+++ b/tests/unit/test_config_provenance.py
@@ -96,6 +96,60 @@ def test_trusted_top_level_kwargs_still_deserialize(monkeypatch):
     assert cfg.extraction_strategy.llm_config.api_token == "tok-123"
 
 
+def test_untrusted_delay_fields_are_capped():
+    """delay_before_return_html / mean_delay / max_range are seconds held on a
+    live browser page or used as a rate-limiter base delay. Unclamped, an
+    untrusted body can hold a page (or a whole arun_many batch) open forever."""
+    cfg = CrawlerRunConfig.load(
+        {
+            "type": "CrawlerRunConfig",
+            "params": {
+                "delay_before_return_html": 1e9,
+                "mean_delay": 1e9,
+                "max_range": 1e9,
+            },
+        },
+        provenance=UNTRUSTED,
+    )
+    assert cfg.delay_before_return_html <= 60
+    assert cfg.mean_delay <= 60
+    assert cfg.max_range <= 60
+
+
+def test_untrusted_delay_fields_negative_or_non_numeric_fall_back_to_default():
+    cfg = CrawlerRunConfig.load(
+        {
+            "type": "CrawlerRunConfig",
+            "params": {
+                "delay_before_return_html": -5,
+                "mean_delay": "not-a-number",
+                "max_range": None,
+            },
+        },
+        provenance=UNTRUSTED,
+    )
+    assert cfg.delay_before_return_html == 0.1
+    assert cfg.mean_delay == 0.1
+    assert cfg.max_range == 0.3
+
+
+def test_trusted_delay_fields_are_not_clamped():
+    """TRUSTED (SDK) callers keep the old behavior: no cap applied."""
+    cfg = CrawlerRunConfig.load(
+        {
+            "type": "CrawlerRunConfig",
+            "params": {
+                "delay_before_return_html": 1e9,
+                "mean_delay": 1e9,
+                "max_range": 1e9,
+            },
+        }
+    )
+    assert cfg.delay_before_return_html == 1e9
+    assert cfg.mean_delay == 1e9
+    assert cfg.max_range == 1e9
+
+
 def test_plain_business_dict_with_type_key_still_passes():
     """A JsonCss schema carries "type" keys but is data, not a typed object."""
     schema = {
@@ -116,3 +170,96 @@ def test_plain_business_dict_with_type_key_still_passes():
         provenance=UNTRUSTED,
     )
     assert cfg.extraction_strategy.schema["baseSelector"] == ".item"
+
+
+def _deep_crawl(**params):
+    return {
+        "type": "CrawlerRunConfig",
+        "params": {"deep_crawl_strategy": {"type": "BFSDeepCrawlStrategy", "params": {"max_depth": 2, **params}}},
+    }
+
+
+def test_deep_crawl_allowed_with_opt_in(monkeypatch):
+    monkeypatch.setenv("CRAWL4AI_ALLOW_DEEP_CRAWL", "true")
+    chain = {"type": "FilterChain", "params": {"filters": [
+        {"type": "URLPatternFilter", "params": {"patterns": ["*/blog/*"]}}]}}
+    cfg = CrawlerRunConfig.load(_deep_crawl(filter_chain=chain, max_pages=50), provenance=UNTRUSTED)
+    assert type(cfg.deep_crawl_strategy).__name__ == "BFSDeepCrawlStrategy"
+    assert cfg.deep_crawl_strategy.max_pages == 50
+
+
+@pytest.mark.parametrize("pattern", ["^(a+)+$", "tag*x"])
+def test_deep_crawl_unsafe_pattern_refused(monkeypatch, pattern):
+    monkeypatch.setenv("CRAWL4AI_ALLOW_DEEP_CRAWL", "true")
+    chain = {"type": "FilterChain", "params": {"filters": [
+        {"type": "URLPatternFilter", "params": {"patterns": [pattern]}}]}}
+    with pytest.raises(UntrustedConfigError, match="URLPatternFilter"):
+        CrawlerRunConfig.load(_deep_crawl(filter_chain=chain), provenance=UNTRUSTED)
+
+
+def test_deep_crawl_resume_state_refused(monkeypatch):
+    monkeypatch.setenv("CRAWL4AI_ALLOW_DEEP_CRAWL", "true")
+    data = _deep_crawl(resume_state={"pending": [{"url": "http://169.254.169.254/", "depth": 1}]})
+    with pytest.raises(UntrustedConfigError, match="resume_state"):
+        CrawlerRunConfig.load(data, provenance=UNTRUSTED)
+
+
+def test_deep_crawl_ssl_certificate_refused(monkeypatch):
+    monkeypatch.setenv("CRAWL4AI_ALLOW_DEEP_CRAWL", "true")
+    data = _deep_crawl()
+    data["params"]["fetch_ssl_certificate"] = True
+    with pytest.raises(UntrustedConfigError, match="fetch_ssl_certificate"):
+        CrawlerRunConfig.load(data, provenance=UNTRUSTED)
+
+
+def _pattern_chain(*sizes):
+    return {"type": "FilterChain", "params": {"filters": [
+        {"type": "URLPatternFilter", "params": {"patterns": [f"*/p{i}/*" for i in range(n)]}}
+        for n in sizes]}}
+
+
+@pytest.mark.parametrize("strategy, match", [
+    ({"filter_chain": _pattern_chain(101)}, "limited to 100 items"),
+    ({"filter_chain": _pattern_chain(*(1,) * 20)}, "in total"),
+    ({"filter_chain": _pattern_chain(100, 100, 1)}, "in total"),
+    ({"url_scorer": {"type": "KeywordRelevanceScorer", "params": {
+        "keywords": {"type": "dict", "value": {f"k{i}": 1 for i in range(201)}}}}}, "in total"),
+])
+def test_deep_crawl_size_budget_refused(monkeypatch, strategy, match):
+    monkeypatch.setenv("CRAWL4AI_ALLOW_DEEP_CRAWL", "true")
+    with pytest.raises(UntrustedConfigError, match=match):
+        CrawlerRunConfig.load(_deep_crawl(**strategy), provenance=UNTRUSTED)
+
+
+def test_deep_crawl_nested_composite_scorer_refused(monkeypatch):
+    monkeypatch.setenv("CRAWL4AI_ALLOW_DEEP_CRAWL", "true")
+    inner = {"type": "CompositeScorer", "params": {"scorers": [{"type": "PathDepthScorer", "params": {}}]}}
+    data = _deep_crawl(url_scorer={"type": "CompositeScorer", "params": {"scorers": [inner]}})
+    with pytest.raises(UntrustedConfigError, match="nested"):
+        CrawlerRunConfig.load(data, provenance=UNTRUSTED)
+
+
+def test_url_pattern_star_led_glob_is_linear_and_unchanged():
+    import time
+    from crawl4ai.deep_crawling.filters import URLPatternFilter
+
+    f = URLPatternFilter(["*/blog/*"])
+    assert f.apply("https://x.com/blog/post")
+    assert not f.apply("https://x.com/news/post")
+    start = time.time()
+    assert not f.apply("https://x.com/" + "a" * 50000)
+    assert time.time() - start < 0.5
+
+
+def test_cache_mode_string_is_converted_and_invalid_one_refused():
+    from crawl4ai import CacheMode
+
+    cfg = CrawlerRunConfig.load(
+        {"type": "CrawlerRunConfig", "params": {"cache_mode": "Enabled"}}, provenance=UNTRUSTED
+    )
+    assert cfg.cache_mode == CacheMode.ENABLED
+    # A bad value must be a 400 (UntrustedConfigError), not a ValueError (500).
+    with pytest.raises(UntrustedConfigError, match="cache_mode"):
+        CrawlerRunConfig.load(
+            {"type": "CrawlerRunConfig", "params": {"cache_mode": "nope"}}, provenance=UNTRUSTED
+        )
diff --git a/tests/unit/test_crawl_result_default_shape.py b/tests/unit/test_crawl_result_default_shape.py
new file mode 100644
index 000000000..4311ec176
--- /dev/null
+++ b/tests/unit/test_crawl_result_default_shape.py
@@ -0,0 +1,66 @@
+"""A CrawlResult built without links/media must still have their keys.
+
+Successful crawls fill `links` and `media` from the scraper's result (arun moves
+media's "tables" to CrawlResult.tables). Results built without them -- the
+robots.txt refusal, the "all proxies failed" and exception paths in
+AsyncWebCrawler.arun -- used to default to `{}`, so `result.links["internal"]`
+raised KeyError on exactly the results a batch caller has to handle, and the
+Docker API returned `"links": {}` / `"media": {}` for them.
+"""
+
+from crawl4ai.models import CrawlResult
+
+
+def links_shape():
+    return {"internal": [], "external": []}
+
+
+def media_shape():
+    return {"images": [], "videos": [], "audios": []}
+
+
+def _refused(url="https://example.com/private"):
+    # The shape AsyncWebCrawler.arun returns when robots.txt disallows a URL.
+    return CrawlResult(
+        url=url,
+        html="",
+        success=False,
+        status_code=403,
+        error_message="Access denied by robots.txt",
+    )
+
+
+def test_result_without_links_or_media_has_the_scraped_shape():
+    result = _refused()
+
+    assert result.links == links_shape()
+    assert result.media == media_shape()
+
+
+def test_default_is_not_shared_between_results():
+    first, second = _refused(), _refused("https://example.com/other")
+
+    assert first.links["internal"] is not second.links["internal"]
+    assert first.media["images"] is not second.media["images"]
+
+    first.links["internal"].append({"href": "https://example.com/a"})
+    first.media["images"].append({"src": "https://example.com/a.png"})
+
+    assert second.links == links_shape()
+    assert second.media == media_shape()
+
+
+def test_serialized_result_keeps_the_keys():
+    dumped = _refused().model_dump()
+
+    assert dumped["links"] == links_shape()
+    assert dumped["media"] == media_shape()
+
+
+def test_explicit_values_are_kept():
+    links = {"internal": [{"href": "https://example.com/a"}], "external": []}
+    result = CrawlResult(
+        url="https://example.com/", html="<p></p>", success=True, links=links
+    )
+
+    assert result.links == links
diff --git a/tests/unit/test_domain_filter_host.py b/tests/unit/test_domain_filter_host.py
new file mode 100644
index 000000000..e7d399cae
--- /dev/null
+++ b/tests/unit/test_domain_filter_host.py
@@ -0,0 +1,60 @@
+"""Tests for DomainFilter host extraction (userinfo/port/trailing-dot bypass)."""
+
+from crawl4ai.deep_crawling.filters import DomainFilter
+
+
+def test_blocked_userinfo_bypass():
+    f = DomainFilter(blocked_domains=["evil.com"])
+    assert f.apply("https://user@evil.com/") is False
+
+
+def test_blocked_trailing_dot_bypass():
+    f = DomainFilter(blocked_domains=["evil.com"])
+    assert f.apply("https://evil.com./") is False
+
+
+def test_blocked_port_bypass():
+    f = DomainFilter(blocked_domains=["evil.com"])
+    assert f.apply("https://evil.com:443/") is False
+
+
+def test_blocked_mixed_case():
+    f = DomainFilter(blocked_domains=["evil.com"])
+    assert f.apply("https://EVIL.COM/") is False
+
+
+def test_blocked_subdomain():
+    f = DomainFilter(blocked_domains=["evil.com"])
+    assert f.apply("https://a.evil.com/") is False
+
+
+def test_not_blocked_lookalike_domain():
+    f = DomainFilter(blocked_domains=["evil.com"])
+    assert f.apply("https://notevil.com/") is True
+
+
+def test_blocked_domain_configured_with_trailing_dot():
+    f = DomainFilter(blocked_domains=["evil.com."])
+    assert f.apply("https://evil.com/") is False
+
+
+def test_blocked_domain_configured_uppercase():
+    f = DomainFilter(blocked_domains=["EVIL.COM"])
+    assert f.apply("https://evil.com/") is False
+
+
+def test_allowed_with_port():
+    f = DomainFilter(allowed_domains=["good.com"])
+    assert f.apply("https://good.com:443/") is True
+
+
+def test_allowed_with_trailing_dot():
+    f = DomainFilter(allowed_domains=["good.com"])
+    assert f.apply("https://good.com./") is True
+
+
+def test_allowed_userinfo_spoof_not_allowed():
+    # Userinfo "good.com@evil.com" must not fool the allowlist into
+    # treating the host as good.com; the real host is evil.com.
+    f = DomainFilter(allowed_domains=["good.com"])
+    assert f.apply("https://good.com@evil.com/") is False
diff --git a/tests/unit/test_egress_policy.py b/tests/unit/test_egress_policy.py
index 91202fe4b..b2ae9303c 100644
--- a/tests/unit/test_egress_policy.py
+++ b/tests/unit/test_egress_policy.py
@@ -16,6 +16,7 @@
 
 from crawl4ai import egress_policy
 from crawl4ai.async_url_seeder import AsyncUrlSeeder
+from crawl4ai.cache_validator import CacheValidator
 from crawl4ai.utils import RobotsParser
 
 PROXY = "http://127.0.0.1:9"  # discard port; nothing here connects
@@ -139,6 +140,35 @@ def test_robots_fetch_no_longer_disables_tls_verification(monkeypatch, tmp_path)
     assert calls[0][1].get("ssl", None) is None
 
 
+# ── cache freshness check ──────────────────────────────────────────────
+
+
+def _validator_client():
+    v = CacheValidator()
+    return v, asyncio.run(v._get_client())
+
+
+def test_cache_validator_client_has_no_proxy_by_default():
+    v, client = _validator_client()
+    try:
+        assert _proxy_transport(client) is None
+    finally:
+        asyncio.run(v.close())
+
+
+def test_cache_validator_client_uses_installed_proxy():
+    """check_cache_freshness is untrusted-allowlisted, so this fetch is
+    caller-controlled and must go through the egress proxy like the others."""
+    egress_policy.set_egress_proxy(PROXY)
+    v, client = _validator_client()
+    try:
+        transport = _proxy_transport(client)
+        assert transport is not None
+        assert transport._pool._http2 is True
+    finally:
+        asyncio.run(v.close())
+
+
 # ── untrusted LinkPreviewConfig clamps ─────────────────────────────────
 
 
diff --git a/tests/unit/test_pdf_page_number_race.py b/tests/unit/test_pdf_page_number_race.py
new file mode 100644
index 000000000..110fbd77e
--- /dev/null
+++ b/tests/unit/test_pdf_page_number_race.py
@@ -0,0 +1,174 @@
+"""Regression tests for unclecode/crawl4ai#2319.
+
+`NaivePDFProcessorStrategy.process_batch()` used to keep the page number being
+processed in the shared `self.current_page_number` attribute: each worker thread
+wrote its own page number there, then read it back after text extraction. When
+another worker overwrote it in between, the page-1-only formatting in
+`clean_pdf_text()`/`clean_pdf_text_to_html()` (e.g. Title-Case author-line
+bolding), the `PDFPage.page_number` field, and the extracted image file names
+(`page_{n}_img_{m}`) all landed on the wrong page -- so the same PDF produced
+different markdown on every run with the default `batch_size=4`.
+
+The fix passes the page number down as an explicit argument to `_process_page()`
+and `_extract_images()` instead of storing it on `self`. These tests pin that:
+
+* `process_batch()` output is byte-identical across runs with `batch_size > 1`
+* the page-1-only formatting applies to page 1 and only page 1
+* `PDFPage.page_number` is sequential even under the thread pool
+* the serial `process()` and parallel `process_batch()` paths agree
+
+The test PDFs are hand-crafted minimal files so the tests need no extra
+dependencies beyond pypdf (fpdf2 is not required).
+"""
+
+import pytest
+
+pypdf = pytest.importorskip("pypdf")
+
+from crawl4ai.processors.pdf.processor import NaivePDFProcessorStrategy
+
+N_PAGES = 12
+BATCH_SIZE = 4
+TITLE_CASE_LINE = "Assessment Overview"
+
+
+def _escape_pdf_text(text: str) -> str:
+    return text.replace("\\", "\\\\").replace("(", "\\(").replace(")", "\\)")
+
+
+def _page_lines(page_number: int):
+    return [
+        f"Chapter Heading Number {page_number}",
+        TITLE_CASE_LINE,
+        f"this is the body of page {page_number}. " * 20,
+    ]
+
+
+def _build_pdf(path, n_pages: int = N_PAGES) -> None:
+    """Write a minimal but valid multi-page PDF with plain-text content."""
+    objects = []
+    kids = " ".join(f"{3 + 3 * i} 0 R" for i in range(n_pages))
+    objects.append("<< /Type /Catalog /Pages 2 0 R >>")
+    objects.append(f"<< /Type /Pages /Kids [{kids}] /Count {n_pages} >>")
+    for i in range(n_pages):
+        page_obj = 3 + 3 * i
+        content_obj = page_obj + 1
+        font_obj = page_obj + 2
+        objects.append(
+            f"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] "
+            f"/Contents {content_obj} 0 R "
+            f"/Resources << /Font << /F1 {font_obj} 0 R >> >> >>"
+        )
+        stream_lines = ["BT /F1 12 Tf 72 720 Td"]
+        for j, line in enumerate(_page_lines(i + 1)):
+            if j:
+                stream_lines.append("0 -16 Td")
+            stream_lines.append(f"({_escape_pdf_text(line)}) Tj")
+        stream_lines.append("ET")
+        stream = "\n".join(stream_lines).encode("latin-1")
+        objects.append((f"<< /Length {len(stream)} >>\nstream\n", stream, "\nendstream"))
+        objects.append("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>")
+
+    out = bytearray(b"%PDF-1.4\n")
+    offsets = []
+    for idx, obj in enumerate(objects, start=1):
+        offsets.append(len(out))
+        out += f"{idx} 0 obj\n".encode("latin-1")
+        if isinstance(obj, tuple):
+            out += obj[0].encode("latin-1") + obj[1] + obj[2].encode("latin-1")
+        else:
+            out += obj.encode("latin-1")
+        out += b"\nendobj\n"
+    xref_pos = len(out)
+    out += f"xref\n0 {len(objects) + 1}\n".encode("latin-1")
+    out += b"0000000000 65535 f \n"
+    for off in offsets:
+        out += f"{off:010d} 00000 n \n".encode("latin-1")
+    out += (
+        f"trailer\n<< /Size {len(objects) + 1} /Root 1 0 R >>\n"
+        f"startxref\n{xref_pos}\n%%EOF\n"
+    ).encode("latin-1")
+    path.write_bytes(bytes(out))
+
+
+def _strategy(**kwargs):
+    return NaivePDFProcessorStrategy(extract_images=False, **kwargs)
+
+
+def _bolded_pages(result):
+    return tuple(
+        page.page_number
+        for page in result.pages
+        if f"**{TITLE_CASE_LINE}**" in page.markdown
+    )
+
+
+def test_process_batch_is_deterministic(tmp_path):
+    """Same PDF + batch_size > 1 must give byte-identical output every run."""
+    pdf_path = tmp_path / "determinism.pdf"
+    _build_pdf(pdf_path)
+
+    runs = []
+    for _ in range(10):
+        result = _strategy(batch_size=BATCH_SIZE).process_batch(pdf_path)
+        runs.append(tuple(page.markdown for page in result.pages))
+
+    assert len(set(runs)) == 1, "process_batch output varied between runs (#2319)"
+
+
+def test_page_one_only_formatting_in_batch(tmp_path):
+    """The page-1-only author-line bolding must apply to page 1, never others."""
+    pdf_path = tmp_path / "page_one.pdf"
+    _build_pdf(pdf_path)
+
+    for _ in range(5):
+        result = _strategy(batch_size=BATCH_SIZE).process_batch(pdf_path)
+        assert _bolded_pages(result) == (1,), (
+            "page-1-only formatting leaked onto another page (#2319)"
+        )
+
+
+def test_page_numbers_sequential_in_batch(tmp_path):
+    """PDFPage.page_number must match the page's position, even under threads."""
+    pdf_path = tmp_path / "numbering.pdf"
+    _build_pdf(pdf_path, n_pages=8)
+
+    result = _strategy(batch_size=BATCH_SIZE).process_batch(pdf_path)
+    assert [page.page_number for page in result.pages] == list(range(1, 9))
+
+
+@pytest.mark.parametrize("page_number", [1, 2, 3])
+def test_process_page_uses_given_page_number(page_number):
+    """_process_page() must honor its page_number argument, not shared state."""
+
+    class _StubPage:
+        def extract_text(self, visitor_text=None, **kwargs):
+            text = "\n".join(_page_lines(page_number))
+            if visitor_text is not None:
+                visitor_text(text, None, [0, 0, 0, 0, 0, 0], None, None)
+            return text
+
+        def __contains__(self, key):  # _extract_links checks '/Annots' in page
+            return False
+
+    strategy = _strategy()
+    page = strategy._process_page(_StubPage(), None, page_number)
+
+    assert page.page_number == page_number
+    bolded = f"**{TITLE_CASE_LINE}**" in page.markdown
+    assert bolded == (page_number == 1), (
+        f"page-1-only formatting wrong for page_number={page_number}"
+    )
+
+
+def test_process_and_process_batch_agree(tmp_path):
+    """Serial and batched paths must produce identical per-page markdown/html."""
+    pdf_path = tmp_path / "parity.pdf"
+    _build_pdf(pdf_path)
+
+    serial = _strategy().process(pdf_path)
+    batched = _strategy(batch_size=BATCH_SIZE).process_batch(pdf_path)
+
+    assert [p.markdown for p in serial.pages] == [p.markdown for p in batched.pages]
+    assert [p.html for p in serial.pages] == [p.html for p in batched.pages]
+    assert [p.page_number for p in serial.pages] == [p.page_number for p in batched.pages]
diff --git a/tests/unit/test_untrusted_field_sinks.py b/tests/unit/test_untrusted_field_sinks.py
new file mode 100644
index 000000000..d4dc192ad
--- /dev/null
+++ b/tests/unit/test_untrusted_field_sinks.py
@@ -0,0 +1,126 @@
+"""Allowlisted untrusted fields that reached code, model-load or regex sinks.
+
+Three 0.9.5 reports, one gate (crawl4ai/async_configs.py): a field the
+untrusted gate let through by name still carried code (wait_for "js:..."), a
+HuggingFace repo id (CosineStrategy.model_name), or a regex that backtracks
+for hours with the GIL held (RegexExtractionStrategy.custom,
+RegexChunking.patterns, schema fields of type "regex").
+
+No browser, no network, no model download: everything here is the gate.
+"""
+import pytest
+
+from crawl4ai.async_configs import CrawlerRunConfig, Provenance, UntrustedConfigError
+
+
+def _load(params, provenance=Provenance.UNTRUSTED):
+    return CrawlerRunConfig.load(
+        {"type": "CrawlerRunConfig", "params": params}, provenance=provenance
+    )
+
+
+# ── wait_for ───────────────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "js:() => { fetch('http://x/'); return true; }",
+        "() => { fetch('http://x/'); return true; }",
+        "function () { return true; }",
+    ],
+)
+def test_untrusted_wait_for_javascript_refused(value):
+    with pytest.raises(UntrustedConfigError):
+        _load({"wait_for": value})
+
+
+def test_untrusted_bare_wait_for_is_pinned_to_css():
+    """A bare value used to fall back to JS when it was not a valid selector."""
+    assert _load({"wait_for": "fetch('http://x/'); return true;"}).wait_for == (
+        "css:fetch('http://x/'); return true;"
+    )
+    assert _load({"wait_for": "#main"}).wait_for == "css:#main"
+    assert _load({"wait_for": "css:#main"}).wait_for == "css:#main"
+
+
+def test_trusted_wait_for_unchanged():
+    value = "js:() => true"
+    assert _load({"wait_for": value}, Provenance.TRUSTED).wait_for == value
+
+
+# ── CosineStrategy.model_name ──────────────────────────────────────────
+
+
+def test_untrusted_cosine_model_name_refused():
+    with pytest.raises(UntrustedConfigError):
+        _load({"extraction_strategy": {
+            "type": "CosineStrategy",
+            "params": {"model_name": "attacker-org/evil-model"},
+        }})
+
+
+# ── caller-supplied regex ──────────────────────────────────────────────
+
+
+def test_untrusted_regex_strategy_custom_refused():
+    with pytest.raises(UntrustedConfigError):
+        _load({"extraction_strategy": {
+            "type": "RegexExtractionStrategy",
+            "params": {"custom": {"evil": "(a+)+$"}},
+        }})
+
+
+def test_untrusted_regex_strategy_builtins_still_allowed():
+    cfg = _load({"extraction_strategy": {
+        "type": "RegexExtractionStrategy", "params": {"pattern": 1},
+    }})
+    assert type(cfg.extraction_strategy).__name__ == "RegexExtractionStrategy"
+
+
+def test_untrusted_regex_chunking_patterns_refused():
+    with pytest.raises(UntrustedConfigError):
+        _load({"chunking_strategy": {
+            "type": "RegexChunking", "params": {"patterns": ["(a+)+$"]},
+        }})
+
+
+def _schema(field):
+    return {"name": "x", "baseSelector": "p", "fields": [field]}
+
+
+REGEX_FIELD = {"name": "f", "selector": "span", "type": "regex", "pattern": "(a+)+$"}
+
+
+@pytest.mark.parametrize(
+    "schema",
+    [
+        _schema(REGEX_FIELD),
+        # nested inside another field
+        _schema({"name": "n", "selector": "div", "type": "nested", "fields": [REGEX_FIELD]}),
+        # behind the {"type": "dict", "value": ...} envelope
+        {"type": "dict", "value": _schema(REGEX_FIELD)},
+    ],
+)
+@pytest.mark.parametrize(
+    "strategy",
+    ["JsonCssExtractionStrategy", "JsonXPathExtractionStrategy", "JsonLxmlExtractionStrategy"],
+)
+def test_untrusted_schema_regex_field_refused(strategy, schema):
+    with pytest.raises(UntrustedConfigError):
+        _load({"extraction_strategy": {"type": strategy, "params": {"schema": schema}}})
+
+
+def test_untrusted_schema_without_regex_still_allowed():
+    cfg = _load({"extraction_strategy": {
+        "type": "JsonCssExtractionStrategy",
+        "params": {"schema": _schema({"name": "t", "selector": "h1", "type": "text"})},
+    }})
+    assert type(cfg.extraction_strategy).__name__ == "JsonCssExtractionStrategy"
+
+
+def test_trusted_regex_unchanged():
+    cfg = _load({"chunking_strategy": {
+        "type": "RegexChunking", "params": {"patterns": [r"\n"]},
+    }}, Provenance.TRUSTED)
+    assert cfg.chunking_strategy.patterns == [r"\n"]