diff --git a/.vscode.backup_1764452251/launch.json b/.vscode.backup_1764452251/launch.json
deleted file mode 100644
index 90ad73a3..00000000
--- a/.vscode.backup_1764452251/launch.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-    "version": "0.2.0",
-    "configurations": [
-        {
-            "name": "Attach to Backend (Docker)",
-            "type": "go",
-            "request": "attach",
-            "mode": "remote",
-            "substitutePath": [
-                {
-                    "from": "${workspaceFolder}",
-                    "to": "/app"
-                }
-            ],
-            "port": 2345,
-            "host": "127.0.0.1",
-            "showLog": true,
-            "trace": "log",
-            "logOutput": "rpc"
-        }
-    ]
-}
diff --git a/backend/internal/api/tests/integration_test.go b/backend/internal/api/tests/integration_test.go
index 73cea5f7..52f92651 100644
--- a/backend/internal/api/tests/integration_test.go
+++ b/backend/internal/api/tests/integration_test.go
@@ -38,21 +38,21 @@ func TestIntegration_WAF_BlockAndMonitor(t *testing.T) {
 
     // Block mode should reject suspicious payload on an API route covered by middleware
     rBlock, _ := newServer("block")
-    req := httptest.NewRequest(http.MethodGet, "/api/v1/certificates?test=<script>", nil)
+    req := httptest.NewRequest(http.MethodGet, "/api/v1/remote-servers?test=<script>", nil)
     w := httptest.NewRecorder()
     rBlock.ServeHTTP(w, req)
     if w.Code == http.StatusOK {
         t.Fatalf("expected block in block mode, got 200: body=%s", w.Body.String())
     }
 
-    // Monitor mode should allow request but still evaluate (prototype may still block)
+    // Monitor mode should allow request but still evaluate (log-only)
     rMon, _ := newServer("monitor")
-    req2 := httptest.NewRequest(http.MethodGet, "/api/v1/certificates?test=<script>", nil)
+    req2 := httptest.NewRequest(http.MethodGet, "/api/v1/remote-servers?test=<script>", nil)
     w2 := httptest.NewRecorder()
     rMon.ServeHTTP(w2, req2)
-    if w2.Code != http.StatusOK && w2.Code != http.StatusBadRequest && w2.Code != http.StatusForbidden {
-        t.Fatalf("unexpected status in monitor mode: %d", w2.Code)
-    }
+        if w2.Code != http.StatusOK {
+            t.Fatalf("unexpected status in monitor mode: %d", w2.Code)
+        }
 
     // Metrics should be exposed
     reqM := httptest.NewRequest(http.MethodGet, "/metrics", nil)
diff --git a/backend/internal/cerberus/cerberus.go b/backend/internal/cerberus/cerberus.go
index 90c624e6..8832b90c 100644
--- a/backend/internal/cerberus/cerberus.go
+++ b/backend/internal/cerberus/cerberus.go
@@ -64,31 +64,34 @@ func (c *Cerberus) Middleware() gin.HandlerFunc {
 			return
 		}
 
-		// WAF: naive example check - block requests containing <script> in URL
+		// WAF: naive example check - evaluate requests containing <script> in URL
 		if c.cfg.WAFMode != "" && c.cfg.WAFMode != "disabled" {
 			metrics.IncWAFRequest()
-			if strings.Contains(ctx.Request.RequestURI, "<script>") {
-				logger.Log().WithFields(map[string]interface{}{
-					"source":   "waf",
-					"decision": "block",
-					"mode":     c.cfg.WAFMode,
-					"path":     ctx.Request.URL.Path,
-					"query":    ctx.Request.URL.RawQuery,
-				}).Warn("WAF blocked request")
-				metrics.IncWAFBlocked()
-				ctx.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "WAF: suspicious payload detected"})
-				return
-			}
-			// Monitoring mode logs but does not block
-			if c.cfg.WAFMode == "monitor" {
-				logger.Log().WithFields(map[string]interface{}{
-					"source":   "waf",
-					"decision": "monitor",
-					"mode":     c.cfg.WAFMode,
-					"path":     ctx.Request.URL.Path,
-					"query":    ctx.Request.URL.RawQuery,
-				}).Info("WAF monitored request")
-				metrics.IncWAFMonitored()
+			suspicious := strings.Contains(ctx.Request.RequestURI, "<script>")
+			if suspicious {
+				if c.cfg.WAFMode == "block" {
+					logger.Log().WithFields(map[string]interface{}{
+						"source":   "waf",
+						"decision": "block",
+						"mode":     c.cfg.WAFMode,
+						"path":     ctx.Request.URL.Path,
+						"query":    ctx.Request.URL.RawQuery,
+					}).Warn("WAF blocked request")
+					metrics.IncWAFBlocked()
+					ctx.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "WAF: suspicious payload detected"})
+					return
+				}
+				// Monitor mode: log only, never block
+				if c.cfg.WAFMode == "monitor" {
+					logger.Log().WithFields(map[string]interface{}{
+						"source":   "waf",
+						"decision": "monitor",
+						"mode":     c.cfg.WAFMode,
+						"path":     ctx.Request.URL.Path,
+						"query":    ctx.Request.URL.RawQuery,
+					}).Info("WAF monitored request")
+					metrics.IncWAFMonitored()
+				}
 			}
 		}
 
diff --git a/backend/internal/cerberus/cerberus_middleware_test.go b/backend/internal/cerberus/cerberus_middleware_test.go
index 61ba852f..47335a02 100644
--- a/backend/internal/cerberus/cerberus_middleware_test.go
+++ b/backend/internal/cerberus/cerberus_middleware_test.go
@@ -129,16 +129,27 @@ func TestMiddleware_WAFMonitorLogsButDoesNotBlock(t *testing.T) {
 	cfg := config.SecurityConfig{WAFMode: "monitor"}
 	c := cerberus.New(cfg, db)
 
+	// Test 1: suspicious payload in monitor mode should NOT block
 	w := httptest.NewRecorder()
 	ctx, _ := gin.CreateTestContext(w)
-	// Safe query should not be blocked; in monitor mode we still pass through
-	req := httptest.NewRequest(http.MethodGet, "/?q=safe", nil)
-	req.RequestURI = "/?q=safe"
+	req := httptest.NewRequest(http.MethodGet, "/?q=<script>", nil)
+	req.RequestURI = "/?q=<script>"
 	ctx.Request = req
 
 	mw := c.Middleware()
 	mw(ctx)
-	require.False(t, ctx.IsAborted())
+	require.False(t, ctx.IsAborted(), "monitor mode should not block suspicious payload")
+
+	// Test 2: safe query in monitor mode should also pass
+	w2 := httptest.NewRecorder()
+	ctx2, _ := gin.CreateTestContext(w2)
+	req2 := httptest.NewRequest(http.MethodGet, "/?q=safe", nil)
+	req2.RequestURI = "/?q=safe"
+	ctx2.Request = req2
+
+	mw2 := c.Middleware()
+	mw2(ctx2)
+	require.False(t, ctx2.IsAborted(), "monitor mode should not block safe payload")
 }
 
 func TestMiddleware_ACLDisabledDoesNotBlock(t *testing.T) {