diff --git a/eslint.config.js b/eslint.config.js
index a7a4312..7239507 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -32,12 +32,16 @@ export default [
         'setCookie': 'readonly',
         'deleteCookie': 'readonly',
         'getHeader': 'readonly',
+        'setHeader': 'readonly',
         'getRouterParam': 'readonly',
         'getQuery': 'readonly',
         'sendStream': 'readonly',
         'sendRedirect': 'readonly',
         'createError': 'readonly',
         'useRuntimeConfig': 'readonly',
+        'hasAnyRole': 'readonly',
+        'hasRole': 'readonly',
+        'hasAllRoles': 'readonly',
         'process': 'readonly',
         // Vue Composition API
         'onUnmounted': 'readonly',
diff --git a/pages/cms/newsletter.vue b/pages/cms/newsletter.vue
index d6da427..e3fb71f 100644
--- a/pages/cms/newsletter.vue
+++ b/pages/cms/newsletter.vue
@@ -166,9 +166,10 @@
                           Keine Empfänger gefunden
                         </span>
                       </div>
+                      <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
                       <div
                         class="text-sm text-gray-600 prose prose-sm max-w-none mb-3"
-                        v-html="useSanitizeHtml(post.content.substring(0, 200) + (post.content.length > 200 ? '...' : ''))" <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+                        v-html="useSanitizeHtml(post.content.substring(0, 200) + (post.content.length > 200 ? '...' : ''))"
                       />
                       
                       <!-- Empfängerliste (collapsible) -->
diff --git a/pages/verein/geschichte.vue b/pages/verein/geschichte.vue
index 6328ee8..7216cbf 100644
--- a/pages/verein/geschichte.vue
+++ b/pages/verein/geschichte.vue
@@ -29,7 +29,7 @@ async function loadConfig() {
   try {
     const data = await $fetch('/api/config')
     rawContent.value = data?.seiten?.geschichte || ''
-  } catch (e) {
+  } catch (_e) {
     rawContent.value = ''
   }
 }
diff --git a/pages/verein/satzung.vue b/pages/verein/satzung.vue
index 32ead31..c8d1c90 100644
--- a/pages/verein/satzung.vue
+++ b/pages/verein/satzung.vue
@@ -64,7 +64,7 @@ async function loadConfig() {
       rawContent.value = satzung.content || ''
       pdfUrl.value = satzung.pdfUrl || ''
     }
-  } catch (e) {
+  } catch (_e) {
     rawContent.value = ''
     pdfUrl.value = ''
   }
diff --git a/pages/verein/tt-regeln.vue b/pages/verein/tt-regeln.vue
index b801c5a..5b24fe3 100644
--- a/pages/verein/tt-regeln.vue
+++ b/pages/verein/tt-regeln.vue
@@ -4,9 +4,10 @@
       <h1 class="text-4xl sm:text-5xl font-display font-bold text-gray-900 mb-6">
         TT-Regeln
       </h1>
+      <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
       <div
         class="prose prose-lg max-w-none"
-        v-html="content" <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+        v-html="content"
       />
     </div>
   </div>
@@ -28,7 +29,7 @@ async function loadConfig() {
   try {
     const data = await $fetch('/api/config')
     rawContent.value = data?.seiten?.ttRegeln || ''
-  } catch (e) {
+  } catch (_e) {
     rawContent.value = ''
   }
 }
diff --git a/pages/verein/ueber-uns.vue b/pages/verein/ueber-uns.vue
index 51cd9be..d9acf28 100644
--- a/pages/verein/ueber-uns.vue
+++ b/pages/verein/ueber-uns.vue
@@ -4,9 +4,10 @@
       <h1 class="text-4xl sm:text-5xl font-display font-bold text-gray-900 mb-6">
         Über uns
       </h1>
+      <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
       <div
         class="prose prose-lg max-w-none"
-        v-html="content" <!-- nosemgrep: javascript.vue.security.audit.xss.templates.avoid-v-html -->
+        v-html="content"
       />
     </div>
   </div>
@@ -28,7 +29,7 @@ async function loadConfig() {
   try {
     const data = await $fetch('/api/config')
     rawContent.value = data?.seiten?.ueberUns || ''
-  } catch (e) {
+  } catch (_e) {
     rawContent.value = ''
   }
 }
diff --git a/scripts/re-encrypt-data.js b/scripts/re-encrypt-data.js
index a7fd608..a22dddf 100755
--- a/scripts/re-encrypt-data.js
+++ b/scripts/re-encrypt-data.js
@@ -52,7 +52,7 @@ function getDataPath(filename) {
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     return path.join(cwd, '../server/data', filename)
   }
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
@@ -125,6 +125,7 @@ async function reencryptUsers(backupDir, oldKeys) {
     const data = await fs.readFile(USERS_FILE, 'utf-8')
     
     // Backup erstellen
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     await fs.copyFile(USERS_FILE, path.join(backupDir, 'users.json')) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     console.log('✅ Backup von users.json erstellt')
     
@@ -167,6 +168,7 @@ async function reencryptMembers(backupDir, oldKeys) {
     const data = await fs.readFile(MEMBERS_FILE, 'utf-8')
     
     // Backup erstellen
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     await fs.copyFile(MEMBERS_FILE, path.join(backupDir, 'members.json')) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     console.log('✅ Backup von members.json erstellt')
     
@@ -217,7 +219,8 @@ async function reencryptMembershipApplications(backupDir, oldKeys) {
   let skipped = 0
   
   for (const file of files) {
-    const filePath = path.join(MEMBERSHIP_APPLICATIONS_DIR, file)
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+      const filePath = path.join(MEMBERSHIP_APPLICATIONS_DIR, file)
     const stat = await fs.stat(filePath)
     
     if (stat.isDirectory()) {
@@ -226,6 +229,7 @@ async function reencryptMembershipApplications(backupDir, oldKeys) {
     
     try {
       // Backup erstellen
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
       const backupPath = path.join(backupDir, 'membership-applications', file) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
       await fs.mkdir(path.dirname(backupPath), { recursive: true })
       await fs.copyFile(filePath, backupPath)
diff --git a/server/api/cms/satzung-upload.post.js b/server/api/cms/satzung-upload.post.js
index d107e7e..f7a982a 100644
--- a/server/api/cms/satzung-upload.post.js
+++ b/server/api/cms/satzung-upload.post.js
@@ -20,7 +20,7 @@ const getDataPath = (filename) => {
   }
   
   // In development, working dir is project root
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/api/cms/save-csv.post.js b/server/api/cms/save-csv.post.js
index 7748e8c..fe60b99 100644
--- a/server/api/cms/save-csv.post.js
+++ b/server/api/cms/save-csv.post.js
@@ -57,7 +57,7 @@ export default defineEventHandler(async (event) => {
       filePath = path.join(cwd, '../public/data', filename)
     } else {
       // In development, working dir is project root
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
       filePath = path.join(cwd, 'public/data', filename)
     }
     
diff --git a/server/api/galerie/[id].delete.js b/server/api/galerie/[id].delete.js
index 541cd24..e2fefab 100644
--- a/server/api/galerie/[id].delete.js
+++ b/server/api/galerie/[id].delete.js
@@ -11,7 +11,7 @@ const getDataPath = (filename) => {
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     return path.join(cwd, '../server/data', filename)
   }
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/api/galerie/[id].get.js b/server/api/galerie/[id].get.js
index 5844d83..12c616e 100644
--- a/server/api/galerie/[id].get.js
+++ b/server/api/galerie/[id].get.js
@@ -12,7 +12,7 @@ const getDataPath = (filename) => {
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     return path.join(cwd, '../server/data', filename)
   }
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/api/galerie/list.get.js b/server/api/galerie/list.get.js
index 0272461..6ecc9be 100644
--- a/server/api/galerie/list.get.js
+++ b/server/api/galerie/list.get.js
@@ -11,7 +11,7 @@ const getDataPath = (filename) => {
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     return path.join(cwd, '../server/data', filename)
   }
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/api/galerie/upload.post.js b/server/api/galerie/upload.post.js
index e8d2459..2213d1f 100644
--- a/server/api/galerie/upload.post.js
+++ b/server/api/galerie/upload.post.js
@@ -14,7 +14,7 @@ const getDataPath = (filename) => {
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     return path.join(cwd, '../server/data', filename)
   }
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/api/membership/generate-pdf.post.js b/server/api/membership/generate-pdf.post.js
index c683641..1d711ed 100644
--- a/server/api/membership/generate-pdf.post.js
+++ b/server/api/membership/generate-pdf.post.js
@@ -313,7 +313,7 @@ function getDataPath(filename) {
   // In der Produktion: process.cwd() ist .output, daher ein Verzeichnis zurück
   const isDev = process.env.NODE_ENV === 'development'
   const projectRoot = isDev ? process.cwd() : path.resolve(process.cwd(), '..')
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(projectRoot, 'server', 'data', filename)
 }
 
diff --git a/server/api/membership/update-status.put.js b/server/api/membership/update-status.put.js
index b6bf1e2..2be15ae 100644
--- a/server/api/membership/update-status.put.js
+++ b/server/api/membership/update-status.put.js
@@ -39,8 +39,10 @@ export default defineEventHandler(async (event) => {
       })
     }
     
-    const dataDir = path.join(process.cwd(), 'server/data/membership-applications') // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
-    const filePath = path.join(dataDir, `${id}.json`) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+    const dataDir = path.join(process.cwd(), 'server/data/membership-applications')
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+    const filePath = path.join(dataDir, `${id}.json`)
     
     // Antrag laden
     const fileContent = await fs.readFile(filePath, 'utf8')
diff --git a/server/api/personen/upload.post.js b/server/api/personen/upload.post.js
index c0bfdce..c350a91 100644
--- a/server/api/personen/upload.post.js
+++ b/server/api/personen/upload.post.js
@@ -14,7 +14,7 @@ const getDataPath = (filename) => {
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     return path.join(cwd, '../server/data', filename)
   }
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/api/spielplan/download/[filename].get.js b/server/api/spielplan/download/[filename].get.js
index 72b1249..25b15c5 100644
--- a/server/api/spielplan/download/[filename].get.js
+++ b/server/api/spielplan/download/[filename].get.js
@@ -53,7 +53,8 @@ export default defineEventHandler(async (event) => {
       filePath = path.join(process.cwd(), 'public', 'documents', 'spielplaene', 'spielplan_gesamt.pdf')
     } else {
       // Für vordefinierte PDFs
-      filePath = path.join(process.cwd(), 'public', 'documents', 'spielplaene', sanitizedFilename) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+      filePath = path.join(process.cwd(), 'public', 'documents', 'spielplaene', sanitizedFilename)
     }
     
     // Prüfe ob Datei existiert
diff --git a/server/api/spielplan/pdf.get.js b/server/api/spielplan/pdf.get.js
index fad13f5..69e3526 100644
--- a/server/api/spielplan/pdf.get.js
+++ b/server/api/spielplan/pdf.get.js
@@ -361,7 +361,8 @@ ${hallenListe.map(halle => {
       // Verzeichnis existiert bereits
     }
     
-    const tempTexFile = path.join(tempDir, `spielplan_${team}_${Date.now()}.tex`) // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+    const tempTexFile = path.join(tempDir, `spielplan_${team}_${Date.now()}.tex`)
     await fs.writeFile(tempTexFile, latexContent, 'utf-8')
     
     // Kompiliere LaTeX zu PDF
diff --git a/server/utils/members.js b/server/utils/members.js
index af557b9..e45612f 100644
--- a/server/utils/members.js
+++ b/server/utils/members.js
@@ -16,7 +16,7 @@ const getDataPath = (filename) => {
   }
   
   // In development, working dir is project root
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/utils/news.js b/server/utils/news.js
index b51b45b..2c0138a 100644
--- a/server/utils/news.js
+++ b/server/utils/news.js
@@ -15,7 +15,7 @@ const getDataPath = (filename) => {
   }
   
   // In development, working dir is project root
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/utils/newsletter.js b/server/utils/newsletter.js
index 9b07f3e..84579ff 100644
--- a/server/utils/newsletter.js
+++ b/server/utils/newsletter.js
@@ -13,7 +13,7 @@ const getDataPath = (filename) => {
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
     return path.join(cwd, '../server/data', filename)
   }
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'server/data', filename)
 }
 
diff --git a/server/utils/termine.js b/server/utils/termine.js
index 16b2cf0..3d92f41 100644
--- a/server/utils/termine.js
+++ b/server/utils/termine.js
@@ -14,7 +14,7 @@ const getDataPath = (filename) => {
   }
   
   // In development, working dir is project root
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal
   return path.join(cwd, 'public/data', filename)
 }