diff --git a/Directory.Packages.props b/Directory.Packages.props
index b42f02f..d06175a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -38,8 +38,10 @@
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.12" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
     <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.12" />
+    
     <!-- Upgraded to latest non-vulnerable version -->
-    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.12" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
 
     <!-- Resilience -->
     <PackageVersion Include="Polly" Version="8.8.0" />
diff --git a/docker-compose.yml b/docker-compose.yml
index 4a5190b..0016acd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,48 +24,48 @@ services:
       - CorsOrigins__2=${CORS_ORIGIN_LOCAL:-https://localhost:7208}
       
       # Postgres Database Overrides      
-      - ConnectionStrings__PfmDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=${POSTGRES_DB:-pfm};User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD};
-      - ConnectionStrings__PfmSchedulerDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=pfm-scheduler;User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD};
+      - ConnectionStrings__PfmDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=${POSTGRES_DB:-pfm};User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD:-};
+      - ConnectionStrings__PfmSchedulerDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=pfm-scheduler;User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD:-};
       
       # Garage S3 Settings
       - GeneralS3Settings__ServiceUrl=${GENERAL_S3_SERVICE_URL:-https://s3.garage.khongisa.co.za}
       - GeneralS3Settings__Region=${GENERAL_S3_REGION:-garage}
       - GeneralS3Settings__BucketName=${GENERAL_S3_BUCKET_NAME:-pfm}
       - GeneralS3Settings__CdnBaseUrl=${GENERAL_S3_CDN_BASE_URL:-https://pfm.cdn.khongisa.co.za}
-      - GeneralS3Settings__AccessKey=${GENERAL_S3_ACCESS_KEY}
-      - GeneralS3Settings__SecretKey=${GENERAL_S3_SECRET_KEY}
+      - GeneralS3Settings__AccessKey=${GENERAL_S3_ACCESS_KEY:-}
+      - GeneralS3Settings__SecretKey=${GENERAL_S3_SECRET_KEY:-}
       
       # HashIds overrides
       - HasherSettings__MinHashLength=${HASHER_MIN_HASH_LENGTH:-11}
-      - HasherSettings__Salt=${HASHER_SALT}
+      - HasherSettings__Salt=${HASHER_SALT:-}
 
       # Skoruba Duende Security Overrides
       - SecuritySettings__Authority=${SECURITY_AUTHORITY:-https://sts.security.khongisa.co.za}
-      - SecuritySettings__Audience=${SECURITY_AUDIENCE}
-      - SecuritySettings__ClientId=${SECURITY_CLIENT_ID}
-      - SecuritySettings__ClientSecret=${SECURITY_CLIENT_SECRET}
+      - SecuritySettings__Audience=${SECURITY_AUDIENCE:-}
+      - SecuritySettings__ClientId=${SECURITY_CLIENT_ID:-}
+      - SecuritySettings__ClientSecret=${SECURITY_CLIENT_SECRET:-}
 
       # Skoruba Duende Administration Security Overrides
       - ConnectionStrings__SkorubaApi=${SKORUBA_ADMIN_API:-https://api.security.khongisa.co.za/}
       - MachineIdentitySettings__Authority=${ADMIN_SECURITY_AUTHORITY:-https://sts.security.khongisa.co.za}
-      - MachineIdentitySettings__Scope=${ADMIN_SECURITY_SCOPE}
-      - MachineIdentitySettings__ClientId=${ADMIN_SECURITY_CLIENT_ID}
-      - MachineIdentitySettings__ClientSecret=${ADMIN_SECURITY_CLIENT_SECRET}
+      - MachineIdentitySettings__Scope=${ADMIN_SECURITY_SCOPE:-}
+      - MachineIdentitySettings__ClientId=${ADMIN_SECURITY_CLIENT_ID:-}
+      - MachineIdentitySettings__ClientSecret=${ADMIN_SECURITY_CLIENT_SECRET:-}
 
       # Data Protection Overrides
-      - DataProtection__Certificate=${DATA_PROTECTION_CERTIFICATE}
-      - DataProtection__Password=${DATA_PROTECTION_CERTIFICATE_PASSWORD}
+      - DataProtection__Certificate=${DATA_PROTECTION_CERTIFICATE:-}
+      - DataProtection__Password=${DATA_PROTECTION_CERTIFICATE_PASSWORD:-}
 
       # Monitoring Overrides
       - Monitoring__Address=${MONITORING_ADDRESS:-http://aspire-dashboard-service.aspire.svc.cluster.local:18889}
       - Monitoring__ServiceName=${MONITORING_SERVICE_NAME:-Pfm.DEV}
-      - Monitoring__ApiKey=${MONITORING_API_KEY}
+      - Monitoring__ApiKey=${MONITORING_API_KEY:-}
 
       # Email Processor Overrides
-      - EmailProcessorCron=${EMAIL_PROCESSOR_CRON}
-      - Email__Credentials__Password=${EMAIL_CREDENTIALS_PASSWORD}
-      - Email__Credentials__Username=${EMAIL_CREDENTIALS_USERNAME}
-      - Email__SmtpServer=${EMAIL_SMTP_SERVER}
+      - EmailProcessorCron=${EMAIL_PROCESSOR_CRON:-}
+      - Email__Credentials__Password=${EMAIL_CREDENTIALS_PASSWORD:-}
+      - Email__Credentials__Username=${EMAIL_CREDENTIALS_USERNAME:-}
+      - Email__SmtpServer=${EMAIL_SMTP_SERVER:-}
       - Email__SmtpPort=${EMAIL_SMTP_PORT:-587}
       
       # Redis overrides 
@@ -86,7 +86,7 @@ services:
       - VITE_OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-pfm-console-dev}
       - VITE_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-yoursecret}
       - VITE_HASHER_MIN_LENGTH=${HASHER_MIN_LENGTH:-11}
-      - VITE_HASHER_SALT=${HASHER_SALT}
+      - VITE_HASHER_SALT=${HASHER_SALT:-}
 
       # Backend API Configuration
       - VITE_API_BASE_URL=${API_BASE_URL:-https://api.ifri.khongisa.co.za/}
@@ -106,8 +106,8 @@ services:
       - VITE_OIDC_CLIENT_ID=${PARTNER_VITE_OIDC_CLIENT_ID:-pfm-partner-dev}
       - VITE_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-yoursecret}
       - VITE_HASHER_MIN_LENGTH=${HASHER_MIN_LENGTH:-11}
-      - VITE_HASHER_SALT=${HASHER_SALT}
+      - VITE_HASHER_SALT=${HASHER_SALT:-}
 
       # Backend API Configuration
       - VITE_API_BASE_URL=${API_BASE_URL:-https://api.ifri.khongisa.co.za/}
-    restart: unless-stopped
\ No newline at end of file
+    restart: unless-stopped