diff --git a/libs/Threema-MsgApi-Net-Core/IcgSoftware.Threema.CoreMsgApi/IcgSoftware.Threema.CoreMsgApi.csproj b/libs/Threema-MsgApi-Net-Core/IcgSoftware.Threema.CoreMsgApi/IcgSoftware.Threema.CoreMsgApi.csproj
index d5156e2..6197d33 100644
--- a/libs/Threema-MsgApi-Net-Core/IcgSoftware.Threema.CoreMsgApi/IcgSoftware.Threema.CoreMsgApi.csproj
+++ b/libs/Threema-MsgApi-Net-Core/IcgSoftware.Threema.CoreMsgApi/IcgSoftware.Threema.CoreMsgApi.csproj
@@ -15,7 +15,8 @@
     <PackageReference Include="Microsoft.Extensions.Configuration.FileExtensions" Version="2.1.1" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="2.1.1" />
     <PackageReference Include="Microsoft.Win32.Registry" Version="4.5.0" />
-    <PackageReference Include="Newtonsoft.Json" Version="11.0.2" />
+    <!-- F4 (Sicherheit): von 11.0.2 (Advisory NU1903, high) auf 13.0.4 gehoben, = App-Version. -->
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
     <PackageReference Include="Sodium.Core" Version="1.2.0" />
   </ItemGroup>
 
diff --git a/src/PolyTrader.Core/Models/ServerSettings.cs b/src/PolyTrader.Core/Models/ServerSettings.cs
index ccf9b59..a4875a7 100644
--- a/src/PolyTrader.Core/Models/ServerSettings.cs
+++ b/src/PolyTrader.Core/Models/ServerSettings.cs
@@ -49,8 +49,8 @@ namespace PolyTraderSharp.Models
 
         [Category("Mullvad VPN")]
         [DisplayName("Mullvad Account")]
-        [Description("Account ID for Mullvad VPN.")]
-        public string MullvadAccount { get; set; } = "7748925650632296";
+        [Description("Account ID for Mullvad VPN. In server_settings.xml (gitignored) hinterlegen – NICHT im Code committen.")]
+        public string MullvadAccount { get; set; } = "";   // F3: Secret nicht mehr im Quellcode
 
         [Category("Mullvad VPN")]
         [DisplayName("VPN Location")]
@@ -70,8 +70,8 @@ namespace PolyTraderSharp.Models
 
         [Category("Blockchain Listener")]
         [DisplayName("Polygon RPC URL")]
-        [Description("RPC URL for Alchemy WSS.")]
-        public string PolygonRpcUrl { get; set; } = "wss://polygon-mainnet.g.alchemy.com/v2/iWCbs9p3nf-8OpR-BtvGi";
+        [Description("RPC-/WSS-URL inkl. Alchemy-API-Key. In server_settings.xml (gitignored) hinterlegen – der Key gehört NICHT in den Quellcode/Git. Format: wss://polygon-mainnet.g.alchemy.com/v2/<KEY>")]
+        public string PolygonRpcUrl { get; set; } = "";   // F3: Alchemy-Key nicht mehr im Quellcode
 
         [Category("Polymarket WebSockets")]
         [DisplayName("Use Polymarket WebSockets")]