diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 3c22675e5..37efcb157 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,7 +1,7 @@
 {
   "name": "WrongSecrets",
 
-  "image": "ghcr.io/owasp/wrongsecrets-devcontainer:26-resolute",
+  "image": "ghcr.io/owasp/wrongsecrets-devcontainer:26-resolute-base",
 
   "workspaceFolder": "/workspaces",
 
diff --git a/.github/scripts/.bash_history b/.github/scripts/.bash_history
index c9a72731b..c40ae0c0e 100644
--- a/.github/scripts/.bash_history
+++ b/.github/scripts/.bash_history
@@ -347,7 +347,7 @@ rm -rf jdk-18_linux-x64_bin.deb
 git rebase -i main
 git rebase -i master
 git stash
-export tempPassword="oHaXO+702br6UpDvxYCGRfxj/wt32HxStpI6yaoSuu0="
+export tempPassword="Nza4LiZtSElJV2wYH/m6Gh5Z+9MItJ1g2iaIgwRmtXE="
 mvn run tempPassword
 k6
 npx k6
diff --git a/.github/scripts/docker-create.sh b/.github/scripts/docker-create.sh
index 38323de3e..256bc44c7 100755
--- a/.github/scripts/docker-create.sh
+++ b/.github/scripts/docker-create.sh
@@ -64,11 +64,11 @@ Heroku_publish_demo() {
     heroku container:login
     echo "heroku deployment to demo"
     cd ../..
-    # git add Dockerfile.web
-    # git commit --no-verify -m "Fix Heroku deploy"
-    # git push heroku HEAD:master
-    heroku container:push --recursive  --arg argBasedVersion=${tag} --app arcane-scrubland-42646
-    heroku container:release web --app arcane-scrubland-42646
+    git add Dockerfile.web
+    git commit --no-verify -m "Fix Heroku deploy"
+    git push heroku HEAD:master
+    # heroku container:push web --arg argBasedVersion=${tag} --app arcane-scrubland-42646
+    # heroku container:release web --app arcane-scrubland-42646
     # heroku container:push --recursive --arg argBasedVersion=${tag}heroku,CTF_ENABLED=true,HINTS_ENABLED=false --app wrongsecrets-ctf
     # heroku container:release web --app wrongsecrets-ctf
     echo "wait for contianer to come up"
diff --git a/.github/workflows/build-devcontainer.yml b/.github/workflows/build-devcontainer.yml
index b00b0978a..c19428299 100644
--- a/.github/workflows/build-devcontainer.yml
+++ b/.github/workflows/build-devcontainer.yml
@@ -7,66 +7,163 @@ on:
     paths:
       - ".devcontainer/Dockerfile"
       - ".devcontainer/devcontainer.json"
+      - ".devcontainer/post-create.sh"
       - ".github/workflows/build-devcontainer.yml"
 
   pull_request:
     paths:
       - ".devcontainer/Dockerfile"
       - ".devcontainer/devcontainer.json"
+      - ".devcontainer/post-create.sh"
       - ".github/workflows/build-devcontainer.yml"
 
   workflow_dispatch:
 
 permissions:
   contents: read
-  packages: write
+
+env:
+  IMAGE_NAME: ghcr.io/owasp/wrongsecrets-devcontainer
 
 jobs:
-  build:
-    name: Build dev container
-    runs-on: ubuntu-latest
+  build-and-scan:
+    name: Build and scan (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
+      # Build the base image from the Dockerfile.
+      - name: Build base image
+        uses: docker/build-push-action@v7
         with:
-          images: ghcr.io/owasp/wrongsecrets-devcontainer
+          context: .
+          file: .devcontainer/Dockerfile
+          platforms: ${{ matrix.platform }}
+          load: true
           tags: |
-            type=raw,value=26-resolute
-            type=sha
+            ${{ env.IMAGE_NAME }}:26-resolute-base-${{ matrix.arch }}-${{ github.sha }}
+          cache-from: type=gha,scope=devcontainer-base-${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=devcontainer-base-${{ matrix.arch }}
 
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      # The devcontainer.json refers to 26-resolute-base.
+      # Make the architecture-specific base image available
+      # locally under that exact name.
+      - name: Tag base image
+        run: |
+          docker tag \
+            "${IMAGE_NAME}:26-resolute-base-${{ matrix.arch }}-${{ github.sha }}" \
+            "${IMAGE_NAME}:26-resolute-base"
+
+      # Build the actual Dev Container.
+      #
+      # devcontainers/ci automatically adds :latest to imageName,
+      # so DO NOT put a tag in imageName here.
+      - name: Build Dev Container
+        uses: devcontainers/ci@v0.3
         with:
-          context: .
-          file: .devcontainer/Dockerfile
+          imageName: devcontainer-${{ matrix.arch }}-${{ github.sha }}
+          push: never
+
+      # devcontainers/ci produced:
+      #
+      #   devcontainer-${arch}-${sha}:latest
+      #
+      # Retag it with the image name we actually want to publish/scan.
+      - name: Tag final Dev Container
+        run: |
+          docker tag \
+            "devcontainer-${{ matrix.arch }}-${{ github.sha }}:latest" \
+            "${IMAGE_NAME}:${{ matrix.arch }}-${{ github.sha }}"
+
+      # Scan the FINAL Dev Container, including all features.
+      - name: Scan Dev Container
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "${{ env.IMAGE_NAME }}:${{ matrix.arch }}-${{ github.sha }}"
+          format: sarif
+          output: "trivy-${{ matrix.arch }}.sarif"
+          severity: CRITICAL,HIGH
+          exit-code: 1
+
+      - name: Upload scan results
+        if: always() && hashFiles(format('trivy-{0}.sarif', matrix.arch)) != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: "trivy-${{ matrix.arch }}.sarif"
+
+      # Only publish the final Dev Container after it passed Trivy.
+      - name: Push final Dev Container
+        if: github.event_name != 'pull_request'
+        run: |
+          docker push \
+            "${IMAGE_NAME}:${{ matrix.arch }}-${{ github.sha }}"
+
+      # Publish the base image separately.
+      - name: Push base image
+        if: github.event_name != 'pull_request'
+        run: |
+          docker tag \
+            "${IMAGE_NAME}:26-resolute-base-${{ matrix.arch }}-${{ github.sha }}" \
+            "${IMAGE_NAME}:26-resolute-base-${{ matrix.arch }}"
+
+          docker push \
+            "${IMAGE_NAME}:26-resolute-base-${{ matrix.arch }}"
 
-          platforms: |
-            linux/amd64
-            linux/arm64
+  manifest:
+    name: Create multi-arch manifest
+    needs: build-and-scan
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
 
-          push: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      contents: read
+      packages: write
 
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Create final Dev Container manifest
+        run: |
+          docker buildx imagetools create \
+            --tag "${IMAGE_NAME}:26-resolute" \
+            --tag "${IMAGE_NAME}:${GITHUB_SHA}" \
+            "${IMAGE_NAME}:amd64-${GITHUB_SHA}" \
+            "${IMAGE_NAME}:arm64-${GITHUB_SHA}"
diff --git a/.github/workflows/challenge13.yml b/.github/workflows/challenge13.yml
index 21ab9cb98..18b1d1297 100644
--- a/.github/workflows/challenge13.yml
+++ b/.github/workflows/challenge13.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Dump and exfiltrate
         shell: bash
         env:
diff --git a/.github/workflows/codeclimate_standalone.yml b/.github/workflows/codeclimate_standalone.yml
index e1b849872..1d3b9016c 100644
--- a/.github/workflows/codeclimate_standalone.yml
+++ b/.github/workflows/codeclimate_standalone.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Run Code Climate
         uses: erzz/codeclimate-standalone@v0.0.5
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 532331fc8..8c761caeb 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/container-alts-test.yml b/.github/workflows/container-alts-test.yml
index b9fac24b4..947a7bf58 100644
--- a/.github/workflows/container-alts-test.yml
+++ b/.github/workflows/container-alts-test.yml
@@ -16,7 +16,7 @@ jobs:
     name: Test with podman
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: run container
         run: |
           podman run -dt -p 8080:8080 -p 8090:8090 docker.io/jeroenwillemsen/wrongsecrets:latest-no-vault && \
diff --git a/.github/workflows/container_test.yml b/.github/workflows/container_test.yml
index dc5505f9b..504fb979d 100644
--- a/.github/workflows/container_test.yml
+++ b/.github/workflows/container_test.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Set up JDK 26
         uses: actions/setup-java@v5
         with:
@@ -40,6 +40,6 @@ jobs:
     name: Challenge 51 compose test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Run compose and print out service
         run: export DOCKER_BUILDKIT=1 && cd src/main/resources/challenges/challenge-51 && docker compose -f challenge51docker-compose.yml build && docker compose -f challenge51docker-compose.yml run myservice
diff --git a/.github/workflows/dast-zap-test.yml b/.github/workflows/dast-zap-test.yml
index 6b990e98b..b88642aa0 100644
--- a/.github/workflows/dast-zap-test.yml
+++ b/.github/workflows/dast-zap-test.yml
@@ -16,7 +16,7 @@ jobs:
     name: DAST test with ZAP
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Set up JDK 26
         uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/desktop-container-publish.yml b/.github/workflows/desktop-container-publish.yml
index 04262bde9..6a6c25d25 100644
--- a/.github/workflows/desktop-container-publish.yml
+++ b/.github/workflows/desktop-container-publish.yml
@@ -27,7 +27,7 @@ jobs:
             image_name: "wrongsecrets-desktop-k8s"
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up JDK 26
         uses: actions/setup-java@v5
diff --git a/.github/workflows/github-pages-preview.yml b/.github/workflows/github-pages-preview.yml
index 2c689cf4c..d16e87cc4 100644
--- a/.github/workflows/github-pages-preview.yml
+++ b/.github/workflows/github-pages-preview.yml
@@ -33,7 +33,7 @@ jobs:
       preview-url: ${{ steps.deployment.outputs.page_url }}pr-${{ github.event.number }}/
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up JDK 26
         uses: actions/setup-java@v5
@@ -271,7 +271,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/heroku_tests.yml b/.github/workflows/heroku_tests.yml
index e65ec4ad8..bae63c5fb 100644
--- a/.github/workflows/heroku_tests.yml
+++ b/.github/workflows/heroku_tests.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Run Tests
         run: |
           cd src/test/e2e
diff --git a/.github/workflows/java_swagger_doc.yml b/.github/workflows/java_swagger_doc.yml
index b65b53873..41bd56bce 100644
--- a/.github/workflows/java_swagger_doc.yml
+++ b/.github/workflows/java_swagger_doc.yml
@@ -18,7 +18,7 @@ jobs:
   javaDocGenerator:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Set up JDK 26
         uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/link_checker.yml b/.github/workflows/link_checker.yml
index caf37c025..367407315 100644
--- a/.github/workflows/link_checker.yml
+++ b/.github/workflows/link_checker.yml
@@ -14,7 +14,7 @@ jobs:
   linkChecker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Link Checker
         id: lychee
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 65c689c15..1fc2b706c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -29,7 +29,7 @@ jobs:
     name: lint javacode
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Set up JDK 26
         uses: actions/setup-java@v5
         with:
@@ -43,7 +43,7 @@ jobs:
     name: execute java spotbugs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Set up JDK 26
         uses: actions/setup-java@v5
         with:
@@ -59,7 +59,7 @@ jobs:
       checks: write
       contents: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Set up JDK 26
         uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/master-container-publish.yml b/.github/workflows/master-container-publish.yml
index 714a254b2..58468ef3f 100644
--- a/.github/workflows/master-container-publish.yml
+++ b/.github/workflows/master-container-publish.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up JDK 26
         uses: actions/setup-java@v5
diff --git a/.github/workflows/minikube-k8s-test.yml b/.github/workflows/minikube-k8s-test.yml
index 51e692d74..9bdd7d7fe 100644
--- a/.github/workflows/minikube-k8s-test.yml
+++ b/.github/workflows/minikube-k8s-test.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Start minikube
         uses: medyagh/setup-minikube@master
diff --git a/.github/workflows/minikube-vault-test.yml b/.github/workflows/minikube-vault-test.yml
index d13576c13..59a0c9264 100644
--- a/.github/workflows/minikube-vault-test.yml
+++ b/.github/workflows/minikube-vault-test.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: eLco/setup-vault@v1.0.4
       - name: Start minikube
         uses: medyagh/setup-minikube@master
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: eLco/setup-vault@v1.0.4
       - name: Start minikube
         uses: medyagh/setup-minikube@master
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 5b567570b..72f8ddc15 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -26,7 +26,7 @@ jobs:
       image-digest: ${{ steps.build.outputs.digest }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up JDK 26
         uses: actions/setup-java@v5
@@ -238,12 +238,12 @@ jobs:
     if: github.event.action != 'closed'
     steps:
       - name: Checkout PR code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           path: pr-code
 
       - name: Checkout main branch
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: master
           path: main-code
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 8acbc8d7f..7cc2824d2 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout git repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
       - name: Setup python
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/scanner-comparison.yml b/.github/workflows/scanner-comparison.yml
index c16067334..b68574542 100644
--- a/.github/workflows/scanner-comparison.yml
+++ b/.github/workflows/scanner-comparison.yml
@@ -17,7 +17,7 @@ jobs:
       count: ${{ steps.count.outputs.findings }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -48,7 +48,7 @@ jobs:
       count: ${{ steps.count.outputs.findings }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Install git-secrets
         run: |
@@ -88,7 +88,7 @@ jobs:
       count: ${{ steps.count.outputs.findings }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -122,7 +122,7 @@ jobs:
       count: ${{ steps.count.outputs.findings }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -158,7 +158,7 @@ jobs:
       count: ${{ steps.count.outputs.findings }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -193,7 +193,7 @@ jobs:
       count: ${{ steps.count.outputs.findings }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -234,7 +234,7 @@ jobs:
       count: ${{ steps.count.outputs.findings }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
diff --git a/.github/workflows/scanners.yml b/.github/workflows/scanners.yml
index f7c73b00c..caa745e1b 100644
--- a/.github/workflows/scanners.yml
+++ b/.github/workflows/scanners.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: TruffleHog OSS
diff --git a/.github/workflows/sort-contributors-go.yml b/.github/workflows/sort-contributors-go.yml
index f09cd97e1..18c7f42c4 100644
--- a/.github/workflows/sort-contributors-go.yml
+++ b/.github/workflows/sort-contributors-go.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Setup Go
         uses: actions/setup-go@v7
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 9d3c4a560..03b42e0b6 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -23,7 +23,7 @@ jobs:
     name: terraform-fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.9.8
diff --git a/.github/workflows/version-sync-check.yml b/.github/workflows/version-sync-check.yml
index 0a5ddc894..ea0fce3d9 100644
--- a/.github/workflows/version-sync-check.yml
+++ b/.github/workflows/version-sync-check.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up JDK 26
         uses: actions/setup-java@v5
diff --git a/.github/workflows/visual-diff.yml b/.github/workflows/visual-diff.yml
index c043bdeb4..083e9bd53 100644
--- a/.github/workflows/visual-diff.yml
+++ b/.github/workflows/visual-diff.yml
@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           path: pr-code
 
       - name: Checkout main branch
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: master
           path: main-code
diff --git a/Dockerfile b/Dockerfile
index d0fc8cdfe..6aae32248 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 FROM bellsoft/liberica-openjre-debian:26-cds AS builder
 WORKDIR /builder
 
-ARG argBasedVersion="1.14.0RC3"
+ARG argBasedVersion="1.14.0RC5">>>>>> hotfixRC4
 
 COPY --chown=wrongsecrets target/wrongsecrets-${argBasedVersion}-SNAPSHOT.jar application.jar
 RUN java -Djarmode=tools -jar application.jar extract --layers --destination extracted
diff --git a/Dockerfile.web b/Dockerfile.web
index 4ec3fde4d..30d64be05 100644
--- a/Dockerfile.web
+++ b/Dockerfile.web
@@ -1,5 +1,5 @@
-FROM jeroenwillemsen/wrongsecrets:1.14.0RC3-no-vault
-ARG argBasedVersion="1.14.0RC3-no-vault"
+FROM jeroenwillemsen/wrongsecrets:1.14.0RC5-no-vault
+ARG argBasedVersion="1.14.0RC5-no-vault"
 ARG spring_profile="without-vault"
 ARG CANARY_URLS="http://canarytokens.com/terms/about/s7cfbdakys13246ewd8ivuvku/post.jsp,http://canarytokens.com/terms/about/y0all60b627gzp19ahqh7rl6j/post.jsp"
 ARG CTF_ENABLED=false
diff --git a/aws/k8s/secret-challenge-vault-deployment.yml b/aws/k8s/secret-challenge-vault-deployment.yml
index bf025d25d..b02038467 100644
--- a/aws/k8s/secret-challenge-vault-deployment.yml
+++ b/aws/k8s/secret-challenge-vault-deployment.yml
@@ -58,7 +58,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "wrongsecrets-aws-secretsmanager"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.14.0RC3-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.14.0RC5-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/azure/k8s/secret-challenge-vault-deployment.yml.tpl b/azure/k8s/secret-challenge-vault-deployment.yml.tpl
index 51d6bd7cb..295c27b24 100644
--- a/azure/k8s/secret-challenge-vault-deployment.yml.tpl
+++ b/azure/k8s/secret-challenge-vault-deployment.yml.tpl
@@ -61,7 +61,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "azure-wrongsecrets-vault"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.14.0RC3-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.14.0RC5-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/docs/VERSION_MANAGEMENT.md b/docs/VERSION_MANAGEMENT.md
index 0bdcabce5..a7ac7e8e9 100644
--- a/docs/VERSION_MANAGEMENT.md
+++ b/docs/VERSION_MANAGEMENT.md
@@ -12,9 +12,9 @@ The project maintains version consistency between:
 ## Version Schema
 
 ```
-pom.xml version:        1.14.0RC3-SNAPSHOT
-Dockerfile version:     1.14.0RC3
-Dockerfile.web version: 1.14.0RC3-no-vault
+pom.xml version:        1.14.0RC5-SNAPSHOT
+Dockerfile version:     1.14.0RC5
+Dockerfile.web version: 1.14.0RC5-no-vault
 ```
 
 ## Automated Solutions
diff --git a/fly.toml b/fly.toml
index 672f44af2..ec90bd7f6 100644
--- a/fly.toml
+++ b/fly.toml
@@ -8,7 +8,7 @@ app = "wrongsecrets"
 primary_region = "ams"
 
 [build]
-  image = "docker.io/jeroenwillemsen/wrongsecrets:1.14.0RC3-no-vault"
+  image = "docker.io/jeroenwillemsen/wrongsecrets:1.14.0RC5-no-vault"
 
 [env]
   K8S_ENV = "Fly(Docker)"
diff --git a/gcp/k8s/secret-challenge-vault-deployment.yml.tpl b/gcp/k8s/secret-challenge-vault-deployment.yml.tpl
index f5f780e91..9babfd07e 100644
--- a/gcp/k8s/secret-challenge-vault-deployment.yml.tpl
+++ b/gcp/k8s/secret-challenge-vault-deployment.yml.tpl
@@ -58,7 +58,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "wrongsecrets-gcp-secretsmanager"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.14.0RC3-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.14.0RC5-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/js/index.js b/js/index.js
index 000a78615..8792510bb 100644
--- a/js/index.js
+++ b/js/index.js
@@ -1,5 +1,4 @@
-
  function secret() {
- var password = "VeZGFY4=" + 9 + "xyOd" + 6 + "VcA=" + 2 + "LCiO" + 7;
+ var password = "d9KRYoY=" + 9 + "rLZd" + 6 + "EqA=" + 2 + "wuQN" + 7;
  return password;
  }
diff --git a/k8s/challenge53/secret-challenge53-sidecar.yml b/k8s/challenge53/secret-challenge53-sidecar.yml
index 096576f43..9daaa588f 100644
--- a/k8s/challenge53/secret-challenge53-sidecar.yml
+++ b/k8s/challenge53/secret-challenge53-sidecar.yml
@@ -21,7 +21,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-      - image: jeroenwillemsen/wrongsecrets-challenge53:1.14.0RC3
+      - image: jeroenwillemsen/wrongsecrets-challenge53:1.14.0RC5
         name: secret-challenge-53
         imagePullPolicy: IfNotPresent
         resources:
@@ -45,7 +45,7 @@ spec:
         command: ["/bin/sh", "-c"]
         args:
           - cp /home/wrongsecrets/* /shared-data/ && exec /home/wrongsecrets/start-on-arch.sh
-      - image: jeroenwillemsen/wrongsecrets-challenge53-debug:1.14.0RC3
+      - image: jeroenwillemsen/wrongsecrets-challenge53-debug:1.14.0RC5
         name: sidecar
         imagePullPolicy: IfNotPresent
         command: ["/bin/sh", "-c", "while true; do ls /shared-data; sleep 10; done"]
diff --git a/k8s/challenge53/secret-challenge53.yml b/k8s/challenge53/secret-challenge53.yml
index aac56dbc1..684c95622 100644
--- a/k8s/challenge53/secret-challenge53.yml
+++ b/k8s/challenge53/secret-challenge53.yml
@@ -21,7 +21,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-      - image: jeroenwillemsen/wrongsecrets-challenge53:1.14.0RC3
+      - image: jeroenwillemsen/wrongsecrets-challenge53:1.14.0RC5
         name: secret-challenge-53
         imagePullPolicy: IfNotPresent
         resources:
diff --git a/k8s/secret-challenge-deployment.yml b/k8s/secret-challenge-deployment.yml
index 1ba2c9afd..30430f351 100644
--- a/k8s/secret-challenge-deployment.yml
+++ b/k8s/secret-challenge-deployment.yml
@@ -28,7 +28,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.14.0RC3-no-vault
+        - image: jeroenwillemsen/wrongsecrets:1.14.0RC5-no-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           ports:
diff --git a/k8s/secret-challenge-vault-deployment.yml b/k8s/secret-challenge-vault-deployment.yml
index 0ed857153..df04795db 100644
--- a/k8s/secret-challenge-vault-deployment.yml
+++ b/k8s/secret-challenge-vault-deployment.yml
@@ -50,7 +50,7 @@ spec:
           type: RuntimeDefault
       serviceAccountName: vault
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.14.0RC3-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.14.0RC5-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/okteto/k8s/secret-challenge-ctf-deployment.yml b/okteto/k8s/secret-challenge-ctf-deployment.yml
index e8e032990..61495e053 100644
--- a/okteto/k8s/secret-challenge-ctf-deployment.yml
+++ b/okteto/k8s/secret-challenge-ctf-deployment.yml
@@ -28,7 +28,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.14.0RC3-no-vault
+        - image: jeroenwillemsen/wrongsecrets:1.14.0RC5-no-vault
           name: secret-challenge-ctf
           imagePullPolicy: IfNotPresent
           securityContext:
diff --git a/okteto/k8s/secret-challenge-deployment.yml b/okteto/k8s/secret-challenge-deployment.yml
index 82dd6b2a0..134b30fea 100644
--- a/okteto/k8s/secret-challenge-deployment.yml
+++ b/okteto/k8s/secret-challenge-deployment.yml
@@ -28,7 +28,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.14.0RC3-no-vault
+        - image: jeroenwillemsen/wrongsecrets:1.14.0RC5-no-vault
           name: secret-challenge
           imagePullPolicy: IfNotPresent
           securityContext:
diff --git a/pom.xml b/pom.xml
index 53ce6633b..d438ddb09 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
 
   <groupId>org.owasp</groupId>
   <artifactId>wrongsecrets</artifactId>
-  <version>1.14.0RC3-SNAPSHOT</version>
+  <version>1.14.0RC5-SNAPSHOT</version>
 
   <name>OWASP WrongSecrets</name>
   <description>Examples with how to not use secrets</description>