diff --git a/package-lock.json b/package-lock.json
index 846546e..1d01bbd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,7 +16,7 @@
         "dotenv": "^17.3.1",
         "express": "^4.18.2",
         "express-rate-limit": "^8.5.2",
-        "helmet": "^8.2.0",
+        "google-auth-library": "^10.6.2",
         "jsonwebtoken": "^9.0.2",
         "razorpay": "^2.9.6",
         "uuid": "^9.0.0"
@@ -888,18 +888,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/helmet": {
-      "version": "8.2.0",
-      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.2.0.tgz",
-      "integrity": "sha512-DRgTIUgnWcJ62KyarxxziuqYxKGnR6Rgg19BlbucN/dpmJbl1XOit6qvoOX0ZT+HhWe5OUVhU/a1zpGyc1xA0Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/EvanHahn"
-      }
-    },
     "node_modules/http-errors": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
diff --git a/package.json b/package.json
index bab97a5..5b55e02 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "dotenv": "^17.3.1",
     "express": "^4.18.2",
     "express-rate-limit": "^8.5.2",
-    "helmet": "^8.2.0",
+    "google-auth-library": "^10.6.2",
     "jsonwebtoken": "^9.0.2",
     "razorpay": "^2.9.6",
     "uuid": "^9.0.0"
diff --git a/public/admin.html b/public/admin.html
index ce3a672..312f581 100644
--- a/public/admin.html
+++ b/public/admin.html
@@ -297,7 +297,7 @@ <h2 class="section-card-title">Top Performing Links</h2>
     <aside class="preview-panel" id="previewPanel">
       <div class="preview-header">
         <span class="preview-title">Live Preview</span>
-        <button class="btn btn-icon btn-secondary" title="Share" id="previewShareBtn">
+        <button class="btn btn-icon btn-secondary" title="Share" id="previewShareBtn" onclick="window.open('/me', '_blank')">
           <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg>
         </button>
       </div>
diff --git a/public/js/admin.js b/public/js/admin.js
index 5589498..a374db9 100644
--- a/public/js/admin.js
+++ b/public/js/admin.js
@@ -1059,12 +1059,4 @@
       // fail silently
     }
   }
-
-  // ─── Live Preview Share Button ───
-  const previewShareBtn = document.getElementById('previewShareBtn');
-  if (previewShareBtn) {
-    previewShareBtn.addEventListener('click', function () {
-      window.open('/me', '_blank');
-    });
-  }
 })();
diff --git a/server.js b/server.js
index 473e0ee..6323ec8 100644
--- a/server.js
+++ b/server.js
@@ -10,7 +10,6 @@ const crypto = require('crypto');
 const supabase = require('./db');
 const { OAuth2Client } = require('google-auth-library');
 const rateLimit = require('express-rate-limit');
-const helmet = require('helmet');
 const app = express();
 const PORT = process.env.PORT || 3000;
 if (!process.env.JWT_SECRET) {
@@ -70,23 +69,6 @@ const googleAuthLimiter = rateLimit({
 
 // Middleware
 app.use(cors());
-
-// Security headers
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
-      fontSrc: ["'self'", "https://fonts.gstatic.com"],
-      scriptSrc: ["'self'", "'unsafe-inline'", "https://checkout.razorpay.com", "https://cdnjs.cloudflare.com"],
-      imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'"],
-      frameAncestors: ["'self'"],
-      upgradeInsecureRequests: []
-    }
-  }
-}));
-
 app.use(express.json());
 app.use(cookieParser());