diff --git a/AUDIT-SONARQUBE-2026.md b/AUDIT-SONARQUBE-2026.md
new file mode 100644
index 00000000..1cbdf367
--- /dev/null
+++ b/AUDIT-SONARQUBE-2026.md
@@ -0,0 +1,160 @@
+# Audit qualité/sécurité — SonarCloud (août 2026)
+
+Analyse du projet SonarCloud `Rem7474_ServerSupervisor` (org `rem7474`, scan des 3 modules
+server/agent/frontend), complétée par une revue manuelle de chaque signal à sévérité
+BLOCKER/CRITICAL et par un sondage représentatif des règles à fort volume, plus une vérification
+des alertes Dependabot ouvertes. Ce document répond à « qu'est-ce qui est vraiment un risque »
+et pas seulement « que dit l'outil » — chaque signal ci-dessous a été vérifié en lisant le code
+réel, pas supposé depuis le libellé de la règle.
+
+## 0. Chiffres bruts (au 2026-08-28)
+
+| Métrique | Valeur |
+|---|---|
+| Issues ouvertes | 871 (585 MAJOR, 212 CRITICAL, 71 MINOR, 3 BLOCKER) |
+| Bugs | 247 (reliability rating **E**) |
+| Vulnerabilities | 151 (security rating **E**) |
+| Code smells | 473 (maintainability rating **A**) |
+| Security hotspots restants | 0 |
+| Duplication | 1.5 % |
+| Dette technique totale | ~140h (8406 min) |
+| Lignes analysées | 120 158 |
+
+Les ratings E sur reliability/security sont **trompeurs** : ils sont dominés par deux règles à
+très haut volume dont la quasi-totalité des occurrences sont des faux positifs pour ce code
+précis (détail §2, §3.1). Le rating A en maintainability est plus représentatif de l'état réel.
+
+## 1. Corrections livrées (branche `fix/sonarqube-audit-findings`, commit `0455631`)
+
+Les 8 signaux BLOCKER/CRITICAL de type BUG/VULNERABILITY ont tous été revus individuellement :
+
+| Règle | Fichier | Verdict | Action |
+|---|---|---|---|
+| `go:S4830`/`go:S5527` | `server/internal/synthetic/ssl.go:105` | **Vrai manque** | Corrigé — voir §1.1 |
+| `javascript:S2819` | `frontend/public/service-worker.js:258` | **Vrai manque (mineur)** | Corrigé — voir §1.2 |
+| `typescript:S2871` | `useGlobalScheduledTasks.ts:176` | **Faux positif bénin** | Corrigé par clarté — voir §1.3 |
+| `go:S6437` + `secrets:S8215` | `db_hosts.go:108` | **Faux positif** | `NOSONAR` + justification |
+| `go:S4790` | `db_web_logs.go:179` | **Faux positif** | `NOSONAR` + justification |
+| `plsql:DeleteOrUpdateWithoutWhereCheck` | `migrations/089_...sql:12` | **Faux positif** | Non modifié (voir §1.4) |
+
+### 1.1 SSL/TLS — vérification hostname/chaîne absente (réel)
+
+`checkCertificate` (sonde SSL) utilise `InsecureSkipVerify: true`, volontairement, pour pouvoir
+lire un certificat même expiré/invalide plutôt que voir le handshake TLS échouer. Mais avant le
+correctif, le seul contrôle réellement rapporté dans `last_error` était l'expiration : un
+certificat avec un **mauvais hostname** ou signé par une **CA non fiable** repassait comme
+« aucune erreur ». Pour un outil dont c'est justement le métier (alerter sur un problème SSL),
+c'est un vrai trou fonctionnel, pas juste un signal bruyant.
+
+Correctif : après le handshake, `leaf.Verify()` est appelé indépendamment (hostname + chaîne),
+et toute erreur autre que l'expiration déjà couverte est ajoutée à `last_error`. Aucun champ de
+modèle ajouté, donc aucune régénération de types/migration nécessaire.
+
+### 1.2 Service worker — message sans vérification d'origine (réel, risque faible)
+
+Le listener `message` du service worker exécutait `SKIP_WAITING`/`CLEAR_CACHE` sans vérifier
+`event.origin`. Le risque concret est faible (un service worker n'est de toute façon contrôlable
+que par des clients same-origin), mais c'est une défense en profondeur peu coûteuse — ajoutée.
+
+### 1.3 Tri alphabétique par défaut (faux positif bénin, corrigé par clarté)
+
+`hostList` trie des `string` (`host_name`), donc `Array.sort()` par défaut est déjà correct
+(la règle S2871 cible le bug classique `[3,1,10].sort()`, pas ce cas). Remplacé par un
+`localeCompare` explicite : correct fonctionnellement à l'identique, en plus robuste aux accents
+et à la casse, et ça éteint le signal proprement plutôt que par suppression.
+
+### 1.4 Faux positifs documentés
+
+- **`db_hosts.go:108`** — le « secret » détecté est un hash bcrypt d'une valeur arbitraire,
+  utilisé uniquement pour normaliser le temps de réponse (empêcher un attaquant de distinguer
+  "host inconnu" de "mauvais secret" par timing). Rien n'est réellement hashé pour le produire,
+  il n'y a donc rien à « révoquer ». `NOSONAR` + commentaire ajoutés.
+- **`db_web_logs.go:179`** — MD5 utilisé comme clé de déduplication non-cryptographique
+  (fingerprint de requête web), jamais dans une décision de sécurité. `NOSONAR` + commentaire
+  ajoutés.
+- **`migrations/089_audit_logs_category.sql:12`** — `UPDATE audit_logs SET category = CASE ...`
+  sans `WHERE` est volontaire : c'est un backfill de la colonne qu'on vient d'ajouter sur
+  **toutes** les lignes existantes. **Non modifié** : une migration déjà appliquée ne doit
+  jamais être éditée (`server/CLAUDE.md`) — le signal reste affiché mais est sans objet.
+
+## 2. Le volume MAJOR est dominé par deux patterns systématiques, pas 600 bugs distincts
+
+### 2.1 `go:S2077` — 67 occurrences « requête SQL formatée dynamiquement »
+
+Échantillon couvrant tous les fichiers distincts touchés (`db_docker_image_versions.go`,
+`db_network_flows.go`, `db_backup.go`, `db_web_logs_summary.go`, `db_web_logs_detail.go`,
+`db_commands.go`, `testutil/postgres.go`) : dans chaque cas, `fmt.Sprintf`/`+` ne sert qu'à
+assembler un **fragment de requête fixe** (clause `WHERE`/`ORDER BY` conditionnelle) — les
+valeurs elles-mêmes passent toujours par des placeholders `$N` paramétrés. Les deux points où on
+pourrait craindre une injection réelle (colonne de tri, direction de tri dans
+`db_web_logs_detail.go:243-248`, bucket temporel dans `db_web_logs_summary.go:811`) sont
+allowlistés (map statique ou comparaison stricte) avant interpolation. **Aucune injection SQL
+trouvée** dans l'échantillon couvert — c'est un faux positif systématique de la règle sur ce
+pattern de construction de requêtes, pas une dette réelle.
+
+**Recommandation** : ne pas corriger fichier par fichier. Soit exclure `go:S2077` du profil
+Sonar pour `server/internal/database` avec une justification versionnée, soit — mieux à terme —
+centraliser la construction des clauses `WHERE`/`ORDER BY` dynamiques dans un petit helper qui
+rend le pattern visible en un seul endroit pour un futur audit.
+
+### 2.2 `Web:InputWithoutLabelCheck` (234) + `Web:S6853` (216) — 450 issues, accessibilité
+
+Plus de la moitié de toutes les issues ouvertes. Ce sont des `<input>`/`<select>` du frontend
+sans `<label for>`/`aria-label` associé — un vrai gap d'accessibilité (lecteurs d'écran), mais
+qui se répète très probablement sur un nombre restreint de *patterns* de composants (filtres de
+table, champs de formulaire modal, toggles) plutôt que 450 cas uniques à traiter un par un.
+
+**Recommandation** : avant de corriger, faire un passage de *tri par composant* (facette
+`directories`/`files` de l'API Sonar) pour identifier les 5-10 composants qui concentrent le
+plus d'occurrences (probablement des composants de filtre/formulaire réutilisés). Corriger ces
+composants partagés en premier réduit le compteur bien plus vite que traiter vue par vue. Le
+frontend a déjà la convention `form-label` (`frontend/CLAUDE.md`) — le gap est l'application
+systématique, pas l'absence de convention.
+
+### 2.3 `go:S3776`/`typescript:S3776` (94) — complexité cognitive
+
+Fonctions trop complexes (souvent les handlers/composables les plus anciens du projet). Pas un
+risque de sécurité, un risque de maintenabilité. Contrairement aux deux catégories ci-dessus, un
+refactor de complexité cognitive change le flot de contrôle réel — **à traiter fonction par
+fonction avec les tests existants comme filet**, pas en masse. Ne pas lancer un refactor
+automatisé dessus.
+
+### 2.4 `go:S4036` (34, MINOR) — recherche de binaire via `$PATH`
+
+Concerne l'agent (`update.go`, `apt.go`, `disk.go`, `systemd.go`, `restic.go`, `system.go`) :
+`exec.Command("nom", ...)` sans chemin absolu. Risque réel mais mineur et cohérent avec le
+modèle de menace de l'agent (déjà privilégié, déjà root ou quasi — voir `agent/CLAUDE.md`) : un
+`$PATH` déjà compromis sur la machine cible implique une compromission plus large que ce que ce
+correctif éviterait. Sévérité MINOR confirmée cohérente. Pas prioritaire.
+
+## 3. Dépendances (Dependabot, hors SonarCloud)
+
+3 alertes ouvertes à haute sévérité sur `main`, vérifiées une par une :
+
+| Package | Manifest | Plage vulnérable | Version résolue actuelle |
+|---|---|---|---|
+| `github.com/moby/go-archive` | `server/go.mod` | `< 0.3.0` | `0.3.3` — **déjà patché** |
+| `github.com/moby/go-archive` | `agent/go.mod` | `< 0.3.0` | `0.3.3` — **déjà patché** |
+| `nanoid` | `frontend/package-lock.json` | `< 3.3.18` | `3.3.18` — **déjà patché** |
+
+Les 3 alertes sont **obsolètes** : les versions réellement résolues dans `go.sum`/
+`package-lock.json` sont déjà au-delà du correctif. Aucune action de code nécessaire — à
+dismiss côté GitHub (ou attendre le prochain rescan Dependabot). Accessoirement : côté agent,
+`go-archive` vient de `go-dockerclient` (donc potentiellement en chemin de prod via le
+collecteur Docker), côté server uniquement de `testcontainers-go` (donc test-only,
+`internal/testutil`) — la distinction n'a plus d'importance ici puisque déjà patché des deux
+côtés, mais utile à noter pour une prochaine alerte sur ce package.
+
+## 4. Plan de suite recommandé
+
+1. **Fait** (`fix/sonarqube-audit-findings`) : les 8 signaux BLOCKER/CRITICAL BUG/VULNERABILITY.
+2. **Prochain, faible effort** : configurer une exclusion Sonar justifiée pour `go:S2077` sur
+   `server/internal/database/**` (voir §2.1) — fait baisser le compteur MAJOR de ~65 sans toucher
+   au code.
+3. **Prochain, effort moyen, fort impact utilisateur** : accessibilité — identifier les
+   composants concentrant le plus d'occurrences de `Web:InputWithoutLabelCheck`/`S6853` (§2.2)
+   et les corriger en priorité.
+4. **En continu, pas en rafale** : complexité cognitive (§2.3) — un refactor à la fois, avec
+   tests, quand on touche de toute façon à la fonction concernée pour une autre raison.
+5. **Non prioritaire** : `go:S4036` (§2.4), `go:S1192` (duplication de chaînes littérales —
+   maintenabilité pure, sans risque).
diff --git a/frontend/public/service-worker.js b/frontend/public/service-worker.js
index b5e6f6d7..5f04226a 100644
--- a/frontend/public/service-worker.js
+++ b/frontend/public/service-worker.js
@@ -256,6 +256,14 @@ self.addEventListener('sync', (event) => {
 
 // Message handling for client communication
 self.addEventListener('message', (event) => {
+  // Reject messages from anything but our own origin — a service worker is
+  // only ever supposed to be controlled by same-origin clients, but nothing
+  // stops a compromised same-origin context (or a browser bug) from being
+  // the actual sender, so don't skip this check just because cross-origin
+  // postMessage() to a foreign SW isn't normally reachable.
+  if (event.origin && event.origin !== self.location.origin) {
+    return
+  }
   if (event.data && event.data.type === 'SKIP_WAITING') {
     self.skipWaiting()
   }
diff --git a/frontend/src/components/alerts/AlertRuleStepConditions.spec.ts b/frontend/src/components/alerts/AlertRuleStepConditions.spec.ts
new file mode 100644
index 00000000..7c1177d3
--- /dev/null
+++ b/frontend/src/components/alerts/AlertRuleStepConditions.spec.ts
@@ -0,0 +1,57 @@
+import { describe, it, expect } from 'vitest'
+import { mount } from '@vue/test-utils'
+import AlertRuleStepConditions from './AlertRuleStepConditions.vue'
+import { useAlertRuleForm } from '../../composables/useAlertRuleForm'
+import type { AlertRuleFormData } from '../../composables/useAlertRuleForm'
+
+function formFor(metric: string, overrides: Partial<AlertRuleFormData> = {}): AlertRuleFormData {
+  const base = useAlertRuleForm().defaultForm()
+  return { ...base, metric, ...overrides }
+}
+
+function mountStep(form: AlertRuleFormData) {
+  return mount(AlertRuleStepConditions, { props: { form } })
+}
+
+describe('AlertRuleStepConditions (characterization, per-metric branches)', () => {
+  it('docker_container_state: renders the warn/crit state checklists and a duration field', () => {
+    const wrapper = mountStep(formFor('docker_container_state'))
+    expect(wrapper.text()).toContain('warn')
+    expect(wrapper.text()).toContain('crit')
+    expect(wrapper.find('#alert-cond-duration').exists()).toBe(true)
+  })
+
+  it('docker_compose_degraded_services: renders warn/crit thresholds and a duration field', () => {
+    const wrapper = mountStep(formFor('docker_compose_degraded_services'))
+    for (const id of ['alert-cond-threshold-warn', 'alert-cond-threshold-crit', 'alert-cond-compose-duration']) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+    }
+  })
+
+  it('bandwidth_vs_rolling_avg: renders the baseline window select and both thresholds', () => {
+    const wrapper = mountStep(formFor('bandwidth_vs_rolling_avg', { baseline_window_seconds: 3600 }))
+    for (const id of ['alert-cond-baseline-window', 'alert-cond-bandwidth-threshold-warn', 'alert-cond-bandwidth-threshold-crit']) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+    }
+  })
+
+  it('heartbeat_timeout: renders the max-silence field', () => {
+    const wrapper = mountStep(formFor('heartbeat_timeout'))
+    expect(wrapper.find('#alert-cond-heartbeat-timeout').exists()).toBe(true)
+  })
+
+  it('generic metric (e.g. cpu): renders operator, thresholds, hysteresis and duration', () => {
+    const wrapper = mountStep(formFor('cpu'))
+    for (const id of [
+      'alert-cond-operator',
+      'alert-cond-generic-threshold-warn',
+      'alert-cond-generic-threshold-crit',
+      'alert-cond-threshold-clear-warn',
+      'alert-cond-threshold-clear-crit',
+      'alert-cond-generic-duration',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+  })
+})
diff --git a/frontend/src/components/alerts/AlertRuleStepConditions.vue b/frontend/src/components/alerts/AlertRuleStepConditions.vue
index b3261b18..0808a817 100644
--- a/frontend/src/components/alerts/AlertRuleStepConditions.vue
+++ b/frontend/src/components/alerts/AlertRuleStepConditions.vue
@@ -4,7 +4,9 @@
     <template v-if="form.metric === 'docker_container_state'">
       <div class="row">
         <div class="col-md-6 mb-3">
-          <label class="form-label">États déclenchant une alerte <span class="badge bg-warning-lt text-warning ms-1">warn</span></label>
+          <div class="form-label">
+            États déclenchant une alerte <span class="badge bg-warning-lt text-warning ms-1">warn</span>
+          </div>
           <div class="border rounded p-2 d-flex flex-wrap gap-2">
             <label
               v-for="s in DOCKER_STATES"
@@ -22,7 +24,9 @@
           </div>
         </div>
         <div class="col-md-6 mb-3">
-          <label class="form-label">États déclenchant une alerte <span class="badge bg-danger-lt text-danger ms-1">crit</span></label>
+          <div class="form-label">
+            États déclenchant une alerte <span class="badge bg-danger-lt text-danger ms-1">crit</span>
+          </div>
           <div class="border rounded p-2 d-flex flex-wrap gap-2">
             <label
               v-for="s in DOCKER_STATES"
@@ -47,8 +51,12 @@
         Sélectionnez au moins un état pour activer cette alerte.
       </div>
       <div class="mb-3">
-        <label class="form-label">Durée (secondes)</label>
+        <label
+          for="alert-cond-duration"
+          class="form-label"
+        >Durée (secondes)</label>
         <input
+          id="alert-cond-duration"
           v-model.number="form.duration"
           type="number"
           min="0"
@@ -74,8 +82,12 @@
       </div>
       <div class="row">
         <div class="col-md-6 mb-3">
-          <label class="form-label required">Warn si ≥ N service(s) dégradé(s)</label>
+          <label
+            for="alert-cond-threshold-warn"
+            class="form-label required"
+          >Warn si ≥ N service(s) dégradé(s)</label>
           <input
+            id="alert-cond-threshold-warn"
             v-model.number="form.threshold_warn"
             type="number"
             step="1"
@@ -88,8 +100,12 @@
           </small>
         </div>
         <div class="col-md-6 mb-3">
-          <label class="form-label required">Crit si ≥ N service(s) dégradé(s)</label>
+          <label
+            for="alert-cond-threshold-crit"
+            class="form-label required"
+          >Crit si ≥ N service(s) dégradé(s)</label>
           <input
+            id="alert-cond-threshold-crit"
             v-model.number="form.threshold_crit"
             type="number"
             step="1"
@@ -103,8 +119,12 @@
         </div>
       </div>
       <div class="mb-3">
-        <label class="form-label">Durée (secondes)</label>
+        <label
+          for="alert-cond-compose-duration"
+          class="form-label"
+        >Durée (secondes)</label>
         <input
+          id="alert-cond-compose-duration"
           v-model.number="form.duration"
           type="number"
           min="0"
@@ -129,8 +149,12 @@
       </div>
       <div class="row">
         <div class="col-md-12 mb-3">
-          <label class="form-label required">Fenêtre de moyenne glissante</label>
+          <label
+            for="alert-cond-baseline-window"
+            class="form-label required"
+          >Fenêtre de moyenne glissante</label>
           <select
+            id="alert-cond-baseline-window"
             v-model.number="form.baseline_window_seconds"
             class="form-select"
           >
@@ -151,8 +175,12 @@
       </div>
       <div class="row">
         <div class="col-md-6 mb-3">
-          <label class="form-label required">Seuil d'avertissement (% de la moyenne glissante)</label>
+          <label
+            for="alert-cond-bandwidth-threshold-warn"
+            class="form-label required"
+          >Seuil d'avertissement (% de la moyenne glissante)</label>
           <input
+            id="alert-cond-bandwidth-threshold-warn"
             v-model.number="form.threshold_warn"
             type="number"
             step="1"
@@ -163,8 +191,12 @@
           <small class="form-hint">Ex. 150 = alerte dès que le trafic dépasse 1,5× la moyenne.</small>
         </div>
         <div class="col-md-6 mb-3">
-          <label class="form-label required">Seuil critique (% de la moyenne glissante)</label>
+          <label
+            for="alert-cond-bandwidth-threshold-crit"
+            class="form-label required"
+          >Seuil critique (% de la moyenne glissante)</label>
           <input
+            id="alert-cond-bandwidth-threshold-crit"
             v-model.number="form.threshold_crit"
             type="number"
             step="1"
@@ -181,8 +213,12 @@
     <template v-else-if="form.metric === 'heartbeat_timeout'">
       <div class="row">
         <div class="col-md-12 mb-3">
-          <label class="form-label required">Silence maximum (secondes)</label>
+          <label
+            for="alert-cond-heartbeat-timeout"
+            class="form-label required"
+          >Silence maximum (secondes)</label>
           <input
+            id="alert-cond-heartbeat-timeout"
             v-model.number="form.threshold_crit"
             type="number"
             step="60"
@@ -204,8 +240,12 @@
     <template v-else>
       <div class="row">
         <div class="col-md-6 mb-3">
-          <label class="form-label required">Opérateur</label>
+          <label
+            for="alert-cond-operator"
+            class="form-label required"
+          >Opérateur</label>
           <select
+            id="alert-cond-operator"
             v-model="form.operator"
             class="form-select"
           >
@@ -227,8 +267,12 @@
 
       <div class="row">
         <div class="col-md-6 mb-3">
-          <label class="form-label required">Seuil d'avertissement (warn)</label>
+          <label
+            for="alert-cond-generic-threshold-warn"
+            class="form-label required"
+          >Seuil d'avertissement (warn)</label>
           <input
+            id="alert-cond-generic-threshold-warn"
             v-model.number="form.threshold_warn"
             type="number"
             step="0.1"
@@ -238,8 +282,12 @@
           <small class="form-hint">Déclenche une alerte de niveau avertissement.</small>
         </div>
         <div class="col-md-6 mb-3">
-          <label class="form-label required">Seuil critique (crit)</label>
+          <label
+            for="alert-cond-generic-threshold-crit"
+            class="form-label required"
+          >Seuil critique (crit)</label>
           <input
+            id="alert-cond-generic-threshold-crit"
             v-model.number="form.threshold_crit"
             type="number"
             step="0.1"
@@ -252,8 +300,12 @@
 
       <div class="row">
         <div class="col-md-6 mb-3">
-          <label class="form-label">Seuil de résolution warn (hystérésis)</label>
+          <label
+            for="alert-cond-threshold-clear-warn"
+            class="form-label"
+          >Seuil de résolution warn (hystérésis)</label>
           <input
+            id="alert-cond-threshold-clear-warn"
             v-model.number="form.threshold_clear_warn"
             type="number"
             step="0.1"
@@ -276,8 +328,12 @@
           </small>
         </div>
         <div class="col-md-6 mb-3">
-          <label class="form-label">Seuil de résolution crit (hystérésis)</label>
+          <label
+            for="alert-cond-threshold-clear-crit"
+            class="form-label"
+          >Seuil de résolution crit (hystérésis)</label>
           <input
+            id="alert-cond-threshold-clear-crit"
             v-model.number="form.threshold_clear_crit"
             type="number"
             step="0.1"
@@ -302,8 +358,12 @@
       </div>
 
       <div class="mb-3">
-        <label class="form-label">Durée (secondes)</label>
+        <label
+          for="alert-cond-generic-duration"
+          class="form-label"
+        >Durée (secondes)</label>
         <input
+          id="alert-cond-generic-duration"
           v-model.number="form.duration"
           type="number"
           class="form-control"
diff --git a/frontend/src/components/alerts/AlertRuleStepSource.spec.ts b/frontend/src/components/alerts/AlertRuleStepSource.spec.ts
new file mode 100644
index 00000000..c576a676
--- /dev/null
+++ b/frontend/src/components/alerts/AlertRuleStepSource.spec.ts
@@ -0,0 +1,97 @@
+import { describe, it, expect } from 'vitest'
+import { mount } from '@vue/test-utils'
+import AlertRuleStepSource from './AlertRuleStepSource.vue'
+import { useAlertRuleForm } from '../../composables/useAlertRuleForm'
+import type { AlertRuleFormData } from '../../composables/useAlertRuleForm'
+
+function formFor(metric: string, overrides: Partial<AlertRuleFormData> = {}): AlertRuleFormData {
+  const base = useAlertRuleForm().defaultForm()
+  return { ...base, metric, ...overrides }
+}
+
+const scopeOptions = [{ id: 'opt-1', label: 'Option 1' }]
+
+function baseProps(overrides: Record<string, unknown> = {}) {
+  return {
+    form: formFor('cpu'),
+    hosts: [{ id: 'host-1', name: 'srv-web' }],
+    metricCards: [],
+    metricSupportsHostFilter: true,
+    metricAllowsGuestScope: false,
+    metricAllowsStorageScope: false,
+    metricAllowsDiskScope: false,
+    proxmoxConnections: scopeOptions,
+    proxmoxNodes: scopeOptions,
+    proxmoxStorages: scopeOptions,
+    proxmoxGuests: scopeOptions,
+    proxmoxDisks: scopeOptions,
+    dockerHosts: [],
+    ...overrides,
+  }
+}
+
+describe('AlertRuleStepSource (characterization, per source-type branches)', () => {
+  it('agent metric: renders name and host-target fields, both labelled', () => {
+    const wrapper = mount(AlertRuleStepSource, { props: baseProps() })
+    for (const id of ['alert-source-name', 'alert-source-host-id']) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+  })
+
+  it('proxmox metric, connection scope: renders the scope-mode and connection selects', () => {
+    const form = formFor('proxmox_node_cpu_percent', { proxmox_scope: { ...formFor('cpu').proxmox_scope, scope_mode: 'connection' } })
+    const wrapper = mount(AlertRuleStepSource, { props: baseProps({ form }) })
+    expect(wrapper.find('#alert-source-proxmox-scope-mode').exists()).toBe(true)
+    expect(wrapper.find('#alert-source-proxmox-connection').exists()).toBe(true)
+  })
+
+  it('proxmox metric, node scope: renders the node select', () => {
+    const form = formFor('proxmox_node_cpu_percent', { proxmox_scope: { ...formFor('cpu').proxmox_scope, scope_mode: 'node' } })
+    const wrapper = mount(AlertRuleStepSource, { props: baseProps({ form }) })
+    expect(wrapper.find('#alert-source-proxmox-node').exists()).toBe(true)
+  })
+
+  it('proxmox metric, guest scope (metricAllowsGuestScope): renders the guest select', () => {
+    const form = formFor('proxmox_guest_cpu_percent', { proxmox_scope: { ...formFor('cpu').proxmox_scope, scope_mode: 'guest' } })
+    const wrapper = mount(AlertRuleStepSource, { props: baseProps({ form, metricAllowsGuestScope: true }) })
+    expect(wrapper.find('#alert-source-proxmox-guest').exists()).toBe(true)
+  })
+
+  it('proxmox metric, storage scope: renders the storage select', () => {
+    const form = formFor('proxmox_storage_percent', { proxmox_scope: { ...formFor('cpu').proxmox_scope, scope_mode: 'storage' } })
+    const wrapper = mount(AlertRuleStepSource, { props: baseProps({ form, metricAllowsStorageScope: true }) })
+    expect(wrapper.find('#alert-source-proxmox-storage').exists()).toBe(true)
+  })
+
+  it('proxmox metric, disk scope: renders the disk select', () => {
+    const form = formFor('proxmox_disk_min_wearout_percent', { proxmox_scope: { ...formFor('cpu').proxmox_scope, scope_mode: 'disk' } })
+    const wrapper = mount(AlertRuleStepSource, { props: baseProps({ form, metricAllowsDiskScope: true }) })
+    expect(wrapper.find('#alert-source-proxmox-disk').exists()).toBe(true)
+  })
+
+  it('docker metric: renders the docker host and scope-mode selects', () => {
+    const form = formFor('docker_container_state')
+    const wrapper = mount(AlertRuleStepSource, {
+      props: baseProps({
+        form,
+        dockerHosts: [{ host_id: 'host-1', host_name: 'srv-web', containers: [], projects: [] }],
+      }),
+    })
+    expect(wrapper.find('#alert-source-docker-host').exists()).toBe(true)
+    expect(wrapper.find('#alert-source-docker-scope-mode').exists()).toBe(true)
+  })
+
+  it('docker_compose_degraded_services with a host selected: renders the compose project select', () => {
+    const form = formFor('docker_compose_degraded_services', {
+      docker_scope: { ...formFor('cpu').docker_scope, host_id: 'host-1' },
+    })
+    const wrapper = mount(AlertRuleStepSource, {
+      props: baseProps({
+        form,
+        dockerHosts: [{ host_id: 'host-1', host_name: 'srv-web', containers: [], projects: [{ name: 'app', services: ['web'] }] }],
+      }),
+    })
+    expect(wrapper.find('#alert-source-docker-project').exists()).toBe(true)
+  })
+})
diff --git a/frontend/src/components/alerts/AlertRuleStepSource.vue b/frontend/src/components/alerts/AlertRuleStepSource.vue
index cf717c87..bd4119f4 100644
--- a/frontend/src/components/alerts/AlertRuleStepSource.vue
+++ b/frontend/src/components/alerts/AlertRuleStepSource.vue
@@ -1,8 +1,12 @@
 <template>
   <div>
     <div class="mb-3">
-      <label class="form-label required">Nom</label>
+      <label
+        for="alert-source-name"
+        class="form-label required"
+      >Nom</label>
       <input
+        id="alert-source-name"
         v-model="form.name"
         type="text"
         class="form-control"
@@ -11,7 +15,9 @@
     </div>
 
     <div class="mb-3">
-      <label class="form-label required">Source des données</label>
+      <div class="form-label required">
+        Source des données
+      </div>
       <div
         class="btn-group w-100"
         role="group"
@@ -56,8 +62,12 @@
       v-if="form.source_type === 'agent'"
       class="mb-3"
     >
-      <label class="form-label">Hôte cible</label>
+      <label
+        for="alert-source-host-id"
+        class="form-label"
+      >Hôte cible</label>
       <select
+        id="alert-source-host-id"
         v-model="form.host_id"
         class="form-select"
         :disabled="!metricSupportsHostFilter"
@@ -132,8 +142,12 @@
       class="row g-2 mt-2"
     >
       <div class="col-md-4">
-        <label class="form-label">Scope Proxmox</label>
+        <label
+          for="alert-source-proxmox-scope-mode"
+          class="form-label"
+        >Scope Proxmox</label>
         <select
+          id="alert-source-proxmox-scope-mode"
           v-model="form.proxmox_scope.scope_mode"
           class="form-select"
         >
@@ -176,8 +190,12 @@
         v-if="!metricAllowsGuestScope && form.proxmox_scope.scope_mode === 'connection'"
         class="col-md-8"
       >
-        <label class="form-label">Connexion</label>
+        <label
+          for="alert-source-proxmox-connection"
+          class="form-label"
+        >Connexion</label>
         <select
+          id="alert-source-proxmox-connection"
           v-model="form.proxmox_scope.connection_id"
           class="form-select"
         >
@@ -197,8 +215,12 @@
         v-if="!metricAllowsGuestScope && form.proxmox_scope.scope_mode === 'node'"
         class="col-md-8"
       >
-        <label class="form-label">Nœud</label>
+        <label
+          for="alert-source-proxmox-node"
+          class="form-label"
+        >Nœud</label>
         <select
+          id="alert-source-proxmox-node"
           v-model="form.proxmox_scope.node_id"
           class="form-select"
         >
@@ -218,8 +240,12 @@
         v-if="metricAllowsGuestScope && form.proxmox_scope.scope_mode === 'guest'"
         class="col-md-8"
       >
-        <label class="form-label">VM/LXC</label>
+        <label
+          for="alert-source-proxmox-guest"
+          class="form-label"
+        >VM/LXC</label>
         <select
+          id="alert-source-proxmox-guest"
           v-model="form.proxmox_scope.guest_id"
           class="form-select"
         >
@@ -239,8 +265,12 @@
         v-if="metricAllowsStorageScope && form.proxmox_scope.scope_mode === 'storage'"
         class="col-md-8"
       >
-        <label class="form-label">Stockage</label>
+        <label
+          for="alert-source-proxmox-storage"
+          class="form-label"
+        >Stockage</label>
         <select
+          id="alert-source-proxmox-storage"
           v-model="form.proxmox_scope.storage_id"
           class="form-select"
         >
@@ -260,8 +290,12 @@
         v-if="metricAllowsDiskScope && form.proxmox_scope.scope_mode === 'disk'"
         class="col-md-8"
       >
-        <label class="form-label">Disque physique</label>
+        <label
+          for="alert-source-proxmox-disk"
+          class="form-label"
+        >Disque physique</label>
         <select
+          id="alert-source-proxmox-disk"
           v-model="form.proxmox_scope.disk_id"
           class="form-select"
         >
@@ -291,8 +325,12 @@
       class="row g-2 mt-2"
     >
       <div class="col-md-4">
-        <label class="form-label required">Hôte</label>
+        <label
+          for="alert-source-docker-host"
+          class="form-label required"
+        >Hôte</label>
         <select
+          id="alert-source-docker-host"
           v-model="form.docker_scope.host_id"
           class="form-select"
           @change="onDockerHostChange"
@@ -320,8 +358,12 @@
         v-if="form.metric !== 'docker_compose_degraded_services'"
         class="col-md-4"
       >
-        <label class="form-label">Scope</label>
+        <label
+          for="alert-source-docker-scope-mode"
+          class="form-label"
+        >Scope</label>
         <select
+          id="alert-source-docker-scope-mode"
           v-model="form.docker_scope.scope_mode"
           class="form-select"
           @change="onDockerScopeModeChange"
@@ -338,7 +380,9 @@
         v-if="form.docker_scope.scope_mode === 'container' && form.docker_scope.host_id"
         class="col-md-8"
       >
-        <label class="form-label required">Container(s)</label>
+        <div class="form-label required">
+          Container(s)
+        </div>
         <div
           v-if="(selectedDockerHost?.containers || []).length === 0"
           class="form-hint"
@@ -378,8 +422,12 @@
         v-if="form.metric === 'docker_compose_degraded_services' && form.docker_scope.host_id"
         class="col-md-4"
       >
-        <label class="form-label required">Projet Compose</label>
+        <label
+          for="alert-source-docker-project"
+          class="form-label required"
+        >Projet Compose</label>
         <select
+          id="alert-source-docker-project"
           v-model="form.docker_scope.project_name"
           class="form-select"
         >
diff --git a/frontend/src/components/alerts/AlertRuleTemplateModal.spec.ts b/frontend/src/components/alerts/AlertRuleTemplateModal.spec.ts
new file mode 100644
index 00000000..ac12a594
--- /dev/null
+++ b/frontend/src/components/alerts/AlertRuleTemplateModal.spec.ts
@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { nextTick } from 'vue'
+import AlertRuleTemplateModal from './AlertRuleTemplateModal.vue'
+
+const agentMetrics = [
+  { metric: 'cpu', label: 'CPU', unit: '%', icon: '', badge_class: '', supports_threshold: true, supports_duration: true, supports_host_filter: true },
+  { metric: 'bandwidth_vs_rolling_avg', label: 'Bande passante', unit: '%', icon: '', badge_class: '', supports_threshold: true, supports_duration: false, supports_host_filter: true },
+]
+
+function mountModal(props: Record<string, unknown> = {}) {
+  return mount(AlertRuleTemplateModal, {
+    props: {
+      visible: true,
+      agentMetrics,
+      ...props,
+    },
+  })
+}
+
+describe('AlertRuleTemplateModal (characterization)', () => {
+  it('renders the generic fields (name, metric, operator, thresholds) with associated labels', () => {
+    const wrapper = mountModal()
+
+    for (const id of [
+      'alert-template-name',
+      'alert-template-metric',
+      'alert-template-operator',
+      'alert-template-threshold-warn',
+      'alert-template-threshold-crit',
+      'alert-template-duration',
+      'alert-template-cooldown',
+      'alert-template-escalate-after-minutes',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+    // "Duration" is hidden for the bandwidth metric — not selected by default.
+    expect(wrapper.find('#alert-template-baseline-window').exists()).toBe(false)
+  })
+
+  it('shows the baseline-window field instead of duration for bandwidth_vs_rolling_avg', async () => {
+    const wrapper = mountModal()
+    await wrapper.find('#alert-template-metric').setValue('bandwidth_vs_rolling_avg')
+    await nextTick()
+
+    expect(wrapper.find('#alert-template-baseline-window').exists()).toBe(true)
+    expect(wrapper.find('#alert-template-duration').exists()).toBe(false)
+  })
+
+  it('toggling a notification channel checkbox works under the "Canaux de notification" group', async () => {
+    const wrapper = mountModal()
+    expect(wrapper.text()).toContain('Canaux de notification')
+
+    const smtpCheckbox = wrapper.findAll('input[type="checkbox"]')[0]
+    expect(smtpCheckbox).toBeTruthy()
+    await smtpCheckbox.setValue(true)
+    expect((smtpCheckbox.element as HTMLInputElement).checked).toBe(true)
+  })
+
+  it('emits "close" when the close button is clicked', async () => {
+    const wrapper = mountModal()
+    await wrapper.find('.btn-close').trigger('click')
+    expect(wrapper.emitted('close')).toBeTruthy()
+  })
+
+  it('pre-fills the form from an existing template (edit mode)', () => {
+    const wrapper = mountModal({
+      template: {
+        id: 1,
+        name: 'CPU élevé',
+        metric: 'cpu',
+        operator: '>',
+        threshold_warn: 70,
+        threshold_crit: 90,
+        duration_seconds: 60,
+        actions: { channels: ['smtp'], cooldown: 300, escalate_after_minutes: 0 },
+      },
+    })
+    expect((wrapper.find('#alert-template-name').element as HTMLInputElement).value).toBe('CPU élevé')
+  })
+})
diff --git a/frontend/src/components/alerts/AlertRuleTemplateModal.vue b/frontend/src/components/alerts/AlertRuleTemplateModal.vue
index 1862c2a2..c43e0fed 100644
--- a/frontend/src/components/alerts/AlertRuleTemplateModal.vue
+++ b/frontend/src/components/alerts/AlertRuleTemplateModal.vue
@@ -24,8 +24,12 @@
           <form @submit.prevent="submit">
             <div class="modal-body">
               <div class="mb-3">
-                <label class="form-label required">Nom</label>
+                <label
+                  for="alert-template-name"
+                  class="form-label required"
+                >Nom</label>
                 <input
+                  id="alert-template-name"
                   v-model="form.name"
                   type="text"
                   class="form-control"
@@ -35,8 +39,12 @@
               </div>
               <div class="row g-3">
                 <div class="col-12 col-md-6">
-                  <label class="form-label required">Métrique</label>
+                  <label
+                    for="alert-template-metric"
+                    class="form-label required"
+                  >Métrique</label>
                   <select
+                    id="alert-template-metric"
                     v-model="form.metric"
                     class="form-select"
                     required
@@ -54,8 +62,12 @@
                   </div>
                 </div>
                 <div class="col-12 col-md-6">
-                  <label class="form-label required">Opérateur</label>
+                  <label
+                    for="alert-template-operator"
+                    class="form-label required"
+                  >Opérateur</label>
                   <select
+                    id="alert-template-operator"
                     v-model="form.operator"
                     class="form-select"
                     required
@@ -78,8 +90,12 @@
                   v-if="form.metric === 'bandwidth_vs_rolling_avg'"
                   class="col-12"
                 >
-                  <label class="form-label required">Fenêtre de moyenne glissante</label>
+                  <label
+                    for="alert-template-baseline-window"
+                    class="form-label required"
+                  >Fenêtre de moyenne glissante</label>
                   <select
+                    id="alert-template-baseline-window"
                     v-model.number="form.baseline_window_seconds"
                     class="form-select"
                   >
@@ -95,10 +111,14 @@
                   </select>
                 </div>
                 <div class="col-6 col-md-3">
-                  <label class="form-label required">
+                  <label
+                    for="alert-template-threshold-warn"
+                    class="form-label required"
+                  >
                     {{ form.metric === 'bandwidth_vs_rolling_avg' ? 'Seuil avertissement (% moyenne)' : 'Seuil avertissement' }}
                   </label>
                   <input
+                    id="alert-template-threshold-warn"
                     v-model.number="form.threshold_warn"
                     type="number"
                     step="any"
@@ -107,10 +127,14 @@
                   >
                 </div>
                 <div class="col-6 col-md-3">
-                  <label class="form-label required">
+                  <label
+                    for="alert-template-threshold-crit"
+                    class="form-label required"
+                  >
                     {{ form.metric === 'bandwidth_vs_rolling_avg' ? 'Seuil critique (% moyenne)' : 'Seuil critique' }}
                   </label>
                   <input
+                    id="alert-template-threshold-crit"
                     v-model.number="form.threshold_crit"
                     type="number"
                     step="any"
@@ -122,8 +146,12 @@
                   v-if="form.metric !== 'bandwidth_vs_rolling_avg'"
                   class="col-6 col-md-3"
                 >
-                  <label class="form-label">Durée (secondes)</label>
+                  <label
+                    for="alert-template-duration"
+                    class="form-label"
+                  >Durée (secondes)</label>
                   <input
+                    id="alert-template-duration"
                     v-model.number="form.duration"
                     type="number"
                     min="0"
@@ -131,8 +159,12 @@
                   >
                 </div>
                 <div class="col-6 col-md-3">
-                  <label class="form-label">Silence (secondes)</label>
+                  <label
+                    for="alert-template-cooldown"
+                    class="form-label"
+                  >Silence (secondes)</label>
                   <input
+                    id="alert-template-cooldown"
                     v-model.number="form.actions.cooldown"
                     type="number"
                     min="0"
@@ -140,8 +172,12 @@
                   >
                 </div>
                 <div class="col-12">
-                  <label class="form-label">Escalade si non acquittée (minutes)</label>
+                  <label
+                    for="alert-template-escalate-after-minutes"
+                    class="form-label"
+                  >Escalade si non acquittée (minutes)</label>
                   <input
+                    id="alert-template-escalate-after-minutes"
                     v-model.number="form.actions.escalate_after_minutes"
                     type="number"
                     min="0"
@@ -154,7 +190,9 @@
                 </div>
               </div>
               <div class="mb-0 mt-3">
-                <label class="form-label">Canaux de notification</label>
+                <div class="form-label">
+                  Canaux de notification
+                </div>
                 <div>
                   <label class="form-check form-check-inline">
                     <input
diff --git a/frontend/src/components/monitoring/MonitoringOverviewPanel.spec.ts b/frontend/src/components/monitoring/MonitoringOverviewPanel.spec.ts
new file mode 100644
index 00000000..c94efcc6
--- /dev/null
+++ b/frontend/src/components/monitoring/MonitoringOverviewPanel.spec.ts
@@ -0,0 +1,118 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import type { UptimeProbe, SSLCertificate } from '../../types/generated'
+import { useAuthStore } from '../../stores/auth'
+
+const RouterLinkStub = { props: ['to'], template: '<a :href="to"><slot /></a>' }
+
+const probeFixture: UptimeProbe = {
+  id: 'probe-1', name: 'API prod', type: 'http', target: 'https://api.example.com',
+  interval_sec: 60, timeout_sec: 10, expected_status: 200, expected_body_regex: '',
+  follow_redirects: true, verify_tls: true, enabled: true, last_status: 'up',
+  consecutive_failures: 0, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z',
+  npm_proxy_host_id: 'npm-1', npm_proxy_host_domain: 'api.example.com',
+}
+
+const certFixture: SSLCertificate = {
+  id: 'cert-1', name: 'api.example.com', host: 'api.example.com', port: 443,
+  enabled: true, days_remaining: 42, created_at: '2026-01-01T00:00:00Z', updated_at: '2026-01-01T00:00:00Z',
+  npm_proxy_host_id: 'npm-1', npm_proxy_host_domain: 'api.example.com',
+}
+
+vi.mock('../../api', () => ({
+  default: {
+    getUptimeProbes: vi.fn(async () => ({ data: { probes: [probeFixture] } })),
+    getUptimeStats: vi.fn(async () => ({ data: { uptime_percent: 99.9 } })),
+    getUptimeHistory: vi.fn(async () => ({ data: { results: [] } })),
+    getSSLCertificates: vi.fn(async () => ({ data: { certificates: [certFixture] } })),
+  },
+}))
+
+import MonitoringOverviewPanel from './MonitoringOverviewPanel.vue'
+
+async function mountPanel() {
+  setActivePinia(createPinia())
+  const auth = useAuthStore()
+  auth.setAuth({ role: 'admin', username: 'admin' } as never, 'admin')
+  const wrapper = mount(MonitoringOverviewPanel, {
+    global: { stubs: { 'router-link': RouterLinkStub, RouterLink: RouterLinkStub } },
+  })
+  await flushPromises()
+  return wrapper
+}
+
+describe('MonitoringOverviewPanel (characterization)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('merges the probe and cert sharing an npm_proxy_host_id into one row', async () => {
+    const wrapper = await mountPanel()
+    expect(wrapper.text()).toContain('api.example.com')
+  })
+
+  it('editing the probe opens the probe form (incl. HTTP-only fields) with associated labels', async () => {
+    const wrapper = await mountPanel()
+    await wrapper.find('[aria-label="Modifier la sonde"]').trigger('click')
+
+    for (const id of [
+      'monitoring-edit-probe-name',
+      'monitoring-edit-probe-type',
+      'monitoring-edit-probe-target',
+      'monitoring-edit-probe-interval',
+      'monitoring-edit-probe-timeout',
+      'monitoring-edit-probe-expected-status',
+      'monitoring-edit-probe-expected-body-regex',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+  })
+
+  it('editing the cert opens the cert form with associated labels', async () => {
+    const wrapper = await mountPanel()
+    await wrapper.find('[aria-label="Modifier le certificat"]').trigger('click')
+
+    for (const id of ['monitoring-edit-cert-name', 'monitoring-edit-cert-host', 'monitoring-edit-cert-port', 'monitoring-edit-cert-sni']) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+  })
+
+  it('the shared "create" modal renders probe fields, and cert fields once toggled on', async () => {
+    const wrapper = await mountPanel()
+    // Only openCreateProbe is exposed (see the component's own defineExpose
+    // comment) — it's the single real entry point (MonitoringView's button).
+    await (wrapper.vm as unknown as { openCreateProbe: () => void }).openCreateProbe()
+    await flushPromises()
+
+    for (const id of [
+      'monitoring-create-name',
+      'monitoring-create-probe-type',
+      'monitoring-create-probe-target',
+      'monitoring-create-probe-interval',
+      'monitoring-create-probe-timeout',
+      'monitoring-create-probe-expected-status',
+      'monitoring-create-probe-expected-body-regex',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+    }
+    // Cert fields not shown yet (probe-only by default).
+    expect(wrapper.find('#monitoring-create-cert-host').exists()).toBe(false)
+
+    // Toggle cert on, probe off, to reach the cert-only Host/Port fields
+    // (with both toggled on, the cert target is derived from the probe's
+    // instead, per the "Certificat SSL vérifié sur ..." branch).
+    const buttons = wrapper.findAll('button')
+    const certToggle = buttons.find((b) => b.text() === 'Certificat SSL')
+    const probeToggle = buttons.find((b) => b.text() === 'Sonde uptime')
+    expect(certToggle && probeToggle).toBeTruthy()
+    await certToggle!.trigger('click')
+    await probeToggle!.trigger('click')
+
+    for (const id of ['monitoring-create-cert-host', 'monitoring-create-cert-port', 'monitoring-create-cert-sni']) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+    }
+  })
+})
diff --git a/frontend/src/components/monitoring/MonitoringOverviewPanel.vue b/frontend/src/components/monitoring/MonitoringOverviewPanel.vue
index 8a29a8a4..db7cc570 100644
--- a/frontend/src/components/monitoring/MonitoringOverviewPanel.vue
+++ b/frontend/src/components/monitoring/MonitoringOverviewPanel.vue
@@ -360,8 +360,12 @@
                 </div>
                 <div class="row g-3">
                   <div class="col-md-7">
-                    <label class="form-label required">Nom</label>
+                    <label
+                      for="monitoring-edit-probe-name"
+                      class="form-label required"
+                    >Nom</label>
                     <input
+                      id="monitoring-edit-probe-name"
                       v-model="probeForm.name"
                       type="text"
                       class="form-control"
@@ -370,8 +374,12 @@
                     >
                   </div>
                   <div class="col-md-5">
-                    <label class="form-label required">Type</label>
+                    <label
+                      for="monitoring-edit-probe-type"
+                      class="form-label required"
+                    >Type</label>
                     <select
+                      id="monitoring-edit-probe-type"
                       v-model="probeForm.type"
                       class="form-select"
                     >
@@ -387,8 +395,12 @@
                     </select>
                   </div>
                   <div class="col-12">
-                    <label class="form-label required">{{ probeTargetLabel }}</label>
+                    <label
+                      for="monitoring-edit-probe-target"
+                      class="form-label required"
+                    >{{ probeTargetLabel }}</label>
                     <input
+                      id="monitoring-edit-probe-target"
                       v-model="probeForm.target"
                       type="text"
                       class="form-control"
@@ -404,8 +416,12 @@
                     </div>
                   </div>
                   <div class="col-md-4">
-                    <label class="form-label">Intervalle (sec)</label>
+                    <label
+                      for="monitoring-edit-probe-interval"
+                      class="form-label"
+                    >Intervalle (sec)</label>
                     <input
+                      id="monitoring-edit-probe-interval"
                       v-model.number="probeForm.interval_sec"
                       type="number"
                       min="10"
@@ -413,8 +429,12 @@
                     >
                   </div>
                   <div class="col-md-4">
-                    <label class="form-label">Timeout (sec)</label>
+                    <label
+                      for="monitoring-edit-probe-timeout"
+                      class="form-label"
+                    >Timeout (sec)</label>
                     <input
+                      id="monitoring-edit-probe-timeout"
                       v-model.number="probeForm.timeout_sec"
                       type="number"
                       min="1"
@@ -424,8 +444,12 @@
                   </div>
                   <template v-if="probeForm.type === 'http'">
                     <div class="col-md-4">
-                      <label class="form-label">Statut HTTP attendu</label>
+                      <label
+                        for="monitoring-edit-probe-expected-status"
+                        class="form-label"
+                      >Statut HTTP attendu</label>
                       <input
+                        id="monitoring-edit-probe-expected-status"
                         v-model.number="probeForm.expected_status"
                         type="number"
                         min="100"
@@ -434,8 +458,12 @@
                       >
                     </div>
                     <div class="col-12">
-                      <label class="form-label">Regex corps attendu (optionnel)</label>
+                      <label
+                        for="monitoring-edit-probe-expected-body-regex"
+                        class="form-label"
+                      >Regex corps attendu (optionnel)</label>
                       <input
+                        id="monitoring-edit-probe-expected-body-regex"
                         v-model="probeForm.expected_body_regex"
                         type="text"
                         class="form-control"
@@ -505,8 +533,12 @@
                   {{ certFormError }}
                 </div>
                 <div class="mb-3">
-                  <label class="form-label required">Nom</label>
+                  <label
+                    for="monitoring-edit-cert-name"
+                    class="form-label required"
+                  >Nom</label>
                   <input
+                    id="monitoring-edit-cert-name"
                     v-model="certForm.name"
                     type="text"
                     class="form-control"
@@ -516,8 +548,12 @@
                 </div>
                 <div class="row g-3">
                   <div class="col-md-8">
-                    <label class="form-label required">Hôte</label>
+                    <label
+                      for="monitoring-edit-cert-host"
+                      class="form-label required"
+                    >Hôte</label>
                     <input
+                      id="monitoring-edit-cert-host"
                       v-model="certForm.host"
                       type="text"
                       class="form-control"
@@ -526,8 +562,12 @@
                     >
                   </div>
                   <div class="col-md-4">
-                    <label class="form-label required">Port</label>
+                    <label
+                      for="monitoring-edit-cert-port"
+                      class="form-label required"
+                    >Port</label>
                     <input
+                      id="monitoring-edit-cert-port"
                       v-model.number="certForm.port"
                       type="number"
                       min="1"
@@ -536,8 +576,12 @@
                     >
                   </div>
                   <div class="col-12">
-                    <label class="form-label">SNI (override, optionnel)</label>
+                    <label
+                      for="monitoring-edit-cert-sni"
+                      class="form-label"
+                    >SNI (override, optionnel)</label>
                     <input
+                      id="monitoring-edit-cert-sni"
                       v-model="certForm.server_name"
                       type="text"
                       class="form-control"
@@ -606,8 +650,12 @@
                   {{ probeFormError || certFormError }}
                 </div>
                 <div class="mb-3">
-                  <label class="form-label required">Nom</label>
+                  <label
+                    for="monitoring-create-name"
+                    class="form-label required"
+                  >Nom</label>
                   <input
+                    id="monitoring-create-name"
                     v-model="sharedName"
                     type="text"
                     class="form-control"
@@ -619,8 +667,12 @@
                 <template v-if="createIncludeProbe">
                   <div class="row g-3">
                     <div class="col-md-5">
-                      <label class="form-label required">Type</label>
+                      <label
+                        for="monitoring-create-probe-type"
+                        class="form-label required"
+                      >Type</label>
                       <select
+                        id="monitoring-create-probe-type"
                         v-model="probeForm.type"
                         class="form-select"
                       >
@@ -636,8 +688,12 @@
                       </select>
                     </div>
                     <div class="col-md-7">
-                      <label class="form-label required">{{ probeTargetLabel }}</label>
+                      <label
+                        for="monitoring-create-probe-target"
+                        class="form-label required"
+                      >{{ probeTargetLabel }}</label>
                       <input
+                        id="monitoring-create-probe-target"
                         v-model="probeForm.target"
                         type="text"
                         class="form-control"
@@ -653,8 +709,12 @@
                       </div>
                     </div>
                     <div class="col-md-4">
-                      <label class="form-label">Intervalle (sec)</label>
+                      <label
+                        for="monitoring-create-probe-interval"
+                        class="form-label"
+                      >Intervalle (sec)</label>
                       <input
+                        id="monitoring-create-probe-interval"
                         v-model.number="probeForm.interval_sec"
                         type="number"
                         min="10"
@@ -662,8 +722,12 @@
                       >
                     </div>
                     <div class="col-md-4">
-                      <label class="form-label">Timeout (sec)</label>
+                      <label
+                        for="monitoring-create-probe-timeout"
+                        class="form-label"
+                      >Timeout (sec)</label>
                       <input
+                        id="monitoring-create-probe-timeout"
                         v-model.number="probeForm.timeout_sec"
                         type="number"
                         min="1"
@@ -673,8 +737,12 @@
                     </div>
                     <template v-if="probeForm.type === 'http'">
                       <div class="col-md-4">
-                        <label class="form-label">Statut HTTP attendu</label>
+                        <label
+                          for="monitoring-create-probe-expected-status"
+                          class="form-label"
+                        >Statut HTTP attendu</label>
                         <input
+                          id="monitoring-create-probe-expected-status"
                           v-model.number="probeForm.expected_status"
                           type="number"
                           min="100"
@@ -683,8 +751,12 @@
                         >
                       </div>
                       <div class="col-12">
-                        <label class="form-label">Regex corps attendu (optionnel)</label>
+                        <label
+                          for="monitoring-create-probe-expected-body-regex"
+                          class="form-label"
+                        >Regex corps attendu (optionnel)</label>
                         <input
+                          id="monitoring-create-probe-expected-body-regex"
                           v-model="probeForm.expected_body_regex"
                           type="text"
                           class="form-control"
@@ -733,8 +805,12 @@
                   <div class="row g-3">
                     <template v-if="!createIncludeProbe">
                       <div class="col-md-8">
-                        <label class="form-label required">Hôte</label>
+                        <label
+                          for="monitoring-create-cert-host"
+                          class="form-label required"
+                        >Hôte</label>
                         <input
+                          id="monitoring-create-cert-host"
                           v-model="certForm.host"
                           type="text"
                           class="form-control"
@@ -743,8 +819,12 @@
                         >
                       </div>
                       <div class="col-md-4">
-                        <label class="form-label required">Port</label>
+                        <label
+                          for="monitoring-create-cert-port"
+                          class="form-label required"
+                        >Port</label>
                         <input
+                          id="monitoring-create-cert-port"
                           v-model.number="certForm.port"
                           type="number"
                           min="1"
@@ -760,8 +840,12 @@
                       Certificat SSL vérifié sur <code>{{ certForm.host || '—' }}:{{ certForm.port }}</code> (dérivé de la cible de la sonde ci-dessus).
                     </div>
                     <div class="col-12">
-                      <label class="form-label">SNI (override, optionnel)</label>
+                      <label
+                        for="monitoring-create-cert-sni"
+                        class="form-label"
+                      >SNI (override, optionnel)</label>
                       <input
+                        id="monitoring-create-cert-sni"
                         v-model="certForm.server_name"
                         type="text"
                         class="form-control"
diff --git a/frontend/src/components/network/NetworkTopologyConfig.spec.ts b/frontend/src/components/network/NetworkTopologyConfig.spec.ts
new file mode 100644
index 00000000..4b94b97d
--- /dev/null
+++ b/frontend/src/components/network/NetworkTopologyConfig.spec.ts
@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest'
+import { mount } from '@vue/test-utils'
+import NetworkTopologyConfig from './NetworkTopologyConfig.vue'
+
+function mountConfig() {
+  return mount(NetworkTopologyConfig, {
+    props: {
+      hosts: [{ id: 'host-1', name: 'srv-web' }],
+      containers: [{ host_id: 'host-1', name: 'app', port_mappings: [{ host_port: 8080, container_port: 80, protocol: 'tcp' }] }],
+      rootHostId: 'host-1',
+      autheliaHostId: 'host-1',
+      networkServices: [{
+        id: 'svc-1', name: '', domain: '', path: '', internalPort: null, externalPort: null,
+        hostId: '', tags: '', linkToProxy: false, linkToAuthelia: false, exposedToInternet: false,
+      }],
+    },
+  })
+}
+
+describe('NetworkTopologyConfig (characterization)', () => {
+  it('renders the root/Authelia/Internet section fields with associated labels or aria-labels', () => {
+    const wrapper = mountConfig()
+
+    for (const id of [
+      'network-config-root-node-name',
+      'network-config-root-node-ip',
+      'network-config-root-host-id',
+      'network-config-root-port-id', // shown because rootHostId has a discovered non-internal port
+      'network-config-authelia-host-id',
+      'network-config-authelia-port-id',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+
+    // Authelia / Internet free-text inputs use aria-label instead of a
+    // sibling <label> (grouped under a section heading, not one per field).
+    expect(wrapper.find('input[aria-label="Label affiché dans le graphe"]').exists()).toBe(true)
+    expect(wrapper.find('input[aria-label="IP ou domaine Authelia"]').exists()).toBe(true)
+    expect(wrapper.find('input[aria-label="IP publique ou domaine"]').exists()).toBe(true)
+  })
+
+  it('renders one manual-service table row with an aria-label per cell', () => {
+    const wrapper = mountConfig()
+
+    for (const label of ['Nom du service', 'Domaine', 'Chemin', 'Port interne', 'Host', 'Lier au proxy', 'Lier à Authelia', 'Exposer sur Internet', 'Port externe']) {
+      expect(wrapper.find(`[aria-label="${label}"]`).exists(), `aria-label="${label}"`).toBe(true)
+    }
+  })
+
+  it('renders one discovered-port table row (per host) with an aria-label per cell', () => {
+    const wrapper = mountConfig()
+
+    expect(wrapper.text()).toContain('srv-web')
+    for (const label of ['Nom du service', 'Domaine', 'Chemin', 'Afficher ce port', 'Lier au proxy', 'Lier à Authelia', 'Exposer sur Internet', 'Port externe']) {
+      expect(wrapper.find(`[aria-label="${label}"]`).exists(), `aria-label="${label}"`).toBe(true)
+    }
+  })
+})
diff --git a/frontend/src/components/network/NetworkTopologyConfig.vue b/frontend/src/components/network/NetworkTopologyConfig.vue
index ef9f00fe..8a71929a 100644
--- a/frontend/src/components/network/NetworkTopologyConfig.vue
+++ b/frontend/src/components/network/NetworkTopologyConfig.vue
@@ -2,8 +2,12 @@
   <div class="network-config">
     <div class="network-config-row">
       <div class="network-config-item">
-        <label class="form-label">Reverse proxy</label>
+        <label
+          for="network-config-root-node-name"
+          class="form-label"
+        >Reverse proxy</label>
         <input
+          id="network-config-root-node-name"
           v-model="rootNodeName"
           type="text"
           class="form-control form-control-sm"
@@ -11,8 +15,12 @@
         >
       </div>
       <div class="network-config-item">
-        <label class="form-label">IP du proxy</label>
+        <label
+          for="network-config-root-node-ip"
+          class="form-label"
+        >IP du proxy</label>
         <input
+          id="network-config-root-node-ip"
           v-model="rootNodeIp"
           type="text"
           class="form-control form-control-sm"
@@ -21,11 +29,15 @@
       </div>
     </div>
     <div class="network-config-item mt-2">
-      <label class="form-label">
+      <label
+        for="network-config-root-host-id"
+        class="form-label"
+      >
         Hôte correspondant
         <span class="text-secondary fw-normal">(optionnel — supprime le nœud fantôme)</span>
       </label>
       <select
+        id="network-config-root-host-id"
         v-model="rootHostId"
         class="form-select form-select-sm"
       >
@@ -47,11 +59,15 @@
         v-if="rootHostId && proxyHostPorts.length > 0"
         class="mt-2"
       >
-        <label class="form-label">
+        <label
+          for="network-config-root-port-id"
+          class="form-label"
+        >
           Port spécifique
           <span class="text-secondary fw-normal">(optionnel)</span>
         </label>
         <select
+          id="network-config-root-port-id"
           v-model="rootPortId"
           class="form-select form-select-sm"
         >
@@ -78,7 +94,9 @@
     <div class="network-config-item mt-3">
       <div class="d-flex align-items-center justify-content-between mb-2">
         <div>
-          <label class="form-label mb-0">Services manuels via proxy</label>
+          <div class="form-label mb-0">
+            Services manuels via proxy
+          </div>
           <div class="text-secondary small mt-1">
             Services définis manuellement, non détectés automatiquement.
             Pour les ports découverts, utilisez la section "Ports découverts" ci-dessous
@@ -121,6 +139,7 @@
               <td>
                 <input
                   v-model="service.name"
+                  aria-label="Nom du service"
                   class="form-control form-control-sm"
                   placeholder="Ex: Vaultwarden"
                 >
@@ -128,6 +147,7 @@
               <td>
                 <input
                   v-model="service.domain"
+                  aria-label="Domaine"
                   class="form-control form-control-sm"
                   placeholder="vault.example.com"
                 >
@@ -135,6 +155,7 @@
               <td>
                 <input
                   v-model="service.path"
+                  aria-label="Chemin"
                   class="form-control form-control-sm"
                   placeholder="/"
                 >
@@ -143,6 +164,7 @@
                 <input
                   v-model.number="service.internalPort"
                   type="number"
+                  aria-label="Port interne"
                   class="form-control form-control-sm"
                   placeholder="3000"
                 >
@@ -150,6 +172,7 @@
               <td>
                 <select
                   v-model="service.hostId"
+                  aria-label="Host"
                   class="form-select form-select-sm"
                 >
                   <option value="">
@@ -167,6 +190,7 @@
               <td>
                 <label class="form-check form-switch"><input
                   v-model="service.linkToProxy"
+                  aria-label="Lier au proxy"
                   class="form-check-input"
                   type="checkbox"
                 ></label>
@@ -174,6 +198,7 @@
               <td>
                 <label class="form-check form-switch"><input
                   v-model="service.linkToAuthelia"
+                  aria-label="Lier à Authelia"
                   class="form-check-input"
                   type="checkbox"
                 ></label>
@@ -181,6 +206,7 @@
               <td>
                 <label class="form-check form-switch"><input
                   v-model="service.exposedToInternet"
+                  aria-label="Exposer sur Internet"
                   class="form-check-input"
                   type="checkbox"
                 ></label>
@@ -189,6 +215,7 @@
                 <input
                   v-model.number="service.externalPort"
                   type="number"
+                  aria-label="Port externe"
                   class="form-control form-control-sm"
                   placeholder="443"
                   :disabled="!service.exposedToInternet"
@@ -219,12 +246,15 @@
     </div>
 
     <div class="network-config-item mt-3">
-      <label class="form-label">Nœud Authelia (optionnel)</label>
+      <div class="form-label">
+        Nœud Authelia (optionnel)
+      </div>
       <div class="network-config-row">
         <div>
           <input
             v-model="autheliaLabel"
             type="text"
+            aria-label="Label affiché dans le graphe"
             class="form-control form-control-sm"
             placeholder="Ex: Authelia"
           >
@@ -236,6 +266,7 @@
           <input
             v-model="autheliaIp"
             type="text"
+            aria-label="IP ou domaine Authelia"
             class="form-control form-control-sm"
             placeholder="Ex: 192.168.1.11"
           >
@@ -245,11 +276,15 @@
         </div>
       </div>
       <div class="mt-2">
-        <label class="form-label">
+        <label
+          for="network-config-authelia-host-id"
+          class="form-label"
+        >
           Hôte correspondant
           <span class="text-secondary fw-normal">(optionnel)</span>
         </label>
         <select
+          id="network-config-authelia-host-id"
           v-model="autheliaHostId"
           class="form-select form-select-sm"
         >
@@ -268,11 +303,15 @@
           v-if="autheliaHostId && autheliaHostPorts.length > 0"
           class="mt-2"
         >
-          <label class="form-label">
+          <label
+            for="network-config-authelia-port-id"
+            class="form-label"
+          >
             Port spécifique
             <span class="text-secondary fw-normal">(optionnel)</span>
           </label>
           <select
+            id="network-config-authelia-port-id"
             v-model="autheliaPortId"
             class="form-select form-select-sm"
           >
@@ -298,12 +337,15 @@
     </div>
 
     <div class="network-config-item mt-3">
-      <label class="form-label">Nœud Internet / Routeur (optionnel)</label>
+      <div class="form-label">
+        Nœud Internet / Routeur (optionnel)
+      </div>
       <div class="network-config-row">
         <div>
           <input
             v-model="internetLabel"
             type="text"
+            aria-label="Label affiché dans le graphe"
             class="form-control form-control-sm"
             placeholder="Ex: Internet"
           >
@@ -315,6 +357,7 @@
           <input
             v-model="internetIp"
             type="text"
+            aria-label="IP publique ou domaine"
             class="form-control form-control-sm"
             placeholder="Ex: 1.2.3.4"
           >
@@ -327,7 +370,9 @@
 
     <div class="network-config-item mt-4">
       <div class="d-flex align-items-center justify-content-between mb-2">
-        <label class="form-label mb-0">Ports decouverts par host</label>
+        <div class="form-label mb-0">
+          Ports decouverts par host
+        </div>
         <div class="text-secondary small">
           Nommer, masquer, lier au proxy
         </div>
@@ -405,6 +450,7 @@
                   <td>
                     <input
                       v-model="getPortSetting(host.id, port.port).name"
+                      aria-label="Nom du service"
                       class="form-control form-control-sm"
                       placeholder="Ex: Vaultwarden"
                     >
@@ -412,6 +458,7 @@
                   <td>
                     <input
                       v-model="getPortSetting(host.id, port.port).domain"
+                      aria-label="Domaine"
                       class="form-control form-control-sm"
                       placeholder="vault.example.com"
                     >
@@ -419,6 +466,7 @@
                   <td>
                     <input
                       v-model="getPortSetting(host.id, port.port).path"
+                      aria-label="Chemin"
                       class="form-control form-control-sm"
                       placeholder="/"
                     >
@@ -428,6 +476,7 @@
                       <input
                         :id="`port-enabled-${host.id}-${port.port}`"
                         v-model="getPortSetting(host.id, port.port).enabled"
+                        aria-label="Afficher ce port"
                         class="form-check-input"
                         type="checkbox"
                         @change="onEnabledChange(host.id, port.port, $event)"
@@ -441,6 +490,7 @@
                     >
                       <input
                         v-model="getPortSetting(host.id, port.port).linkToProxy"
+                        aria-label="Lier au proxy"
                         class="form-check-input"
                         type="checkbox"
                         :disabled="!getPortSetting(host.id, port.port).enabled"
@@ -451,6 +501,7 @@
                     <label class="form-check form-switch">
                       <input
                         v-model="getPortSetting(host.id, port.port).linkToAuthelia"
+                        aria-label="Lier à Authelia"
                         class="form-check-input"
                         type="checkbox"
                         :disabled="!getPortSetting(host.id, port.port).enabled"
@@ -461,6 +512,7 @@
                     <label class="form-check form-switch">
                       <input
                         v-model="getPortSetting(host.id, port.port).exposedToInternet"
+                        aria-label="Exposer sur Internet"
                         class="form-check-input"
                         type="checkbox"
                         :disabled="!getPortSetting(host.id, port.port).enabled"
@@ -471,6 +523,7 @@
                     <input
                       v-model.number="getPortSetting(host.id, port.port).externalPort"
                       type="number"
+                      aria-label="Port externe"
                       class="form-control form-control-sm"
                       placeholder="443"
                       :disabled="!getPortSetting(host.id, port.port).exposedToInternet"
diff --git a/frontend/src/components/settings/SettingsThreatDetectionCard.spec.ts b/frontend/src/components/settings/SettingsThreatDetectionCard.spec.ts
new file mode 100644
index 00000000..a2ecec25
--- /dev/null
+++ b/frontend/src/components/settings/SettingsThreatDetectionCard.spec.ts
@@ -0,0 +1,70 @@
+import { describe, it, expect } from 'vitest'
+import { mount } from '@vue/test-utils'
+import SettingsThreatDetectionCard from './SettingsThreatDetectionCard.vue'
+
+function defaultForm() {
+  return {
+    threatWeightWordpress: 1,
+    threatWeightAdminpanel: 1,
+    threatWeightPathtraversal: 1,
+    threatWeightKnownscanner: 1,
+    threatWeightSuspiciousmethod: 1,
+    threatWeightStatus2xx: 0.1,
+    threatWeightStatus3xx: 0.2,
+    threatWeightStatus404: 0.5,
+    threatWeightStatus4xx: 0.3,
+    threatWeightStatus5xx: 0.4,
+    threatWeightBreadth: 1,
+    threatWeightHits: 1,
+    threatThresholdMedium: 10,
+    threatThresholdHigh: 30,
+    threatThresholdCritical: 60,
+  }
+}
+
+describe('SettingsThreatDetectionCard (characterization)', () => {
+  it('renders every weight/threshold field with its label correctly associated', () => {
+    const wrapper = mount(SettingsThreatDetectionCard, {
+      props: { form: defaultForm() },
+    })
+
+    const fieldIds = [
+      'threat-weight-wordpress',
+      'threat-weight-adminpanel',
+      'threat-weight-pathtraversal',
+      'threat-weight-knownscanner',
+      'threat-weight-suspiciousmethod',
+      'threat-weight-status-2xx',
+      'threat-weight-status-3xx',
+      'threat-weight-status-404',
+      'threat-weight-status-4xx',
+      'threat-weight-status-5xx',
+      'threat-weight-breadth',
+      'threat-weight-hits',
+      'threat-threshold-medium',
+      'threat-threshold-high',
+      'threat-threshold-critical',
+    ]
+
+    for (const id of fieldIds) {
+      const input = wrapper.find(`#${id}`)
+      expect(input.exists(), `expected #${id} to exist`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `expected a label for #${id}`).toBe(true)
+    }
+  })
+
+  it('shows an incoherence warning when thresholds are not increasing', () => {
+    const wrapper = mount(SettingsThreatDetectionCard, {
+      props: { form: { ...defaultForm(), threatThresholdMedium: 50, threatThresholdHigh: 30 } },
+    })
+    expect(wrapper.text()).toContain('devraient être croissants')
+  })
+
+  it('emits "save" when the admin-only save button is clicked', async () => {
+    const wrapper = mount(SettingsThreatDetectionCard, {
+      props: { form: defaultForm(), authIsAdmin: true },
+    })
+    await wrapper.find('.card-footer button').trigger('click')
+    expect(wrapper.emitted('save')).toBeTruthy()
+  })
+})
diff --git a/frontend/src/components/settings/SettingsThreatDetectionCard.vue b/frontend/src/components/settings/SettingsThreatDetectionCard.vue
index 6714b76e..bd2ccd78 100644
--- a/frontend/src/components/settings/SettingsThreatDetectionCard.vue
+++ b/frontend/src/components/settings/SettingsThreatDetectionCard.vue
@@ -19,8 +19,12 @@
       </h4>
       <div class="row g-2 mb-3">
         <div class="col-6 col-md-4">
-          <label class="form-label">WordPress</label>
+          <label
+            for="threat-weight-wordpress"
+            class="form-label"
+          >WordPress</label>
           <input
+            id="threat-weight-wordpress"
             v-model.number="form.threatWeightWordpress"
             type="number"
             step="0.1"
@@ -29,8 +33,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">Panneau admin</label>
+          <label
+            for="threat-weight-adminpanel"
+            class="form-label"
+          >Panneau admin</label>
           <input
+            id="threat-weight-adminpanel"
             v-model.number="form.threatWeightAdminpanel"
             type="number"
             step="0.1"
@@ -39,8 +47,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">Traversée de chemin</label>
+          <label
+            for="threat-weight-pathtraversal"
+            class="form-label"
+          >Traversée de chemin</label>
           <input
+            id="threat-weight-pathtraversal"
             v-model.number="form.threatWeightPathtraversal"
             type="number"
             step="0.1"
@@ -49,8 +61,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">Scanner connu</label>
+          <label
+            for="threat-weight-knownscanner"
+            class="form-label"
+          >Scanner connu</label>
           <input
+            id="threat-weight-knownscanner"
             v-model.number="form.threatWeightKnownscanner"
             type="number"
             step="0.1"
@@ -59,8 +75,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">Méthode suspecte</label>
+          <label
+            for="threat-weight-suspiciousmethod"
+            class="form-label"
+          >Méthode suspecte</label>
           <input
+            id="threat-weight-suspiciousmethod"
             v-model.number="form.threatWeightSuspiciousmethod"
             type="number"
             step="0.1"
@@ -75,8 +95,12 @@
       </h4>
       <div class="row g-2 mb-3">
         <div class="col-6 col-md-4">
-          <label class="form-label">2xx (succès)</label>
+          <label
+            for="threat-weight-status-2xx"
+            class="form-label"
+          >2xx (succès)</label>
           <input
+            id="threat-weight-status-2xx"
             v-model.number="form.threatWeightStatus2xx"
             type="number"
             step="0.05"
@@ -85,8 +109,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">3xx (redirection)</label>
+          <label
+            for="threat-weight-status-3xx"
+            class="form-label"
+          >3xx (redirection)</label>
           <input
+            id="threat-weight-status-3xx"
             v-model.number="form.threatWeightStatus3xx"
             type="number"
             step="0.1"
@@ -95,8 +123,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">404</label>
+          <label
+            for="threat-weight-status-404"
+            class="form-label"
+          >404</label>
           <input
+            id="threat-weight-status-404"
             v-model.number="form.threatWeightStatus404"
             type="number"
             step="0.1"
@@ -105,8 +137,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">4xx (autre)</label>
+          <label
+            for="threat-weight-status-4xx"
+            class="form-label"
+          >4xx (autre)</label>
           <input
+            id="threat-weight-status-4xx"
             v-model.number="form.threatWeightStatus4xx"
             type="number"
             step="0.1"
@@ -115,8 +151,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">5xx</label>
+          <label
+            for="threat-weight-status-5xx"
+            class="form-label"
+          >5xx</label>
           <input
+            id="threat-weight-status-5xx"
             v-model.number="form.threatWeightStatus5xx"
             type="number"
             step="0.1"
@@ -132,10 +172,11 @@
       <div class="row g-2 mb-3">
         <div class="col-6 col-md-4">
           <label
+            for="threat-weight-breadth"
             class="form-label"
-            aria-describedby="threat-breadth-hint"
           >Largeur (chemins distincts)</label>
           <input
+            id="threat-weight-breadth"
             v-model.number="form.threatWeightBreadth"
             type="number"
             step="0.1"
@@ -152,10 +193,11 @@
         </div>
         <div class="col-6 col-md-4">
           <label
+            for="threat-weight-hits"
             class="form-label"
-            aria-describedby="threat-hits-hint"
           >Volume de requêtes</label>
           <input
+            id="threat-weight-hits"
             v-model.number="form.threatWeightHits"
             type="number"
             step="0.1"
@@ -177,8 +219,12 @@
       </h4>
       <div class="row g-2">
         <div class="col-6 col-md-4">
-          <label class="form-label">MEDIUM à partir de</label>
+          <label
+            for="threat-threshold-medium"
+            class="form-label"
+          >MEDIUM à partir de</label>
           <input
+            id="threat-threshold-medium"
             v-model.number="form.threatThresholdMedium"
             type="number"
             step="1"
@@ -187,8 +233,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">HIGH à partir de</label>
+          <label
+            for="threat-threshold-high"
+            class="form-label"
+          >HIGH à partir de</label>
           <input
+            id="threat-threshold-high"
             v-model.number="form.threatThresholdHigh"
             type="number"
             step="1"
@@ -197,8 +247,12 @@
           >
         </div>
         <div class="col-6 col-md-4">
-          <label class="form-label">CRITICAL à partir de</label>
+          <label
+            for="threat-threshold-critical"
+            class="form-label"
+          >CRITICAL à partir de</label>
           <input
+            id="threat-threshold-critical"
             v-model.number="form.threatThresholdCritical"
             type="number"
             step="1"
diff --git a/frontend/src/components/webhooks/WebhookModal.spec.ts b/frontend/src/components/webhooks/WebhookModal.spec.ts
new file mode 100644
index 00000000..71206612
--- /dev/null
+++ b/frontend/src/components/webhooks/WebhookModal.spec.ts
@@ -0,0 +1,89 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { nextTick } from 'vue'
+
+// Mock the API barrel so the component never hits the network on mount/watchers
+// (useWebhookForm's immediate watcher loads custom tasks / registry credentials
+// / pickable containers as soon as the modal is visible).
+vi.mock('../../api', () => ({
+  default: {
+    getHostCustomTasks: vi.fn(async () => ({ data: [] })),
+    getRegistryCredentials: vi.fn(async () => ({ data: { credentials: [] } })),
+    getPickableContainers: vi.fn(async () => ({ data: { containers: [] } })),
+  },
+}))
+
+import WebhookModal from './WebhookModal.vue'
+
+function mountModal(props: Record<string, unknown> = {}) {
+  return mount(WebhookModal, {
+    props: {
+      visible: true,
+      hosts: [{ id: 'host-1', name: 'srv-web' }],
+      ...props,
+    },
+  })
+}
+
+describe('WebhookModal (characterization)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('webhook mode: renders the git-webhook fields, VM cible and the tasks.yaml field, each labelled', async () => {
+    const wrapper = mountModal({ mode: 'webhook' })
+    await nextTick()
+
+    for (const id of [
+      'webhook-name',
+      'webhook-provider',
+      'webhook-event-filter',
+      'webhook-repo-filter',
+      'webhook-branch-filter',
+      'webhook-host-id',
+      'webhook-custom-task-id',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+  })
+
+  it('tracker mode, docker + compose with a dispatch task: renders cooldown, compose fields and both hooks', async () => {
+    const wrapper = mountModal({
+      mode: 'tracker',
+      item: {
+        name: 'Update Home Assistant',
+        tracker_type: 'docker',
+        host_id: 'host-1',
+        docker_image: 'ghcr.io/home-assistant/home-assistant',
+        docker_tag: 'latest',
+        update_action: 'compose',
+        compose_project: 'homeassistant',
+      },
+    })
+    await nextTick()
+
+    for (const id of [
+      'webhook-cooldown-hours',
+      'webhook-host-id',
+      'webhook-compose-project',
+      'webhook-compose-service',
+      'webhook-healthcheck-timeout',
+      'webhook-pre-update-task-id',
+      'webhook-post-update-task-id',
+      // Nested WebhookTrackerFields, docker branch.
+      'webhook-tracker-source-host',
+      'webhook-tracker-container',
+      'webhook-tracker-registry-credentials',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+    }
+    expect(wrapper.text()).toContain('Mode de mise a jour')
+  })
+
+  it('emits "close" when the close button is clicked', async () => {
+    const wrapper = mountModal()
+    await wrapper.find('.btn-close').trigger('click')
+    expect(wrapper.emitted('close')).toBeTruthy()
+  })
+})
diff --git a/frontend/src/components/webhooks/WebhookModal.vue b/frontend/src/components/webhooks/WebhookModal.vue
index d4bcc86d..15beaa17 100644
--- a/frontend/src/components/webhooks/WebhookModal.vue
+++ b/frontend/src/components/webhooks/WebhookModal.vue
@@ -29,8 +29,12 @@
 
           <div class="row g-3">
             <div class="col-12">
-              <label class="form-label required">Nom</label>
+              <label
+                for="webhook-name"
+                class="form-label required"
+              >Nom</label>
               <input
+                id="webhook-name"
                 v-model="form.name"
                 type="text"
                 class="form-control"
@@ -41,8 +45,12 @@
             <!-- ===== WEBHOOK FIELDS ===== -->
             <template v-if="mode === 'webhook'">
               <div class="col-md-6">
-                <label class="form-label required">Provider</label>
+                <label
+                  for="webhook-provider"
+                  class="form-label required"
+                >Provider</label>
                 <select
+                  id="webhook-provider"
                   v-model="form.provider"
                   class="form-select"
                 >
@@ -64,8 +72,12 @@
                 </select>
               </div>
               <div class="col-md-6">
-                <label class="form-label">Evenement</label>
+                <label
+                  for="webhook-event-filter"
+                  class="form-label"
+                >Evenement</label>
                 <select
+                  id="webhook-event-filter"
                   v-model="form.event_filter"
                   class="form-select"
                 >
@@ -81,8 +93,12 @@
                 </select>
               </div>
               <div class="col-md-6">
-                <label class="form-label">Filtre repo <span class="text-muted">(optionnel)</span></label>
+                <label
+                  for="webhook-repo-filter"
+                  class="form-label"
+                >Filtre repo <span class="text-muted">(optionnel)</span></label>
                 <input
+                  id="webhook-repo-filter"
                   v-model="form.repo_filter"
                   type="text"
                   class="form-control"
@@ -90,8 +106,12 @@
                 >
               </div>
               <div class="col-md-6">
-                <label class="form-label">Filtre branche <span class="text-muted">(optionnel)</span></label>
+                <label
+                  for="webhook-branch-filter"
+                  class="form-label"
+                >Filtre branche <span class="text-muted">(optionnel)</span></label>
                 <input
+                  id="webhook-branch-filter"
                   v-model="form.branch_filter"
                   type="text"
                   class="form-control"
@@ -141,8 +161,12 @@
               v-if="mode === 'tracker' && form.dispatch_task"
               class="col-md-4"
             >
-              <label class="form-label">Cooldown (heures)</label>
+              <label
+                for="webhook-cooldown-hours"
+                class="form-label"
+              >Cooldown (heures)</label>
               <input
+                id="webhook-cooldown-hours"
                 v-model.number="form.cooldown_hours"
                 type="number"
                 min="0"
@@ -160,7 +184,9 @@
               v-if="mode === 'tracker' && form.dispatch_task && form.tracker_type === 'docker'"
               class="col-12"
             >
-              <label class="form-label">Mode de mise a jour</label>
+              <div class="form-label">
+                Mode de mise a jour
+              </div>
               <div class="row g-2">
                 <div class="col-6">
                   <label
@@ -202,10 +228,12 @@
             <template v-if="mode === 'webhook' || (mode === 'tracker' && form.dispatch_task)">
               <div class="col-md-6">
                 <label
+                  for="webhook-host-id"
                   class="form-label"
                   :class="(mode === 'webhook' || (mode === 'tracker' && form.dispatch_task)) ? 'required' : ''"
                 >VM cible</label>
                 <select
+                  id="webhook-host-id"
                   v-model="form.host_id"
                   class="form-select"
                 >
@@ -225,8 +253,12 @@
               <!-- Compose mode: project + service -->
               <template v-if="isComposeMode">
                 <div class="col-md-6">
-                  <label class="form-label required">Projet compose</label>
+                  <label
+                    for="webhook-compose-project"
+                    class="form-label required"
+                  >Projet compose</label>
                   <input
+                    id="webhook-compose-project"
                     v-model="form.compose_project"
                     type="text"
                     class="form-control"
@@ -241,8 +273,12 @@
                   </div>
                 </div>
                 <div class="col-md-6">
-                  <label class="form-label">Service <span class="text-muted">(optionnel)</span></label>
+                  <label
+                    for="webhook-compose-service"
+                    class="form-label"
+                  >Service <span class="text-muted">(optionnel)</span></label>
                   <input
+                    id="webhook-compose-service"
                     v-model="form.compose_service"
                     type="text"
                     class="form-control"
@@ -250,8 +286,12 @@
                   >
                 </div>
                 <div class="col-md-4">
-                  <label class="form-label">Healthcheck (s)</label>
+                  <label
+                    for="webhook-healthcheck-timeout"
+                    class="form-label"
+                  >Healthcheck (s)</label>
                   <input
+                    id="webhook-healthcheck-timeout"
                     v-model.number="form.healthcheck_timeout_sec"
                     type="number"
                     min="0"
@@ -300,9 +340,13 @@
                   </div>
                 </div>
                 <div class="col-md-6">
-                  <label class="form-label">Hook avant MAJ <span class="text-muted">(optionnel)</span></label>
+                  <label
+                    for="webhook-pre-update-task-id"
+                    class="form-label"
+                  >Hook avant MAJ <span class="text-muted">(optionnel)</span></label>
                   <select
                     v-if="customTasks.length"
+                    id="webhook-pre-update-task-id"
                     v-model="form.pre_update_task_id"
                     class="form-select"
                   >
@@ -319,6 +363,7 @@
                   </select>
                   <input
                     v-else
+                    id="webhook-pre-update-task-id"
                     v-model="form.pre_update_task_id"
                     type="text"
                     class="form-control"
@@ -329,9 +374,13 @@
                   </div>
                 </div>
                 <div class="col-md-6">
-                  <label class="form-label">Hook apres MAJ <span class="text-muted">(optionnel)</span></label>
+                  <label
+                    for="webhook-post-update-task-id"
+                    class="form-label"
+                  >Hook apres MAJ <span class="text-muted">(optionnel)</span></label>
                   <select
                     v-if="customTasks.length"
+                    id="webhook-post-update-task-id"
                     v-model="form.post_update_task_id"
                     class="form-select"
                   >
@@ -348,6 +397,7 @@
                   </select>
                   <input
                     v-else
+                    id="webhook-post-update-task-id"
                     v-model="form.post_update_task_id"
                     type="text"
                     class="form-control"
@@ -362,11 +412,13 @@
                 class="col-md-6"
               >
                 <label
+                  for="webhook-custom-task-id"
                   class="form-label"
                   :class="(mode === 'webhook' || (mode === 'tracker' && form.dispatch_task)) ? 'required' : ''"
                 >Tache (tasks.yaml)</label>
                 <select
                   v-if="customTasks.length"
+                  id="webhook-custom-task-id"
                   v-model="form.custom_task_id"
                   class="form-select"
                 >
@@ -386,6 +438,7 @@
                 </select>
                 <input
                   v-else
+                  id="webhook-custom-task-id"
                   v-model="form.custom_task_id"
                   type="text"
                   class="form-control"
@@ -403,7 +456,9 @@
 
             <!-- Notifications -->
             <div class="col-12">
-              <label class="form-label">Notifications</label>
+              <div class="form-label">
+                Notifications
+              </div>
               <div class="d-flex flex-wrap gap-3 mt-1">
                 <label
                   v-if="mode === 'webhook'"
diff --git a/frontend/src/components/webhooks/WebhookTrackerFields.spec.ts b/frontend/src/components/webhooks/WebhookTrackerFields.spec.ts
new file mode 100644
index 00000000..39337f12
--- /dev/null
+++ b/frontend/src/components/webhooks/WebhookTrackerFields.spec.ts
@@ -0,0 +1,62 @@
+import { describe, it, expect } from 'vitest'
+import { mount } from '@vue/test-utils'
+import WebhookTrackerFields from './WebhookTrackerFields.vue'
+import type { WebhookFormData, PickableContainer } from '../../composables/useWebhookForm'
+
+function baseForm(overrides: Partial<WebhookFormData> = {}): WebhookFormData {
+  return {
+    name: '',
+    notify_channels: [],
+    enabled: true,
+    tracker_type: 'git',
+    provider: 'github',
+    ...overrides,
+  }
+}
+
+function mountFields(form: WebhookFormData) {
+  return mount(WebhookTrackerFields, {
+    props: {
+      form,
+      registryCredentials: [{ id: 'cred-1', name: 'GHCR perso', registry_host: 'ghcr.io' }],
+      containerHosts: [{ id: 'host-1', name: 'srv-web' }],
+      containersForHost: [],
+      containerKey: (c: PickableContainer) => `${c.host_id}:${c.image}`,
+      selectedContainerKey: '',
+      selectedContainerMissing: false,
+      containerSourceHostId: '',
+    },
+  })
+}
+
+describe('WebhookTrackerFields (characterization)', () => {
+  it('git mode: renders provider/owner/repo fields with associated labels', () => {
+    const wrapper = mountFields(baseForm({ tracker_type: 'git' }))
+
+    for (const id of ['webhook-tracker-provider', 'webhook-tracker-repo-owner', 'webhook-tracker-repo-name']) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+      expect(wrapper.find(`label[for="${id}"]`).exists(), `label for #${id}`).toBe(true)
+    }
+  })
+
+  it('docker mode: renders host/container/registry fields plus the linked-repo sub-section', () => {
+    const wrapper = mountFields(baseForm({ tracker_type: 'docker' }))
+
+    for (const id of [
+      'webhook-tracker-source-host',
+      'webhook-tracker-container',
+      'webhook-tracker-registry-credentials',
+      // Linked git repo fields nested inside the docker branch — distinct
+      // ids from the git-mode ones above even though the labels repeat.
+      'webhook-tracker-linked-provider',
+      'webhook-tracker-linked-repo-owner',
+      'webhook-tracker-linked-repo-name',
+    ]) {
+      expect(wrapper.find(`#${id}`).exists(), `#${id}`).toBe(true)
+    }
+
+    // The two "Provider" ids must never collide even though this branch
+    // isn't visible at the same time as the git branch above.
+    expect(wrapper.find('#webhook-tracker-provider').exists()).toBe(false)
+  })
+})
diff --git a/frontend/src/components/webhooks/WebhookTrackerFields.vue b/frontend/src/components/webhooks/WebhookTrackerFields.vue
index 01baaac6..46ae5e5f 100644
--- a/frontend/src/components/webhooks/WebhookTrackerFields.vue
+++ b/frontend/src/components/webhooks/WebhookTrackerFields.vue
@@ -1,7 +1,9 @@
 <template>
   <!-- Type selector -->
   <div class="col-12">
-    <label class="form-label required">Type de suivi</label>
+    <div class="form-label required">
+      Type de suivi
+    </div>
     <div class="row g-2">
       <div class="col-6">
         <label
@@ -43,8 +45,12 @@
   <!-- Git-specific fields -->
   <template v-if="form.tracker_type === 'git'">
     <div class="col-md-4">
-      <label class="form-label required">Provider</label>
+      <label
+        for="webhook-tracker-provider"
+        class="form-label required"
+      >Provider</label>
       <select
+        id="webhook-tracker-provider"
         v-model="form.provider"
         class="form-select"
       >
@@ -60,8 +66,12 @@
       </select>
     </div>
     <div class="col-md-4">
-      <label class="form-label required">Owner / Org</label>
+      <label
+        for="webhook-tracker-repo-owner"
+        class="form-label required"
+      >Owner / Org</label>
       <input
+        id="webhook-tracker-repo-owner"
         v-model="form.repo_owner"
         type="text"
         class="form-control"
@@ -69,8 +79,12 @@
       >
     </div>
     <div class="col-md-4">
-      <label class="form-label required">Depot</label>
+      <label
+        for="webhook-tracker-repo-name"
+        class="form-label required"
+      >Depot</label>
       <input
+        id="webhook-tracker-repo-name"
         v-model="form.repo_name"
         type="text"
         class="form-control"
@@ -85,8 +99,12 @@
        that silently watched an image nobody was running. -->
   <template v-else>
     <div class="col-md-5">
-      <label class="form-label required">Hôte</label>
+      <label
+        for="webhook-tracker-source-host"
+        class="form-label required"
+      >Hôte</label>
       <select
+        id="webhook-tracker-source-host"
         v-model="containerSourceHostId"
         class="form-select"
       >
@@ -106,8 +124,12 @@
       </div>
     </div>
     <div class="col-md-7">
-      <label class="form-label required">Conteneur</label>
+      <label
+        for="webhook-tracker-container"
+        class="form-label required"
+      >Conteneur</label>
       <select
+        id="webhook-tracker-container"
         class="form-select"
         :disabled="!containerSourceHostId"
         :value="selectedContainerKey"
@@ -145,8 +167,12 @@
     </div>
 
     <div class="col-md-6">
-      <label class="form-label">Registre privé <span class="text-muted">(optionnel)</span></label>
+      <label
+        for="webhook-tracker-registry-credentials"
+        class="form-label"
+      >Registre privé <span class="text-muted">(optionnel)</span></label>
       <select
+        id="webhook-tracker-registry-credentials"
         v-model="form.registry_credentials_id"
         class="form-select"
       >
@@ -178,8 +204,12 @@
         </div>
         <div class="row g-2">
           <div class="col-md-4">
-            <label class="form-label">Provider</label>
+            <label
+              for="webhook-tracker-linked-provider"
+              class="form-label"
+            >Provider</label>
             <select
+              id="webhook-tracker-linked-provider"
               v-model="form.provider"
               class="form-select"
             >
@@ -195,8 +225,12 @@
             </select>
           </div>
           <div class="col-md-4">
-            <label class="form-label">Owner / Org</label>
+            <label
+              for="webhook-tracker-linked-repo-owner"
+              class="form-label"
+            >Owner / Org</label>
             <input
+              id="webhook-tracker-linked-repo-owner"
               v-model="form.repo_owner"
               type="text"
               class="form-control"
@@ -204,8 +238,12 @@
             >
           </div>
           <div class="col-md-4">
-            <label class="form-label">Depot</label>
+            <label
+              for="webhook-tracker-linked-repo-name"
+              class="form-label"
+            >Depot</label>
             <input
+              id="webhook-tracker-linked-repo-name"
               v-model="form.repo_name"
               type="text"
               class="form-control"
diff --git a/frontend/src/composables/useGlobalScheduledTasks.ts b/frontend/src/composables/useGlobalScheduledTasks.ts
index 3c96107e..07680387 100644
--- a/frontend/src/composables/useGlobalScheduledTasks.ts
+++ b/frontend/src/composables/useGlobalScheduledTasks.ts
@@ -173,7 +173,7 @@ export function useGlobalScheduledTasks() {
 
   const hostList = computed(() => {
     const names = [...new Set(tasks.value.map((t) => t.host_name))]
-    return names.sort()
+    return names.sort((a, b) => a.localeCompare(b))
   })
 
   const filteredTasks = computed(() => {
diff --git a/server/internal/database/db_hosts.go b/server/internal/database/db_hosts.go
index 52766ea4..e834c7e3 100644
--- a/server/internal/database/db_hosts.go
+++ b/server/internal/database/db_hosts.go
@@ -104,8 +104,11 @@ func (db *DB) GetHostByAPIKey(ctx context.Context, apiKey string) (*models.Host,
 		// Perform a dummy bcrypt comparison to normalise response time and
 		// prevent an attacker from distinguishing "host not found" from
 		// "wrong secret" via timing differences.
-		// The hash below is a valid bcrypt hash of an arbitrary placeholder value.
-		const dummyHash = "$2a$10$tz.0gDET5/Bc3.ScGwT4DOemFDsphktsjzR7Bkcxy7pWpZD5ls4My"
+		// The hash below is a valid bcrypt hash of an arbitrary placeholder value,
+		// not a real credential — nothing is ever hashed to produce it, and no
+		// secret it could "leak" exists. NOSONAR: false positive on go:S6437 /
+		// secrets:S8215, which can't distinguish this from a committed real secret.
+		const dummyHash = "$2a$10$tz.0gDET5/Bc3.ScGwT4DOemFDsphktsjzR7Bkcxy7pWpZD5ls4My" // NOSONAR
 		_ = bcrypt.CompareHashAndPassword([]byte(dummyHash), []byte(secret))
 		return nil, fmt.Errorf("invalid API key")
 	}
diff --git a/server/internal/database/db_web_logs.go b/server/internal/database/db_web_logs.go
index d17b98f9..e1ed6a7c 100644
--- a/server/internal/database/db_web_logs.go
+++ b/server/internal/database/db_web_logs.go
@@ -176,7 +176,10 @@ func webLogFingerprint(hostID string, source string, capturedAt time.Time, req m
 		req.Category,
 		suspicious,
 	)
-	digest := md5.Sum([]byte(payload))
+	// MD5 here is a non-cryptographic dedup key (collision resistance against
+	// an attacker is irrelevant — it never gates a security decision), not a
+	// sensitive-context hash. NOSONAR: false positive on go:S4790.
+	digest := md5.Sum([]byte(payload)) // NOSONAR
 	return hex.EncodeToString(digest[:])
 }
 
diff --git a/server/internal/synthetic/ssl.go b/server/internal/synthetic/ssl.go
index 79608506..2a5c8ec6 100644
--- a/server/internal/synthetic/ssl.go
+++ b/server/internal/synthetic/ssl.go
@@ -3,10 +3,13 @@ package synthetic
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
+	"errors"
 	"fmt"
 	"log/slog"
 	"net"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/serversupervisor/server/internal/database"
@@ -134,12 +137,40 @@ func checkCertificate(ctx context.Context, c models.SSLCertificate) models.SSLCe
 		c.DNSNames = []string{}
 	}
 
-	// Surface near-expiry as a non-fatal warning in last_error so the UI can show it.
-	if remaining := time.Until(notAfter); remaining < 0 {
-		c.LastError = fmt.Sprintf("certificate expired on %s", notAfter.Format(time.RFC3339))
+	// The handshake above skipped verification entirely (InsecureSkipVerify)
+	// so we could still read the chain of an expired/invalid endpoint —
+	// otherwise that connection would just fail before we got here. That
+	// means a wrong hostname or an untrusted CA would go completely
+	// unreported. Verify independently now and fold anything beyond plain
+	// expiry into last_error too.
+	intermediates := x509.NewCertPool()
+	for _, cert := range state.PeerCertificates[1:] {
+		intermediates.AddCert(cert)
 	}
+	_, verifyErr := leaf.Verify(x509.VerifyOptions{DNSName: serverName, Intermediates: intermediates})
+	c.LastError = strings.Join(certificateIssues(notAfter, verifyErr), "; ")
 	return c
 }
 
+// certificateIssues turns a certificate's expiry and an independent
+// chain/hostname verification error (nil if it passed) into the list of
+// problems to report in last_error. verifyErr's own "certificate has
+// expired" case is suppressed since the notAfter check already reports that
+// more clearly ("expired on <date>" vs x509's raw error text) — anything
+// else from verifyErr (wrong hostname, untrusted CA, ...) is kept.
+func certificateIssues(notAfter time.Time, verifyErr error) []string {
+	var issues []string
+	if remaining := time.Until(notAfter); remaining < 0 {
+		issues = append(issues, fmt.Sprintf("certificate expired on %s", notAfter.Format(time.RFC3339)))
+	}
+	if verifyErr != nil {
+		var invalidErr x509.CertificateInvalidError
+		if !errors.As(verifyErr, &invalidErr) || invalidErr.Reason != x509.Expired {
+			issues = append(issues, verifyErr.Error())
+		}
+	}
+	return issues
+}
+
 // Compile-time check: database.DB satisfies SSLDB.
 var _ SSLDB = (*database.DB)(nil)
diff --git a/server/internal/synthetic/ssl_test.go b/server/internal/synthetic/ssl_test.go
new file mode 100644
index 00000000..2f315d4d
--- /dev/null
+++ b/server/internal/synthetic/ssl_test.go
@@ -0,0 +1,281 @@
+package synthetic
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"errors"
+	"math/big"
+	"net"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/serversupervisor/server/internal/models"
+)
+
+func TestCertificateIssues(t *testing.T) {
+	future := time.Now().Add(30 * 24 * time.Hour)
+	past := time.Now().Add(-24 * time.Hour)
+
+	tests := []struct {
+		name      string
+		notAfter  time.Time
+		verifyErr error
+		wantEmpty bool
+		want      []string // exact expected messages, checked when non-nil
+	}{
+		{
+			name:      "valid and trusted: no issues",
+			notAfter:  future,
+			wantEmpty: true,
+		},
+		{
+			name:     "expired, no verify error",
+			notAfter: past,
+			want:     []string{"certificate expired on " + past.Format(time.RFC3339)},
+		},
+		{
+			name:      "not expired but verify says expired: still reported once via notAfter, not duplicated",
+			notAfter:  past,
+			verifyErr: x509.CertificateInvalidError{Reason: x509.Expired, Detail: "irrelevant"},
+			want:      []string{"certificate expired on " + past.Format(time.RFC3339)},
+		},
+		{
+			name:      "verify expired-only error and cert not actually expired: suppressed entirely",
+			notAfter:  future,
+			verifyErr: x509.CertificateInvalidError{Reason: x509.Expired, Detail: "irrelevant"},
+			wantEmpty: true,
+		},
+		{
+			name:      "verify says untrusted: kept",
+			notAfter:  future,
+			verifyErr: x509.UnknownAuthorityError{},
+		},
+		{
+			name:      "verify says invalid for a non-expiry reason: kept",
+			notAfter:  future,
+			verifyErr: x509.CertificateInvalidError{Reason: x509.NotAuthorizedToSign, Detail: "irrelevant"},
+		},
+		{
+			name:      "verify error wrapped: still recognised as expired via errors.As",
+			notAfter:  past,
+			verifyErr: errors.Join(x509.CertificateInvalidError{Reason: x509.Expired}),
+			want:      []string{"certificate expired on " + past.Format(time.RFC3339)},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := certificateIssues(tt.notAfter, tt.verifyErr)
+			if tt.wantEmpty {
+				if len(got) != 0 {
+					t.Fatalf("certificateIssues() = %v, want none", got)
+				}
+				return
+			}
+			if len(got) == 0 {
+				t.Fatalf("certificateIssues() = %v, want at least one issue", got)
+			}
+			for _, w := range tt.want {
+				found := false
+				for _, g := range got {
+					if g == w {
+						found = true
+						break
+					}
+				}
+				if !found {
+					t.Fatalf("certificateIssues() = %v, want it to contain %q", got, w)
+				}
+			}
+		})
+	}
+}
+
+// selfSignedCert generates a minimal self-signed certificate valid for
+// 127.0.0.1, expiring at notAfter.
+func selfSignedCert(t *testing.T, notAfter time.Time) tls.Certificate {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("generate key: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "127.0.0.1"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     notAfter,
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("create certificate: %v", err)
+	}
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
+}
+
+// certChain generates a self-signed root CA and a leaf certificate for
+// 127.0.0.1 signed by it, so a test can exercise the intermediates pool
+// checkCertificate builds from state.PeerCertificates[1:] — a lone
+// self-signed leaf (selfSignedCert above) never has a second certificate to
+// put in that pool.
+func certChain(t *testing.T) tls.Certificate {
+	t.Helper()
+	rootKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("generate root key: %v", err)
+	}
+	rootTmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "test root CA"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(24 * time.Hour),
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+		KeyUsage:              x509.KeyUsageCertSign,
+	}
+	rootDER, err := x509.CreateCertificate(rand.Reader, rootTmpl, rootTmpl, &rootKey.PublicKey, rootKey)
+	if err != nil {
+		t.Fatalf("create root certificate: %v", err)
+	}
+	rootCert, err := x509.ParseCertificate(rootDER)
+	if err != nil {
+		t.Fatalf("parse root certificate: %v", err)
+	}
+
+	leafKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("generate leaf key: %v", err)
+	}
+	leafTmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(2),
+		Subject:      pkix.Name{CommonName: "127.0.0.1"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+	}
+	leafDER, err := x509.CreateCertificate(rand.Reader, leafTmpl, rootCert, &leafKey.PublicKey, rootKey)
+	if err != nil {
+		t.Fatalf("create leaf certificate: %v", err)
+	}
+	return tls.Certificate{Certificate: [][]byte{leafDER, rootDER}, PrivateKey: leafKey}
+}
+
+// listenTLS starts a TLS listener serving cert on 127.0.0.1 and accepts
+// (and discards) connections in the background until the test ends.
+func listenTLS(t *testing.T, cert tls.Certificate) int {
+	t.Helper()
+	ln, err := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{Certificates: []tls.Certificate{cert}})
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { _ = ln.Close() })
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go func() {
+				defer func() { _ = conn.Close() }()
+				buf := make([]byte, 1)
+				_, _ = conn.Read(buf)
+			}()
+		}
+	}()
+	_, portStr, err := net.SplitHostPort(ln.Addr().String())
+	if err != nil {
+		t.Fatalf("split addr: %v", err)
+	}
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		t.Fatalf("parse port: %v", err)
+	}
+	return port
+}
+
+func TestCheckCertificate_SelfSignedIsReportedAsUntrusted(t *testing.T) {
+	// X.509 time encoding has no sub-second precision, so the value read
+	// back from the wire is truncated relative to what we generate it with.
+	notAfter := time.Now().Add(30 * 24 * time.Hour).Truncate(time.Second)
+	port := listenTLS(t, selfSignedCert(t, notAfter))
+
+	result := checkCertificate(context.Background(), models.SSLCertificate{
+		ID:   "cert-1",
+		Host: "127.0.0.1",
+		Port: port,
+	})
+
+	if result.LastError == "" {
+		t.Fatal("expected last_error to report the self-signed / untrusted chain, got none")
+	}
+	if strings.Contains(result.LastError, "expired") {
+		t.Fatalf("cert is not expired, last_error should not mention it: %q", result.LastError)
+	}
+	if result.SerialNumber == "" || result.Issuer == "" || result.Subject == "" {
+		t.Fatalf("expected certificate fields to be populated, got %+v", result)
+	}
+	if result.ValidTo == nil || !result.ValidTo.Equal(notAfter) {
+		t.Fatalf("expected ValidTo %v, got %v", notAfter, result.ValidTo)
+	}
+}
+
+func TestCheckCertificate_ExpiredSelfSignedReportsExpiry(t *testing.T) {
+	notAfter := time.Now().Add(-24 * time.Hour)
+	port := listenTLS(t, selfSignedCert(t, notAfter))
+
+	result := checkCertificate(context.Background(), models.SSLCertificate{
+		ID:   "cert-2",
+		Host: "127.0.0.1",
+		Port: port,
+	})
+
+	if !strings.Contains(result.LastError, "certificate expired on") {
+		t.Fatalf("expected last_error to mention expiry, got %q", result.LastError)
+	}
+}
+
+func TestCheckCertificate_ChainWithIntermediateIsRead(t *testing.T) {
+	port := listenTLS(t, certChain(t))
+
+	result := checkCertificate(context.Background(), models.SSLCertificate{
+		ID:   "cert-4",
+		Host: "127.0.0.1",
+		Port: port,
+	})
+
+	if result.SerialNumber == "" {
+		t.Fatal("expected the leaf certificate to be read despite the extra intermediate in the chain")
+	}
+	// Still untrusted (the root above is never added to any trust store) —
+	// last_error must say so rather than come back empty.
+	if result.LastError == "" {
+		t.Fatal("expected last_error to report the untrusted root")
+	}
+}
+
+func TestCheckCertificate_DialFailureIsReported(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	_, portStr, _ := net.SplitHostPort(ln.Addr().String())
+	port, _ := strconv.Atoi(portStr)
+	_ = ln.Close() // free the port so the dial below fails with connection refused
+
+	result := checkCertificate(context.Background(), models.SSLCertificate{
+		ID:   "cert-3",
+		Host: "127.0.0.1",
+		Port: port,
+	})
+
+	if result.LastError == "" {
+		t.Fatal("expected a dial error to be reported in last_error")
+	}
+}
diff --git a/sonar-project.properties b/sonar-project.properties
index d5966c08..6fe6a24f 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -6,13 +6,16 @@ sonar.sourceEncoding=UTF-8
 # Three independent modules (see CLAUDE.md) analyzed from one scan.
 sonar.sources=server/cmd,server/internal,agent/cmd,agent/internal,frontend/src
 
-# Go test files are auto-detected by the *_test.go suffix, no separate
-# sonar.tests entry needed for server/agent. Frontend specs are co-located
-# with their source (frontend/CLAUDE.md: "*.spec.ts co-located") rather than
-# in a separate directory, so sonar.tests overlaps sonar.sources and
-# sonar.test.inclusions is what actually tells Sonar which files are tests.
-sonar.tests=frontend/src
-sonar.test.inclusions=frontend/src/**/*.spec.ts
+# *_test.go being auto-detected only means Sonar's Go rules skip them for
+# static analysis — it does NOT exempt their lines from the new-code coverage
+# gate (confirmed: a *_test.go file's own added lines showed up as 0%-covered
+# "new code to cover", since go test's coverage.out never instruments test
+# files themselves). sonar.test.inclusions is what actually does that, so Go
+# test files need to be listed here too, not just frontend's co-located specs
+# (frontend/CLAUDE.md: "*.spec.ts co-located") — sonar.tests overlaps
+# sonar.sources for both reasons.
+sonar.tests=frontend/src,server,agent
+sonar.test.inclusions=frontend/src/**/*.spec.ts,server/**/*_test.go,agent/**/*_test.go
 
 # Generated/vendored/build output — not authored code.
 sonar.exclusions=\