diff --git a/.github/workflows/run-tests-generate-output.yaml b/.github/workflows/run-tests-generate-output.yaml
index 9e68a3ebb..7984a0325 100644
--- a/.github/workflows/run-tests-generate-output.yaml
+++ b/.github/workflows/run-tests-generate-output.yaml
@@ -35,7 +35,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          # use the commit that triggered this workflow to avoid any wildcard fetch
+          ref: ${{ github.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           persist-credentials: false
       # Set the pip environment up
@@ -173,7 +174,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
-          ref: ${{ github.event.pull_request.head.ref }}
+          # use the run's SHA rather than branch to avoid wildcard refspec
+          ref: ${{ github.sha }}
       - name: Download translation check report
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
diff --git a/copi.owasp.org/lib/copi_web/live/player_live/index.html.heex b/copi.owasp.org/lib/copi_web/live/player_live/index.html.heex
index 2c38d7ebd..922a25e4a 100644
--- a/copi.owasp.org/lib/copi_web/live/player_live/index.html.heex
+++ b/copi.owasp.org/lib/copi_web/live/player_live/index.html.heex
@@ -1,4 +1,5 @@
 
+<%= if @player do %>
   <.live_component
     module={CopiWeb.PlayerLive.FormComponent}
     id={:new}
@@ -8,6 +9,7 @@
     client_ip={@client_ip}
     patch={~p"/games/#{@game.id}"}
   />
+<% end %>
 
 
 <!--
diff --git a/copi.owasp.org/lib/copi_web/live/player_live/show.ex b/copi.owasp.org/lib/copi_web/live/player_live/show.ex
index bc71e3d8d..0bf8cd397 100644
--- a/copi.owasp.org/lib/copi_web/live/player_live/show.ex
+++ b/copi.owasp.org/lib/copi_web/live/player_live/show.ex
@@ -23,11 +23,11 @@ defmodule CopiWeb.PlayerLive.Show do
         {:noreply, socket |> assign(:game, game) |> assign(:player, player)}
       else
         {:error, _reason} ->
-          {:ok, redirect(socket, to: "/error")}
+          {:noreply, redirect(socket, to: "/error")}
       end
     else
       {:error, _reason} ->
-        {:ok, redirect(socket, to: "/error")}
+        {:noreply, redirect(socket, to: "/error")}
     end
   end
 
@@ -37,7 +37,7 @@ defmodule CopiWeb.PlayerLive.Show do
       {:noreply, socket |> assign(:game, updated_game) |> assign(:player, updated_player)}
     else
       {:error, _reason} ->
-        {:ok, redirect(socket, to: "/error")}
+        {:noreply, redirect(socket, to: "/error")}
     end
   end
 
diff --git a/copi.owasp.org/test/copi/cornucopia/dealt_card_test.exs b/copi.owasp.org/test/copi/cornucopia/dealt_card_test.exs
new file mode 100644
index 000000000..520a47513
--- /dev/null
+++ b/copi.owasp.org/test/copi/cornucopia/dealt_card_test.exs
@@ -0,0 +1,24 @@
+defmodule Copi.Cornucopia.DealtCardTest do
+  use Copi.DataCase, async: true
+
+  alias Copi.Cornucopia.DealtCard
+
+  describe "changeset/2" do
+    test "returns a valid changeset with empty attrs" do
+      changeset = DealtCard.changeset(%DealtCard{}, %{})
+      assert changeset.valid?
+    end
+
+    test "casts played_in_round when provided" do
+      changeset = DealtCard.changeset(%DealtCard{}, %{played_in_round: 3})
+      # changeset/2 only casts [], so played_in_round is ignored but changeset is valid
+      assert changeset.valid?
+    end
+  end
+
+  describe "find/1" do
+    test "returns error for nonexistent dealt card id" do
+      assert {:error, :not_found} = DealtCard.find(-1)
+    end
+  end
+end
diff --git a/copi.owasp.org/test/copi/cornucopia/player_test.exs b/copi.owasp.org/test/copi/cornucopia/player_test.exs
new file mode 100644
index 000000000..f712c0ac0
--- /dev/null
+++ b/copi.owasp.org/test/copi/cornucopia/player_test.exs
@@ -0,0 +1,32 @@
+defmodule Copi.Cornucopia.PlayerTest do
+  use ExUnit.Case, async: true
+
+  alias Copi.Cornucopia.Player
+
+  describe "changeset/2" do
+    test "valid with name only" do
+      # game_id is not in validate_required, so name alone is enough
+      changeset = Player.changeset(%Player{}, %{name: "Alice"})
+      assert changeset.valid?
+    end
+
+    test "invalid without name" do
+      changeset = Player.changeset(%Player{}, %{})
+      refute changeset.valid?
+      assert %{name: ["can't be blank"]} = errors_on(changeset)
+    end
+
+    test "invalid when name too long" do
+      changeset = Player.changeset(%Player{}, %{name: String.duplicate("a", 51)})
+      refute changeset.valid?
+    end
+  end
+
+  defp errors_on(changeset) do
+    Ecto.Changeset.traverse_errors(changeset, fn {msg, opts} ->
+      Enum.reduce(opts, msg, fn {key, value}, acc ->
+        String.replace(acc, "%{#{key}}", to_string(value))
+      end)
+    end)
+  end
+end
diff --git a/copi.owasp.org/test/copi/cornucopia/vote_test.exs b/copi.owasp.org/test/copi/cornucopia/vote_test.exs
new file mode 100644
index 000000000..043626c4b
--- /dev/null
+++ b/copi.owasp.org/test/copi/cornucopia/vote_test.exs
@@ -0,0 +1,12 @@
+defmodule Copi.Cornucopia.VoteTest do
+  use ExUnit.Case, async: true
+
+  alias Copi.Cornucopia.Vote
+
+  describe "changeset/2" do
+    test "valid with empty attrs" do
+      changeset = Vote.changeset(%Vote{}, %{})
+      assert changeset.valid?
+    end
+  end
+end
diff --git a/copi.owasp.org/test/copi/ip_helper_test.exs b/copi.owasp.org/test/copi/ip_helper_test.exs
index 074a145e2..1e882b554 100644
--- a/copi.owasp.org/test/copi/ip_helper_test.exs
+++ b/copi.owasp.org/test/copi/ip_helper_test.exs
@@ -128,10 +128,37 @@ defmodule Copi.IPHelperTest do
       socket = %Phoenix.Socket{transport_pid: self()}
       Process.put(:peer, {{10, 0, 0, 5}, 12345})
       assert IPHelper.get_ip_from_socket(socket) == {10, 0, 0, 5}
-      
+
       socket2 = %Phoenix.Socket{transport_pid: nil}
       assert IPHelper.get_ip_from_socket(socket2) == {127, 0, 0, 1}
     end
+
+    test "falls back to localhost for LiveView socket with empty map connect_info" do
+      # connect_info is a map with no headers and no peer_data
+      socket = %Phoenix.LiveView.Socket{private: %{connect_info: %{}}}
+      assert IPHelper.get_ip_from_socket(socket) == {127, 0, 0, 1}
+    end
+
+    test "skips atom-key req_header tuple and falls back to binary-keyed one" do
+      socket = %Phoenix.LiveView.Socket{
+        private: %{connect_info: %{req_headers: [{:some_key, "ignored"}, {"x-forwarded-for", "10.0.2.5"}]}}
+      }
+      assert IPHelper.get_ip_from_socket(socket) == {10, 0, 2, 5}
+    end
+
+    test "falls back to peer_data when connect_info map x_headers has no x-forwarded-for" do
+      socket = %Phoenix.LiveView.Socket{
+        private: %{connect_info: %{x_headers: [{"other-header", "val"}], peer_data: %{address: {10, 0, 2, 6}}}}
+      }
+      assert IPHelper.get_ip_from_socket(socket) == {10, 0, 2, 6}
+    end
+
+    test "returns localhost when connect_info map has no peer_data and no useful headers" do
+      socket = %Phoenix.LiveView.Socket{
+        private: %{connect_info: %{x_headers: []}}
+      }
+      assert IPHelper.get_ip_from_socket(socket) == {127, 0, 0, 1}
+    end
   end
   
   describe "get_ip_from_connect_info/1" do
@@ -170,9 +197,39 @@ defmodule Copi.IPHelperTest do
     test "handles malformed extract_first_ip inputs" do
       info = %{x_headers: [{"x-forwarded-for", "invalid"}]}
       assert IPHelper.get_ip_from_connect_info(info) == nil
-      
+
       info2 = %{x_headers: [{"other", "10.0.0.1"}]}
       assert IPHelper.get_ip_from_connect_info(info2) == nil
     end
+
+    test "extracts IP from x_headers binary string" do
+      info = %{x_headers: "10.0.1.1"}
+      assert IPHelper.get_ip_from_connect_info(info) == {10, 0, 1, 1}
+    end
+
+    test "handles x_headers as non-map/non-list/non-binary (true->nil branch)" do
+      info = %{x_headers: 9999}
+      assert IPHelper.get_ip_from_connect_info(info) == nil
+    end
+
+    test "extracts IP from x_headers atom key tuple list" do
+      info = %{x_headers: [{:"x-forwarded-for", "10.0.1.2"}]}
+      assert IPHelper.get_ip_from_connect_info(info) == {10, 0, 1, 2}
+    end
+
+    test "returns nil for non-matching atom key in x_headers" do
+      info = %{x_headers: [{:other_header, "10.0.0.1"}]}
+      assert IPHelper.get_ip_from_connect_info(info) == nil
+    end
+
+    test "extracts IP from x_headers list of binary strings" do
+      info = %{x_headers: ["10.0.1.3"]}
+      assert IPHelper.get_ip_from_connect_info(info) == {10, 0, 1, 3}
+    end
+
+    test "returns nil for non-tuple elements in req_headers list" do
+      info = %{req_headers: [123, 456]}
+      assert IPHelper.get_ip_from_connect_info(info) == nil
+    end
   end
 end
diff --git a/copi.owasp.org/test/copi/rate_limiter_test.exs b/copi.owasp.org/test/copi/rate_limiter_test.exs
index 76f4d904f..a9d1e9ef3 100644
--- a/copi.owasp.org/test/copi/rate_limiter_test.exs
+++ b/copi.owasp.org/test/copi/rate_limiter_test.exs
@@ -241,6 +241,23 @@ defmodule Copi.RateLimiterTest do
       # Should still work even with weird input
       assert {:ok, _} = RateLimiter.check_rate("invalid-ip", :game_creation)
     end
+
+    test "normalize_ip fallback: passes non-tuple non-binary values through", %{ip: _ip} do
+      # nil is neither binary nor tuple, hits normalize_ip(ip), do: ip
+      assert {:ok, _} = RateLimiter.check_rate(nil, :game_creation)
+    end
+  end
+
+  describe "prod env bypass" do
+    test "bypasses rate limit for localhost in prod env" do
+      Application.put_env(:copi, :env, :prod)
+
+      try do
+        assert {:ok, :unlimited} = RateLimiter.check_rate({127, 0, 0, 1}, :game_creation)
+      after
+        Application.put_env(:copi, :env, :test)
+      end
+    end
   end
 
   describe "cleanup process" do
@@ -248,6 +265,14 @@ defmodule Copi.RateLimiterTest do
       assert Process.whereis(Copi.RateLimiter) != nil
     end
 
+    test "cleanup message is handled without crashing" do
+      pid = Process.whereis(Copi.RateLimiter)
+      assert pid != nil
+      send(pid, :cleanup)
+      :timer.sleep(50)
+      assert Process.alive?(pid)
+    end
+
     test "can make requests after clearing IP", %{ip: ip} do
       config = RateLimiter.get_config()
       limit = config.limits.connection
diff --git a/copi.owasp.org/test/copi_web/controllers/card_controller_test.exs b/copi.owasp.org/test/copi_web/controllers/card_controller_test.exs
index 2d9a0ad35..0a99705ee 100644
--- a/copi.owasp.org/test/copi_web/controllers/card_controller_test.exs
+++ b/copi.owasp.org/test/copi_web/controllers/card_controller_test.exs
@@ -43,5 +43,12 @@ defmodule CopiWeb.CardControllerTest do
     end
   end
 
+  describe "format_capec/1" do
+    test "returns the input list unchanged" do
+      assert CopiWeb.CardController.format_capec(["123", "456"]) == ["123", "456"]
+      assert CopiWeb.CardController.format_capec([]) == []
+    end
+  end
+
 
 end
diff --git a/copi.owasp.org/test/copi_web/live/game_live/show_pure_test.exs b/copi.owasp.org/test/copi_web/live/game_live/show_pure_test.exs
new file mode 100644
index 000000000..7e2c6202c
--- /dev/null
+++ b/copi.owasp.org/test/copi_web/live/game_live/show_pure_test.exs
@@ -0,0 +1,30 @@
+defmodule CopiWeb.GameLive.ShowPureTest do
+  use ExUnit.Case, async: true
+
+  alias CopiWeb.GameLive.Show
+
+  test "display_game_session returns expected labels" do
+    assert Show.display_game_session("webapp") == "Cornucopia Web Session:"
+    assert Show.display_game_session("mobileapp") == "Cornucopia Mobile Session:"
+    assert Show.display_game_session("mlsec") == "Elevation of MLSec Session:"
+    assert Show.display_game_session("unknown") == "EoP Session:"
+  end
+
+  test "latest_version returns expected versions" do
+    assert Show.latest_version("webapp") == "2.2"
+    assert Show.latest_version("ecommerce") == "1.22"
+    assert Show.latest_version("eop") == "5.1"
+    assert Show.latest_version("other") == "1.0"
+  end
+
+  test "card_played_in_round finds card or returns nil" do
+    cards = [%{played_in_round: 1, id: "a"}, %{played_in_round: 3, id: "b"}]
+    assert Show.card_played_in_round(cards, 3) == %{played_in_round: 3, id: "b"}
+    assert Show.card_played_in_round(cards, 2) == nil
+  end
+
+  test "topic builds topic string" do
+    assert Show.topic(42) == "game:42"
+    assert Show.topic("abc") == "game:abc"
+  end
+end
diff --git a/copi.owasp.org/test/copi_web/live/game_live/show_test.exs b/copi.owasp.org/test/copi_web/live/game_live/show_test.exs
index fb19034e7..443504930 100644
--- a/copi.owasp.org/test/copi_web/live/game_live/show_test.exs
+++ b/copi.owasp.org/test/copi_web/live/game_live/show_test.exs
@@ -128,5 +128,48 @@ defmodule CopiWeb.GameLive.ShowTest do
       alias CopiWeb.GameLive.Show
       assert Show.card_played_in_round([], 1) == nil
     end
+
+    test "card_played_in_round/2 returns the matching card", %{conn: _conn, game: _game} do
+      alias CopiWeb.GameLive.Show
+
+      cards = [%{played_in_round: 1, id: "a"}, %{played_in_round: 2, id: "b"}]
+      assert Show.card_played_in_round(cards, 2) == %{played_in_round: 2, id: "b"}
+    end
+
+    test "topic/1 builds topic strings", %{conn: _conn, game: _game} do
+      alias CopiWeb.GameLive.Show
+      assert Show.topic(1) == "game:1"
+      assert Show.topic("xyz") == "game:xyz"
+    end
+
+    test "handle_info ignores update for a different game id", %{conn: conn, game: game} do
+      {:ok, show_live, _html} = live(conn, "/games/#{game.id}")
+
+      {:ok, other_game} = Copi.Cornucopia.create_game(%{name: "other"})
+      {:ok, other_game_loaded} = Copi.Cornucopia.Game.find(other_game.id)
+
+      send(show_live.pid, %{
+        topic: "game:#{game.id}",
+        event: "game:updated",
+        payload: other_game_loaded
+      })
+
+      :timer.sleep(50)
+      assert render(show_live) =~ game.name
+    end
+
+    test "handle_params sets current_round to rounds_played when game is finished", %{conn: conn, game: game} do
+      {:ok, updated_game} = Copi.Cornucopia.update_game(game, %{
+        finished_at: DateTime.truncate(DateTime.utc_now(), :second),
+        rounds_played: 3
+      })
+      {:ok, _view, html} = live(conn, "/games/#{updated_game.id}?round=2")
+      assert is_binary(html)
+    end
+
+    test "handle_params redirects to /error for nonexistent game_id", %{conn: conn, game: _game} do
+      assert {:error, {:redirect, %{to: "/error"}}} =
+               live(conn, "/games/00000000000000000000000000")
+    end
   end
 end
diff --git a/copi.owasp.org/test/copi_web/live/player_live/show_pure_test.exs b/copi.owasp.org/test/copi_web/live/player_live/show_pure_test.exs
new file mode 100644
index 000000000..23c660c91
--- /dev/null
+++ b/copi.owasp.org/test/copi_web/live/player_live/show_pure_test.exs
@@ -0,0 +1,85 @@
+defmodule CopiWeb.PlayerLive.ShowPureTest do
+  use ExUnit.Case, async: true
+
+  alias CopiWeb.PlayerLive.Show
+  alias CopiWeb.PlayerLive.FormComponent
+
+  test "topic/1 builds topic strings" do
+    assert Show.topic(1) == "game:1"
+    assert Show.topic("abc") == "game:abc"
+  end
+
+  test "FormComponent.topic/1 builds topic strings" do
+    assert FormComponent.topic(99) == "game:99"
+    assert FormComponent.topic("xyz") == "game:xyz"
+  end
+
+  test "ordered_cards/1 sorts by card.id" do
+    cards = [%{card: %{id: 3}}, %{card: %{id: 1}}, %{card: %{id: 2}}]
+    sorted = Show.ordered_cards(cards)
+    assert Enum.map(sorted, & &1.card.id) == [1, 2, 3]
+  end
+
+  test "unplayed_cards/1 filters unplayed (0 or nil)" do
+    cards = [%{played_in_round: 0, card: %{id: 1}}, %{played_in_round: nil, card: %{id: 2}}, %{played_in_round: 2, card: %{id: 3}}]
+    res = Show.unplayed_cards(cards)
+    assert Enum.map(res, & &1.card.id) == [1, 2]
+  end
+
+  test "played_cards/2 returns those in given round" do
+    cards = [%{played_in_round: 1, card: %{id: 1}}, %{played_in_round: 2, card: %{id: 2}}]
+    assert Show.played_cards(cards, 2) == [%{played_in_round: 2, card: %{id: 2}}]
+  end
+
+  test "card_played_in_round/2 finds first matching card" do
+    cards = [%{played_in_round: 1, card: %{id: 1}}, %{played_in_round: 2, card: %{id: 2}}]
+    assert Show.card_played_in_round(cards, 2) == %{played_in_round: 2, card: %{id: 2}}
+    assert Show.card_played_in_round([], 1) == nil
+  end
+
+  test "player_first/2 places given player first" do
+    players = [%{id: 2}, %{id: 1}, %{id: 3}]
+    res = Show.player_first(players, %{id: 1})
+    assert hd(res).id == 1
+  end
+
+  test "round_open?/1 and round_closed?/1 reflect player dealt cards" do
+    # latest_round = rounds_played + 1 = 2
+    # player1 has a card for round 2 -> has played
+    player1 = %{id: 1, dealt_cards: [%{played_in_round: 2}]}
+    # player2 has no card for round 2 -> still to play
+    player2 = %{id: 2, dealt_cards: [%{played_in_round: 1}]}
+    game = %{rounds_played: 1, players: [player1, player2]}
+
+    assert Show.round_open?(game) == true
+    assert Show.round_closed?(game) == false
+  end
+
+  test "last_round?/1 detects when players have no nil played_in_round" do
+    # player with no nil played_in_round => they have no cards left
+    player1 = %{dealt_cards: [%{played_in_round: 1}]} # no nil cards
+    player2 = %{dealt_cards: [%{played_in_round: nil}]} # has nil -> still has cards
+    game = %{players: [player1, player2]}
+
+    # last_round? returns true when there is at least one player with no nil cards
+    assert Show.last_round?(game) == true
+  end
+
+  test "get_vote/2 finds vote by player id" do
+    votes = [%{player_id: 1, id: 10}, %{player_id: 2, id: 11}]
+    dealt_card = %{votes: votes}
+    player = %{id: 2}
+    assert Show.get_vote(dealt_card, player) == %{player_id: 2, id: 11}
+  end
+
+  test "display_game_session/1 returns correct label for every edition" do
+    assert Show.display_game_session("webapp")    == "Cornucopia Web Session:"
+    assert Show.display_game_session("ecommerce") == "Cornucopia Web Session:"
+    assert Show.display_game_session("mobileapp") == "Cornucopia Mobile Session:"
+    assert Show.display_game_session("masvs")     == "Cornucopia Mobile Session:"
+    assert Show.display_game_session("cumulus")   == "OWASP Cumulus Session:"
+    assert Show.display_game_session("mlsec")     == "Elevation of MLSec Session:"
+    assert Show.display_game_session("eop")       == "EoP Session:"
+    assert Show.display_game_session("unknown")   == "EoP Session:"
+  end
+end
diff --git a/copi.owasp.org/test/copi_web/live/player_live/show_test.exs b/copi.owasp.org/test/copi_web/live/player_live/show_test.exs
index d41fec568..b968d86ad 100644
--- a/copi.owasp.org/test/copi_web/live/player_live/show_test.exs
+++ b/copi.owasp.org/test/copi_web/live/player_live/show_test.exs
@@ -16,6 +16,11 @@ defmodule CopiWeb.PlayerLive.ShowTest do
   describe "Show - additional coverage" do
     setup [:create_player]
 
+    test "handle_params redirects to /error for nonexistent player_id", %{conn: conn, player: _player} do
+      assert {:error, {:redirect, %{to: "/error"}}} =
+               live(conn, "/games/00000000000000000000000001/players/00000000000000000000000002")
+    end
+
     test "handle_info :proceed_to_next_round advances rounds_played", %{conn: conn, player: player} do
       game_id = player.game_id
       {:ok, game} = Cornucopia.Game.find(game_id)
@@ -119,5 +124,34 @@ defmodule CopiWeb.PlayerLive.ShowTest do
       assert Show.display_game_session("mlsec")     == "Elevation of MLSec Session:"
       assert Show.display_game_session("eop")       == "EoP Session:"
     end
+
+    test "next_round advances round when round is already closed (all players played)", %{conn: conn, player: player} do
+      game_id = player.game_id
+      {:ok, game} = Copi.Cornucopia.Game.find(game_id)
+
+      Copi.Repo.update!(
+        Ecto.Changeset.change(game, started_at: DateTime.truncate(DateTime.utc_now(), :second))
+      )
+
+      # Give the player a dealt card that has already been played (played_in_round = 1, not nil)
+      # so round_open? is false for the first round
+      {:ok, card} = Copi.Cornucopia.create_card(%{
+        category: "C", value: "V", description: "D", edition: "webapp",
+        version: "2.2", external_id: "CLO1", language: "en", misc: "misc",
+        owasp_scp: [], owasp_devguide: [], owasp_asvs: [], owasp_appsensor: [],
+        capec: [], safecode: [], owasp_mastg: [], owasp_masvs: []
+      })
+      Copi.Repo.insert!(%Copi.Cornucopia.DealtCard{
+        player_id: player.id, card_id: card.id, played_in_round: 1
+      })
+
+      {:ok, show_live, _html} = live(conn, "/games/#{game_id}/players/#{player.id}")
+      render_click(show_live, "next_round", %{})
+      :timer.sleep(100)
+
+      {:ok, updated_game} = Copi.Cornucopia.Game.find(game_id)
+      # Rounds played should have advanced via the closed-round else branch
+      assert updated_game.rounds_played >= 1
+    end
   end
 end
diff --git a/copi.owasp.org/test/copi_web/live/player_live_test.exs b/copi.owasp.org/test/copi_web/live/player_live_test.exs
index 5d17a5536..2b75d3070 100644
--- a/copi.owasp.org/test/copi_web/live/player_live_test.exs
+++ b/copi.owasp.org/test/copi_web/live/player_live_test.exs
@@ -61,6 +61,24 @@ defmodule CopiWeb.PlayerLiveTest do
       assert html =~ "Hi some updated name, waiting for the game to start..."
     end
 
+    test "lists players on index route", %{conn: conn, player: player} do
+      {:ok, _index_live, html} = live(conn, "/games/#{player.game_id}/players")
+      assert html =~ "Listing Players"
+    end
+
+    test "shows validation error when submitting empty player name", %{conn: conn, player: player} do
+      RateLimiter.clear_ip({127, 0, 0, 1})
+      {:ok, index_live, _html} = live(conn, "/games/#{player.game_id}/players/new")
+
+      # Submit with empty name → triggers {:error, changeset} in save_player(:new, ...)
+      html =
+        index_live
+        |> form("#player-form", player: %{name: "", game_id: player.game_id})
+        |> render_submit()
+
+      assert html =~ "can&#39;t be blank"
+    end
+
     test "blocks player creation when rate limit exceeded", %{conn: conn, player: player} do
       test_ip = {127, 0, 0, 1}
       RateLimiter.clear_ip(test_ip)
diff --git a/copi.owasp.org/test/copi_web/plugs/rate_limiter_plug_test.exs b/copi.owasp.org/test/copi_web/plugs/rate_limiter_plug_test.exs
index 107d4d31a..84118b5af 100644
--- a/copi.owasp.org/test/copi_web/plugs/rate_limiter_plug_test.exs
+++ b/copi.owasp.org/test/copi_web/plugs/rate_limiter_plug_test.exs
@@ -66,12 +66,19 @@ defmodule CopiWeb.Plugs.RateLimiterPlugTest do
   end
 
   test "skips rate limiting when no IP info is available" do
-    # No headers, no remote_ip
+    # Explicitly set remote_ip to nil so get_ip_source returns {:none, nil}
     conn =
       conn(:get, "/")
+      |> Map.put(:remote_ip, nil)
+      |> init_test_session(%{})
       |> RateLimiterPlug.call([])
 
     assert conn.status != 429
     refute conn.halted
   end
+
+  test "init/1 passes opts through unchanged" do
+    assert RateLimiterPlug.init([]) == []
+    assert RateLimiterPlug.init(foo: :bar) == [foo: :bar]
+  end
 end
diff --git a/scripts/capec_map_enricher.py b/scripts/capec_map_enricher.py
index 2a0c222c4..5ad5fce11 100644
--- a/scripts/capec_map_enricher.py
+++ b/scripts/capec_map_enricher.py
@@ -25,6 +25,32 @@ class EnricherVars:
     args: argparse.Namespace
 
 
+def _extract_names_from_items(
+    items: Any,
+    target: dict[int, str],
+    *,
+    warn_if_not_list: bool = False,
+    label: str = "items",
+) -> None:
+    """Add ID->Name mappings from a list-like `items` into target dict.
+
+    When `warn_if_not_list` is True, log a warning if `items` is not a
+    list; otherwise silently skip non-list values. `label` is used in the
+    warning message to indicate which field was expected to be a list.
+    """
+    if not isinstance(items, list):
+        if warn_if_not_list:
+            logging.warning("'%s' is not a list", label)
+        return
+    for item in items:
+        if "_ID" in item and "_Name" in item:
+            try:
+                target[int(item["_ID"])] = item["_Name"]
+            except (ValueError, TypeError):
+                # Ignore malformed IDs
+                continue
+
+
 def extract_capec_names(json_data: dict[str, Any]) -> dict[int, str]:
     """
     Extract CAPEC ID to Name mappings from JSON data.
@@ -51,23 +77,19 @@ def extract_capec_names(json_data: dict[str, Any]) -> dict[int, str]:
         logging.warning("No 'Attack_Pattern' key found in patterns")
         return capec_names
 
+    # Use module-level helper `_extract_names_from_items` for extraction
+
     attack_patterns = patterns["Attack_Pattern"]
-    if not isinstance(attack_patterns, list):
-        logging.warning("'Attack_Pattern' is not a list")
-        return capec_names
+    _extract_names_from_items(attack_patterns, capec_names, warn_if_not_list=True, label="Attack_Pattern")
 
-    for pattern in attack_patterns:
-        if "_ID" in pattern and "_Name" in pattern:
-            capec_id = int(pattern["_ID"])
-            capec_name = pattern["_Name"]
-            capec_names[capec_id] = capec_name
-
-    categories = catalog["Categories"]["Category"]
-    for category in categories:
-        if "_ID" in category and "_Name" in category:
-            capec_id = int(category["_ID"])
-            capec_name = category["_Name"]
-            capec_names[capec_id] = capec_name
+    if "Categories" not in catalog:
+        logging.warning("No 'Categories' key found in catalog")
+    else:
+        categories_section = catalog["Categories"]
+        if "Category" not in categories_section:
+            logging.warning("No 'Category' key found in categories section")
+        else:
+            _extract_names_from_items(categories_section["Category"], capec_names, label="Category")
 
     logging.info("Extracted %d CAPEC name mappings", len(capec_names))
     return capec_names
diff --git a/scripts/convert_asvs.py b/scripts/convert_asvs.py
index eff5868fd..ca7153ee4 100644
--- a/scripts/convert_asvs.py
+++ b/scripts/convert_asvs.py
@@ -30,19 +30,23 @@ def create_level_summary(level: int, arr: List[dict[str, Any]]) -> None:
     topic = ""
     category = ""
     os.mkdir(Path(convert_vars.args.output_path, f"level-{level}-controls"))
-    f = open(Path(convert_vars.args.output_path, f"level-{level}-controls/index.md"), "w", encoding="utf-8")
-    f.write(f"# Level {level} controls\n\n")
-    f.write(f"Level {level} contains {len(arr)} controls listed below: \n\n")
-    for link in arr:
-        if link["topic"] != topic:
-            topic = link["topic"]
-            f.write(f"## {topic}\n\n")
-        if link["cat"] != category:
-            category = link["cat"]
-            f.write(f"### {category}\n\n")
-        shortdesc = link["description"].replace("Verify that", "").strip().capitalize()[0:50] + " ..."
-        f.write(f"- [{link['name']}]({link['link']}) *{shortdesc}* \n\n")
-    f.close()
+    filepath = Path(convert_vars.args.output_path, f"level-{level}-controls/index.md")
+    # open explicitly and close in finally so mocks see close() called
+    f = open(filepath, "w", encoding="utf-8")
+    try:
+        f.write(f"# Level {level} controls\n\n")
+        f.write(f"Level {level} contains {len(arr)} controls listed below: \n\n")
+        for link in arr:
+            if link["topic"] != topic:
+                topic = link["topic"]
+                f.write(f"## {topic}\n\n")
+            if link["cat"] != category:
+                category = link["cat"]
+                f.write(f"### {category}\n\n")
+            shortdesc = link["description"].replace("Verify that", "").strip().capitalize()[0:50] + " ..."
+            f.write(f"- [{link['name']}]({link['link']}) *{shortdesc}* \n\n")
+    finally:
+        f.close()
 
 
 def _format_directory_name(ordinal: int, name: str) -> str:
diff --git a/scripts/convert_capec.py b/scripts/convert_capec.py
index a2fd1f2fa..18a8aeb32 100644
--- a/scripts/convert_capec.py
+++ b/scripts/convert_capec.py
@@ -40,20 +40,22 @@ def create_capec_pages(
         name = str(i["_ID"])
         capec_path = directory / convert_vars.args.output_path / name
         create_folder(capec_path)
-        f = open(capec_path / "index.md", "w", encoding="utf-8")
-        f.write(f"# CAPEC™ {i['_ID']}: {i['_Name']}\n\n")
-        f.write("## Description\n\n")
-        f.write(f"{parse_description(i.get('Description', ''))}\n\n")
-        capec_id = int(i["_ID"])
-        f.write(f"Source: [CAPEC™ {capec_id}](https://capec.mitre.org/data/definitions/{capec_id}.html)\n\n")
-        if has_no_asvs_mapping(capec_id, capec_to_asvs_map):
-            logging.debug("CAPEC ID %d has no ASVS mapping", capec_id)
-        else:
-            f.write("## Related ASVS Requirements\n\n")
-            f.write(f"ASVS ({asvs_version}): \
+        filepath = capec_path / "index.md"
+        f = open(filepath, "w", encoding="utf-8")
+        try:
+            f.write(f"# CAPEC™ {i['_ID']}: {i['_Name']}\n\n")
+            f.write("## Description\n\n")
+            f.write(f"{parse_description(i.get('Description', ''))}\n\n")
+            capec_id = int(i["_ID"])
+            f.write(f"Source: [CAPEC™ {capec_id}](https://capec.mitre.org/data/definitions/{capec_id}.html)\n\n")
+            if has_no_asvs_mapping(capec_id, capec_to_asvs_map):
+                logging.debug("CAPEC ID %d has no ASVS mapping", capec_id)
+            else:
+                f.write("## Related ASVS Requirements\n\n")
+                f.write(f"ASVS ({asvs_version}): \
 {create_link_list(capec_to_asvs_map.get(capec_id, {}), asvs_map, asvs_version)}\n")
-
-        f.close()
+        finally:
+            f.close()
 
     categories = data["Attack_Pattern_Catalog"]["Categories"]
     for i in categories["Category"]:
@@ -62,20 +64,22 @@ def create_capec_pages(
         name = str(i["_ID"])
         capec_path = directory / convert_vars.args.output_path / name
         create_folder(capec_path)
-        f = open(capec_path / "index.md", "w", encoding="utf-8")
-        f.write(f"# CAPEC™ {i['_ID']}: {i['_Name']}\n\n")
-        f.write("## Description\n\n")
-        f.write(f"{parse_description(i.get('Summary', ''))}\n\n")
-        capec_id = int(i["_ID"])
-        f.write(f"Source: [CAPEC™ {capec_id}](https://capec.mitre.org/data/definitions/{capec_id}.html)\n\n")
-        if has_no_asvs_mapping(capec_id, capec_to_asvs_map):
-            logging.debug("CAPEC ID %d has no ASVS mapping", capec_id)
-        else:
-            f.write("## Related ASVS Requirements\n\n")
-            f.write(f"ASVS ({asvs_version}): \
+        filepath = capec_path / "index.md"
+        f = open(filepath, "w", encoding="utf-8")
+        try:
+            f.write(f"# CAPEC™ {i['_ID']}: {i['_Name']}\n\n")
+            f.write("## Description\n\n")
+            f.write(f"{parse_description(i.get('Summary', ''))}\n\n")
+            capec_id = int(i["_ID"])
+            f.write(f"Source: [CAPEC™ {capec_id}](https://capec.mitre.org/data/definitions/{capec_id}.html)\n\n")
+            if has_no_asvs_mapping(capec_id, capec_to_asvs_map):
+                logging.debug("CAPEC ID %d has no ASVS mapping", capec_id)
+            else:
+                f.write("## Related ASVS Requirements\n\n")
+                f.write(f"ASVS ({asvs_version}): \
 {create_link_list(capec_to_asvs_map.get(capec_id, {}), asvs_map, asvs_version)}\n")
-
-        f.close()
+        finally:
+            f.close()
 
     logging.info("Created %d CAPEC pages", pages)
 
diff --git a/tests/scripts/convert_asvs_utest.py b/tests/scripts/convert_asvs_utest.py
index b51f73d0e..438a5be6d 100644
--- a/tests/scripts/convert_asvs_utest.py
+++ b/tests/scripts/convert_asvs_utest.py
@@ -66,6 +66,8 @@ def test_create_level_summary_level_1(self, mock_mkdir, mock_file):
         self.assertIn("### 02-injection-prevention", content)
         self.assertIn("[V1.1.1]", content)
         self.assertIn("[V1.2.1]", content)
+        # file should be closed after leaving the context
+        self.assertTrue(handle.close.called)
 
     @patch("builtins.open", new_callable=mock_open)
     @patch("os.mkdir")
@@ -81,6 +83,47 @@ def test_create_level_summary_empty_array(self, mock_mkdir, mock_file):
 
         self.assertIn("# Level 2 controls", content)
         self.assertIn("Level 2 contains 0 controls listed below:", content)
+        self.assertTrue(handle.close.called)
+
+
+class TestFileHandleClosure(unittest.TestCase):
+    """Ensure file handles are closed even when errors occur"""
+
+    def setUp(self):
+        self.mock_output_path = Path("/fake/output")
+        asvs.convert_vars.args = argparse.Namespace(output_path=self.mock_output_path)
+
+    @patch("builtins.open", new_callable=mock_open)
+    @patch("os.mkdir")
+    def test_create_level_summary_close_on_error(self, mock_mkdir, mock_file):
+        """An exception during writing should still close the file"""
+        handle = mock_file()
+        # raise on the second write call
+        handle.write.side_effect = [None, ValueError("boom")]
+
+        with self.assertRaises(ValueError):
+            asvs.create_level_summary(
+                1,
+                [
+                    {
+                        "topic": "t",
+                        "cat": "c",
+                        "name": "n",
+                        "link": "l",
+                        "description": "desc",
+                    },
+                    {
+                        "topic": "t",
+                        "cat": "c",
+                        "name": "n2",
+                        "link": "l2",
+                        "description": "desc2",
+                    },
+                ],
+            )
+
+        # even though error happened, close should have been called by context manager
+        self.assertTrue(handle.close.called)
 
 
 class TestHasNoCapecMapping(unittest.TestCase):
diff --git a/tests/scripts/convert_capec_utest.py b/tests/scripts/convert_capec_utest.py
index 27393604e..5eb213ea4 100644
--- a/tests/scripts/convert_capec_utest.py
+++ b/tests/scripts/convert_capec_utest.py
@@ -17,6 +17,35 @@
     __import__("sys").modules["unittest.util"]._MAX_LENGTH = 999999999
 
 
+class TestFileHandleClosure(unittest.TestCase):
+    """Ensure CAPEC page generators close file handles on errors"""
+
+    def setUp(self):
+        self.mock_output_path = Path("/fake/output")
+        capec.convert_vars.args = argparse.Namespace(output_path=self.mock_output_path)
+
+    @patch("builtins.open", new_callable=mock_open)
+    @patch("scripts.convert_capec.create_folder")
+    def test_create_capec_pages_close_on_error(self, mock_create_folder, mock_file):
+        handle = mock_file()
+        # first write succeeds, second write throws
+        handle.write.side_effect = [None, ValueError("oops")]
+
+        # Minimal data causing one pattern entry
+        test_data = {
+            "Attack_Pattern_Catalog": {
+                "Attack_Patterns": {"Attack_Pattern": [{"_ID": "1", "_Name": "foo", "Description": "bar"}]},
+                "Categories": {"Category": []},
+            }
+        }
+        capec_to_asvs_map = {}
+        asvs_map = {"Requirements": []}
+        with self.assertRaises(ValueError):
+            capec.create_capec_pages(test_data, capec_to_asvs_map, asvs_map, "5.0")
+
+        self.assertTrue(handle.close.called)
+
+
 class TestParseDescription(unittest.TestCase):
     def test_parse_description_with_dict_and_text(self):
         """Test parsing description with __text field in dict"""
@@ -367,6 +396,8 @@ def test_create_capec_pages_single_pattern(self, mock_create_folder, mock_file):
         self.assertIn("## Description", written_content)
         self.assertIn("This is a test description", written_content)
         self.assertIn("Source: [CAPEC™ 123](https://capec.mitre.org/data/definitions/123.html)", written_content)
+        # ensure file closed
+        self.assertTrue(handle.close.called)
 
     @patch("builtins.open", new_callable=mock_open)
     @patch("scripts.convert_capec.create_folder")