diff --git a/backend/src/contracts/api-contracts.json b/backend/src/contracts/api-contracts.json
index 66ea7b4..2907b37 100644
--- a/backend/src/contracts/api-contracts.json
+++ b/backend/src/contracts/api-contracts.json
@@ -42,7 +42,8 @@
     "mimeTypes": [
       "application/pdf",
       "image/png",
-      "image/jpeg"
+      "image/jpeg",
+      "image/svg+xml"
     ]
   }
 }
diff --git a/backend/src/documents/documents.controller.ts b/backend/src/documents/documents.controller.ts
index 4b69442..fb1d4ee 100644
--- a/backend/src/documents/documents.controller.ts
+++ b/backend/src/documents/documents.controller.ts
@@ -53,7 +53,9 @@ const fileFilter: multer.Options['fileFilter'] = (_req, file, callback) => {
   }
 
   return callback(
-    new BadRequestException('Only PDF, PNG, or JPEG files are allowed'),
+    new BadRequestException(
+      'Only PDF, PNG, JPEG, or SVG files are allowed',
+    ),
   );
 };
 
diff --git a/backend/src/documents/pipes/file-validation.pipe.spec.ts b/backend/src/documents/pipes/file-validation.pipe.spec.ts
index d3a6fdc..5cf0085 100644
--- a/backend/src/documents/pipes/file-validation.pipe.spec.ts
+++ b/backend/src/documents/pipes/file-validation.pipe.spec.ts
@@ -44,6 +44,10 @@ async function createValidPng(): Promise<Buffer> {
     .toBuffer();
 }
 
+function createSvg(markup: string): Buffer {
+  return Buffer.from(markup, 'utf8');
+}
+
 describe('FileValidationPipe', () => {
   let pipe: FileValidationPipe;
 
@@ -90,6 +94,142 @@ describe('FileValidationPipe', () => {
     expect(result.mimetype).toBe('image/jpeg');
   });
 
+  it('should accept static SVG content and store a bounded PNG', async () => {
+    const buffer = createSvg(`
+      <svg xmlns="http://www.w3.org/2000/svg" width="120" height="40" viewBox="0 0 120 40">
+        <title>Parcel A &amp; B</title>
+        <defs>
+          <linearGradient id="paint">
+            <stop offset="0" stop-color="#fff" />
+          </linearGradient>
+        </defs>
+        <path id="shape" d="M0 0 L120 40" fill="url(#paint)" stroke="#123456" stroke-width="2" />
+        <text aria-label="https://maps.example/Parcel"><textPath href="#shape">Parcel A</textPath></text>
+      </svg>
+    `);
+    const file = createFile(buffer, 'image/svg+xml', 'survey.svg');
+
+    const result = await pipe.transform(file);
+
+    expect(result.mimetype).toBe('image/png');
+    expect(result.buffer.subarray(1, 4).toString('ascii')).toBe('PNG');
+    expect(result.size).toBe(result.buffer.length);
+  });
+
+  it.each<[string, RegExp]>([
+    ['<script>alert(1)</script>', /active or resource-bearing content/i],
+    ['<script />', /active or resource-bearing content/i],
+    ['<animate attributeName="href" values="javascript:alert(1)" />', /active or resource-bearing content/i],
+    ['<style>rect { fill: red }</style>', /active or resource-bearing content/i],
+    ['<foreignObject><div>html</div></foreignObject>', /active or resource-bearing content/i],
+    ['<image href="data:image/png;base64,AA==" />', /active or resource-bearing content/i],
+    ['<feImage href="https://attacker.example/pixel.png" />', /active or resource-bearing content/i],
+  ])('should reject active SVG element %s', async (element, expectedError) => {
+    const buffer = createSvg(
+      `<svg xmlns="http://www.w3.org/2000/svg">${element}</svg>`,
+    );
+    const file = createFile(buffer, 'image/svg+xml', 'active.svg');
+
+    await expect(pipe.transform(file)).rejects.toThrow(expectedError);
+  });
+
+  it.each([
+    '<rect width="1" height="1" onload="alert(1)" />',
+    '<rect width="1" height="1" style="fill:url(https://attacker.example/paint)" />',
+  ])('should reject active SVG attribute in %s', async (element) => {
+    const buffer = createSvg(
+      `<svg xmlns="http://www.w3.org/2000/svg">${element}</svg>`,
+    );
+    const file = createFile(buffer, 'image/svg+xml', 'active-attribute.svg');
+
+    await expect(pipe.transform(file)).rejects.toThrow(
+      /active or unsafe attributes/i,
+    );
+  });
+
+  it('should preserve inert descriptive attributes that contain URL-like text', async () => {
+    const buffer = createSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg"><text aria-label="url(https://maps.example/reference)" data-reference="url(https://maps.example/data)">Parcel</text></svg>',
+    );
+
+    const result = await pipe.transform(
+      createFile(buffer, 'image/svg+xml', 'descriptive.svg'),
+    );
+
+    expect(result.mimetype).toBe('image/png');
+  });
+
+  it.each([
+    '<rect fill="url(/**/https://attacker.example/paint)" />',
+    '<rect fill="u\\72l(https://attacker.example/paint)" />',
+  ])('should reject obfuscated external CSS URLs in %s', async (element) => {
+    const buffer = createSvg(
+      `<svg xmlns="http://www.w3.org/2000/svg">${element}</svg>`,
+    );
+
+    await expect(
+      pipe.transform(
+        createFile(buffer, 'image/svg+xml', 'external-css.svg'),
+      ),
+    ).rejects.toThrow(/external or embedded resource/i);
+  });
+
+  it('should reject unsupported elements and oversized tags before rasterization', async () => {
+    const unsupported = createSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg"><unknown /></svg>',
+    );
+    const oversized = createSvg(
+      `<svg xmlns="http://www.w3.org/2000/svg"><rect data-note="${'a'.repeat(64 * 1024)}" /></svg>`,
+    );
+
+    await expect(
+      pipe.transform(
+        createFile(unsupported, 'image/svg+xml', 'unknown.svg'),
+      ),
+    ).rejects.toThrow(/not supported/i);
+    await expect(
+      pipe.transform(
+        createFile(oversized, 'image/svg+xml', 'oversized.svg'),
+      ),
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it('should reject external SVG references', async () => {
+    const buffer = createSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg">' +
+        '<text><textPath href="https://attacker.example/path">Parcel</textPath></text>' +
+        '</svg>',
+    );
+    const file = createFile(buffer, 'image/svg+xml', 'external.svg');
+
+    await expect(pipe.transform(file)).rejects.toThrow(
+      /resource-bearing|external|embedded resource/i,
+    );
+  });
+
+  it('should reject data URLs in SVG attributes', async () => {
+    const buffer = createSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg">' +
+        '<text><textPath href="data:image/png;base64,AA==">Parcel</textPath></text>' +
+        '</svg>',
+    );
+    const file = createFile(buffer, 'image/svg+xml', 'data.svg');
+
+    await expect(pipe.transform(file)).rejects.toThrow(
+      /resource-bearing|external|embedded resource/i,
+    );
+  });
+
+  it('should reject SVG entities and external resources', async () => {
+    const buffer = createSvg(`
+      <!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+      <svg xmlns="http://www.w3.org/2000/svg"><text>&xxe;</text></svg>
+    `);
+    const file = createFile(buffer, 'image/svg+xml', 'entity.svg');
+
+    await expect(pipe.transform(file)).rejects.toThrow(/unsafe XML content/i);
+  });
+
   it('should reject an executable renamed to .pdf', async () => {
     const buffer = Buffer.from('MZ\x90\x00');
     const file = createFile(buffer, 'application/pdf', 'malware.pdf');
diff --git a/backend/src/documents/pipes/file-validation.pipe.ts b/backend/src/documents/pipes/file-validation.pipe.ts
index 4a5aab0..ac6ef44 100644
--- a/backend/src/documents/pipes/file-validation.pipe.ts
+++ b/backend/src/documents/pipes/file-validation.pipe.ts
@@ -12,6 +12,135 @@ const sharp = require('sharp') as (...args: any[]) => any;
 
 const ALLOWED_MIME_TYPES = DOCUMENT_ALLOWED_MIME_TYPES;
 const MAX_FILE_SIZE_BYTES = DOCUMENT_MAX_FILE_SIZE_BYTES;
+const MAX_SVG_RASTER_DIMENSION = 4096;
+const MAX_SVG_ELEMENTS = 50_000;
+const MAX_SVG_DEPTH = 128;
+const MAX_SVG_TAG_LENGTH = 64 * 1024;
+const MAX_SVG_ATTRIBUTES_PER_ELEMENT = 256;
+const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
+const XLINK_NAMESPACE = 'http://www.w3.org/1999/xlink';
+
+const DISALLOWED_SVG_ELEMENTS = new Set([
+  'script',
+  'foreignobject',
+  'style',
+  'animate',
+  'animatemotion',
+  'animatetransform',
+  'set',
+  'discard',
+  'handler',
+  'listener',
+  'iframe',
+  'object',
+  'embed',
+  'audio',
+  'video',
+  'link',
+  'meta',
+  'a',
+  'image',
+  'feimage',
+  'font-face-uri',
+  'color-profile',
+  'mpath',
+  'use',
+]);
+
+const ALLOWED_SVG_ELEMENTS = new Set([
+  'svg',
+  'g',
+  'defs',
+  'title',
+  'desc',
+  'path',
+  'rect',
+  'circle',
+  'ellipse',
+  'line',
+  'polyline',
+  'polygon',
+  'text',
+  'tspan',
+  'textpath',
+  'lineargradient',
+  'radialgradient',
+  'stop',
+  'clippath',
+  'pattern',
+  'marker',
+  'symbol',
+  'view',
+  'mask',
+  'filter',
+  'fegaussianblur',
+  'feoffset',
+  'feblend',
+  'fecolormatrix',
+  'fecomponenttransfer',
+  'fecomposite',
+  'fediffuselighting',
+  'feconvolvematrix',
+  'fedisplacementmap',
+  'fedropshadow',
+  'feflood',
+  'fefunca',
+  'fefuncb',
+  'fefuncg',
+  'fefuncr',
+  'femerge',
+  'femergenode',
+  'femorphology',
+  'fepointlight',
+  'fespecularlighting',
+  'fespotlight',
+  'fetile',
+  'feturbulence',
+  'switch',
+  'font',
+  'font-face',
+  'font-face-format',
+  'font-face-name',
+  'glyph',
+  'missing-glyph',
+  'hkern',
+  'vkern',
+  'tref',
+  'cursor',
+]);
+
+const URL_ATTRIBUTES = new Set([
+  'href',
+  'xlink:href',
+  'src',
+  'srcset',
+  'action',
+  'formaction',
+  'poster',
+  'background',
+  'codebase',
+  'cite',
+  'icon',
+  'manifest',
+  'profile',
+  'usemap',
+  'ping',
+  'longdesc',
+]);
+
+const CSS_URL_ATTRIBUTES = new Set([
+  'background-image',
+  'clip-path',
+  'color-profile',
+  'cursor',
+  'fill',
+  'filter',
+  'marker-end',
+  'marker-mid',
+  'marker-start',
+  'mask',
+  'stroke',
+]);
 
 interface DetectedType {
   mime: string;
@@ -85,6 +214,11 @@ export class FileValidationPipe implements PipeTransform<
       );
     }
 
+    if (detectedType.mime === 'image/svg+xml') {
+      await this.sanitizeSvg(file);
+      return file;
+    }
+
     if (detectedType.mime === 'application/pdf') {
       await this.validatePdf(file.buffer);
     }
@@ -123,6 +257,11 @@ export class FileValidationPipe implements PipeTransform<
       return { mime: 'image/jpeg', ext: 'jpg' };
     }
 
+    const svg = this.decodeSvg(buffer);
+    if (svg && this.looksLikeSvg(svg)) {
+      return { mime: 'image/svg+xml', ext: 'svg' };
+    }
+
     if (buffer[0] === 0x50 && buffer[1] === 0x4b) {
       return { mime: 'application/zip', ext: 'zip' };
     }
@@ -159,6 +298,268 @@ export class FileValidationPipe implements PipeTransform<
     return undefined;
   }
 
+  private decodeSvg(buffer: Buffer): string | null {
+    try {
+      return new TextDecoder('utf-8', { fatal: true }).decode(buffer);
+    } catch {
+      return null;
+    }
+  }
+
+  private stripXmlDeclaration(source: string): string {
+    return source.replace(
+      /^\uFEFF?\s*<\?xml\s+version\s*=\s*(['"])1\.0\1(?:\s+encoding\s*=\s*(['"])UTF-8\2)?(?:\s+standalone\s*=\s*(['"])(?:yes|no)\3)?\s*\?>\s*/i,
+      '',
+    );
+  }
+
+  private hasSvgRoot(source: string): boolean {
+    return /^<svg(?:\s|>)/i.test(this.stripXmlDeclaration(source));
+  }
+
+  private looksLikeSvg(source: string): boolean {
+    return this.hasSvgRoot(source) || /<svg(?:\s|>)/i.test(source);
+  }
+
+  private assertSafeSvg(source: string): void {
+    const body = this.stripXmlDeclaration(source);
+    if (
+      /<!--|<!\[CDATA\[|<\?|<!DOCTYPE|<!ENTITY/i.test(body) ||
+      /&(?!(?:amp|lt|gt|quot|apos);)/.test(body)
+    ) {
+      throw new BadRequestException('SVG contains unsafe XML content');
+    }
+    if (!/^<svg(?:\s|>)/i.test(body)) {
+      throw new BadRequestException('Invalid SVG document');
+    }
+
+    const stack: string[] = [];
+    let elementCount = 0;
+    let rootClosed = false;
+    let index = 0;
+
+    while (index < body.length) {
+      if (body[index] !== '<') {
+        index += 1;
+        continue;
+      }
+
+      if (rootClosed) {
+        if (/\S/.test(body.slice(index))) {
+          throw new BadRequestException('Invalid SVG document');
+        }
+        break;
+      }
+
+      const tagEnd = this.findSvgTagEnd(body, index + 1);
+      if (tagEnd === -1) {
+        throw new BadRequestException('Invalid SVG document');
+      }
+
+      const rawTag = body.slice(index + 1, tagEnd);
+      if (!rawTag || rawTag.startsWith('!') || rawTag.startsWith('?')) {
+        throw new BadRequestException('SVG contains unsafe XML content');
+      }
+
+      if (rawTag.startsWith('/')) {
+        const closingMatch = /^\/\s*([A-Za-z_][A-Za-z0-9_.-]*)\s*$/.exec(
+          rawTag,
+        );
+        if (!closingMatch) {
+          throw new BadRequestException('Invalid SVG document');
+        }
+
+        const name = closingMatch[1].toLowerCase();
+        if (stack.pop() !== name) {
+          throw new BadRequestException('Invalid SVG document');
+        }
+        if (stack.length === 0) rootClosed = true;
+      } else {
+        const openingMatch = /^([A-Za-z_][A-Za-z0-9_.-]*)([\s\S]*)$/.exec(
+          rawTag,
+        );
+        if (!openingMatch || openingMatch[1].includes(':')) {
+          throw new BadRequestException('Invalid SVG document');
+        }
+
+        const name = openingMatch[1].toLowerCase();
+        const attributes = openingMatch[2].replace(/\/\s*$/, '');
+        const selfClosing = /\/\s*$/.test(openingMatch[2]);
+
+        elementCount += 1;
+        if (elementCount > MAX_SVG_ELEMENTS || stack.length >= MAX_SVG_DEPTH) {
+          throw new BadRequestException('SVG exceeds structural limits');
+        }
+        if (DISALLOWED_SVG_ELEMENTS.has(name)) {
+          throw new BadRequestException(
+            'SVG contains active or resource-bearing content that is not allowed',
+          );
+        }
+        if (!ALLOWED_SVG_ELEMENTS.has(name)) {
+          throw new BadRequestException(
+            `SVG element ${name} is not supported`,
+          );
+        }
+
+        if (stack.length === 0) {
+          if (name !== 'svg' || /\S/.test(body.slice(0, index))) {
+            throw new BadRequestException('Invalid SVG document');
+          }
+          if (selfClosing) rootClosed = true;
+        } else if (name === 'svg') {
+          throw new BadRequestException('Invalid SVG document');
+        }
+
+        this.validateSvgAttributes(attributes);
+        if (!selfClosing) stack.push(name);
+      }
+
+      index = tagEnd + 1;
+    }
+
+    if (stack.length !== 0 || !rootClosed) {
+      throw new BadRequestException('Invalid SVG document');
+    }
+  }
+
+  private findSvgTagEnd(source: string, start: number): number {
+    let quote: "'" | '"' | null = null;
+
+    for (let index = start; index < source.length; index += 1) {
+      if (index - start > MAX_SVG_TAG_LENGTH) return -1;
+
+      const character = source[index];
+      if (quote) {
+        if (character === quote) quote = null;
+      } else if (character === "'" || character === '"') {
+        quote = character;
+      } else if (character === '>') {
+        return index;
+      } else if (character === '<') {
+        return -1;
+      }
+    }
+
+    return -1;
+  }
+
+  private validateSvgAttributes(input: string): void {
+    let remaining = input.trim();
+    const names = new Set<string>();
+
+    while (remaining) {
+      const match =
+        /^([A-Za-z_][A-Za-z0-9_.:-]*)\s*=\s*(["'])([\s\S]*?)\2(?=\s|$)/.exec(
+          remaining,
+        );
+      if (!match) {
+        throw new BadRequestException('Invalid SVG attributes');
+      }
+
+      const name = match[1].toLowerCase();
+      const value = match[3];
+      if (
+        names.has(name) ||
+        names.size >= MAX_SVG_ATTRIBUTES_PER_ELEMENT
+      ) {
+        throw new BadRequestException('Invalid SVG attributes');
+      }
+      names.add(name);
+
+      if (name === 'xmlns' || name.startsWith('xmlns:')) {
+        if (value !== SVG_NAMESPACE && value !== XLINK_NAMESPACE) {
+          throw new BadRequestException('SVG contains an external reference');
+        }
+        remaining = remaining.slice(match[0].length).trim();
+        continue;
+      }
+
+      if (
+        name.includes(':') &&
+        name !== 'xlink:href' &&
+        name !== 'xml:space' &&
+        name !== 'xml:lang'
+      ) {
+        throw new BadRequestException('SVG contains an external reference');
+      }
+
+      if (
+        name.startsWith('on') ||
+        name === 'style' ||
+        name === 'xml:base' ||
+        value.includes('<') ||
+        /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value)
+      ) {
+        throw new BadRequestException(
+          'SVG contains active or unsafe attributes',
+        );
+      }
+
+      if (
+        URL_ATTRIBUTES.has(name) &&
+        !/^#[A-Za-z0-9_.:-]+$/.test(value)
+      ) {
+        throw new BadRequestException(
+          'SVG contains an external or embedded resource',
+        );
+      }
+
+      if (CSS_URL_ATTRIBUTES.has(name)) {
+        const normalizedCssValue = value.replace(/\/\*[\s\S]*?\*\//g, '');
+        if (
+          (normalizedCssValue.includes('\\') ||
+            /\b(?:url|var|attr)\s*\(/i.test(normalizedCssValue)) &&
+          !/^url\(\s*#[A-Za-z0-9_.:-]+\s*\)$/i.test(
+            normalizedCssValue.trim(),
+          )
+        ) {
+          throw new BadRequestException(
+            'SVG contains an external or embedded resource',
+          );
+        }
+      }
+
+      remaining = remaining.slice(match[0].length).trim();
+    }
+  }
+
+  private async sanitizeSvg(file: Express.Multer.File): Promise<void> {
+    const source = this.decodeSvg(file.buffer);
+    if (!source) {
+      throw new BadRequestException('Invalid or malformed SVG file');
+    }
+
+    this.assertSafeSvg(source);
+
+    try {
+      const sanitized = await sharp(file.buffer, {
+        limitInputPixels: 40_000_000,
+        timeout: 5_000,
+      })
+        .resize({
+          width: MAX_SVG_RASTER_DIMENSION,
+          height: MAX_SVG_RASTER_DIMENSION,
+          fit: 'inside',
+          withoutEnlargement: true,
+        })
+        .png()
+        .toBuffer();
+
+      if (sanitized.length > MAX_FILE_SIZE_BYTES) {
+        throw new BadRequestException(
+          `File exceeds maximum size of ${MAX_FILE_SIZE_BYTES} bytes`,
+        );
+      }
+
+      file.buffer = sanitized;
+      file.size = sanitized.length;
+      file.mimetype = 'image/png';
+    } catch (error) {
+      if (error instanceof BadRequestException) throw error;
+      throw new BadRequestException('Invalid or unsafe SVG file');
+    }
+  }
+
   private validateSize(file: Express.Multer.File): void {
     if (file.size > MAX_FILE_SIZE_BYTES) {
       throw new BadRequestException(
@@ -220,7 +621,12 @@ export class FileValidationPipe implements PipeTransform<
 
   private async stripImageMetadata(buffer: Buffer): Promise<Buffer> {
     try {
-      return await sharp(buffer).withMetadata({}).toBuffer();
+      return await sharp(buffer, {
+        limitInputPixels: 40_000_000,
+        timeout: 5_000,
+      })
+        .withMetadata({})
+        .toBuffer();
     } catch {
       throw new BadRequestException('Failed to process image metadata');
     }
diff --git a/contracts/api-contracts.json b/contracts/api-contracts.json
index 66ea7b4..2907b37 100644
--- a/contracts/api-contracts.json
+++ b/contracts/api-contracts.json
@@ -42,7 +42,8 @@
     "mimeTypes": [
       "application/pdf",
       "image/png",
-      "image/jpeg"
+      "image/jpeg",
+      "image/svg+xml"
     ]
   }
 }
diff --git a/frontend/__tests__/abdulrcrtw.test.ts b/frontend/__tests__/abdulrcrtw.test.ts
index e15c631..6959e4d 100644
--- a/frontend/__tests__/abdulrcrtw.test.ts
+++ b/frontend/__tests__/abdulrcrtw.test.ts
@@ -1,5 +1,5 @@
 import { sanitizeText, isSafeUrl } from '../lib/sanitize';
-import { toPublicDocumentView } from '../lib/document-sanitizer';
+import { toPublicDocumentView } from '../lib/document-mapper';
 
 describe('abdulrcrtw Frontend Features (FE-95, FE-94, FE-93, FE-92)', () => {
   it('sanitizeText escapes HTML characters', () => {
diff --git a/frontend/app/[locale]/(protected)/documents/upload/page.tsx b/frontend/app/[locale]/(protected)/documents/upload/page.tsx
index 39ebaec..a9a52c3 100644
--- a/frontend/app/[locale]/(protected)/documents/upload/page.tsx
+++ b/frontend/app/[locale]/(protected)/documents/upload/page.tsx
@@ -7,6 +7,7 @@ import {
   documentUploadConstraints,
   documentUploadSchema,
 } from "@/lib/schemas/document";
+import { sanitizeSvg } from "@/lib/document-sanitizer";
 
 const API_BASE = process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:3001";
 const MAX_SIZE_MB = Math.round(
@@ -33,12 +34,12 @@ export default function DocumentUploadPage() {
 
     const field = result.error.issues[0]?.path[0];
     if (field === "mimeType") {
-      return "Invalid file type. Only PDF, PNG, and JPEG files are allowed.";
+      return "Invalid file type. Only PDF, PNG, JPEG, and SVG files are allowed.";
     }
     return `File is too large. Maximum file size allowed is ${MAX_SIZE_MB}MB.`;
   }
 
-  function handleFileChange(file: File | null) {
+  async function handleFileChange(file: File | null) {
     if (!file) return;
     const valError = validateFile(file);
     if (valError) {
@@ -47,10 +48,25 @@ export default function DocumentUploadPage() {
       return;
     }
 
+    let preparedFile = file;
+    if (file.type === "image/svg+xml") {
+      try {
+        const sanitized = sanitizeSvg(await file.text());
+        preparedFile = new File([sanitized], file.name, {
+          type: "image/svg+xml",
+          lastModified: file.lastModified,
+        });
+      } catch {
+        setError("The SVG file could not be sanitized safely.");
+        setSelectedFile(null);
+        return;
+      }
+    }
+
     setError("");
-    setSelectedFile(file);
+    setSelectedFile(preparedFile);
     if (!title) {
-      setTitle(file.name.replace(/\.[^/.]+$/, ""));
+      setTitle(preparedFile.name.replace(/\.[^/.]+$/, ""));
     }
   }
 
@@ -68,7 +84,7 @@ export default function DocumentUploadPage() {
     e.preventDefault();
     setIsDragOver(false);
     if (e.dataTransfer.files && e.dataTransfer.files[0]) {
-      handleFileChange(e.dataTransfer.files[0]);
+      void handleFileChange(e.dataTransfer.files[0]);
     }
   }
 
@@ -134,7 +150,7 @@ export default function DocumentUploadPage() {
       <div className="rounded-xl border border-gray-800 bg-gray-950 p-8 shadow-2xl">
         <h1 className="text-2xl font-bold">Upload New Document</h1>
         <p className="mt-1 text-xs text-gray-400">
-          Upload PDF, PNG, or JPEG documents (up to {MAX_SIZE_MB}MB) for
+          Upload PDF, PNG, JPEG, or SVG documents (up to {MAX_SIZE_MB}MB) for
           automated AI verification.
         </p>
 
@@ -170,7 +186,7 @@ export default function DocumentUploadPage() {
               type="file"
               accept={documentUploadConstraints.mimeTypes.join(",")}
               className="hidden"
-              onChange={(e) => handleFileChange(e.target.files?.[0] || null)}
+              onChange={(e) => void handleFileChange(e.target.files?.[0] || null)}
             />
 
             {selectedFile ? (
@@ -192,7 +208,7 @@ export default function DocumentUploadPage() {
                   Drag and drop your file here, or <span className="text-blue-400 underline">browse</span>
                 </p>
                 <p className="mt-1 text-xs text-gray-500">
-                  Supports PDF, PNG, JPEG (Max {MAX_SIZE_MB}MB)
+                  Supports PDF, PNG, JPEG, SVG (Max {MAX_SIZE_MB}MB)
                 </p>
               </div>
             )}
diff --git a/frontend/components/disputes/FileDisputeModal.tsx b/frontend/components/disputes/FileDisputeModal.tsx
index 9df0891..e5499f0 100644
--- a/frontend/components/disputes/FileDisputeModal.tsx
+++ b/frontend/components/disputes/FileDisputeModal.tsx
@@ -39,6 +39,7 @@ export function FileDisputeModal({
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const { toast } = useToast();
+  const availableDocuments = Array.isArray(documents) ? documents : [];
 
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
@@ -112,7 +113,7 @@ export function FileDisputeModal({
               className="mt-1 block w-full rounded-md border-gray-300 py-2 pl-3 pr-10 text-base focus:border-indigo-500 focus:outline-none focus:ring-indigo-500 sm:text-sm"
             >
               <option value="">Select a document</option>
-              {documents.map((doc) => (
+              {availableDocuments.map((doc) => (
                 <option key={doc.id} value={doc.id}>
                   {doc.title}
                 </option>
diff --git a/frontend/contracts/api-contracts.json b/frontend/contracts/api-contracts.json
index 66ea7b4..2907b37 100644
--- a/frontend/contracts/api-contracts.json
+++ b/frontend/contracts/api-contracts.json
@@ -42,7 +42,8 @@
     "mimeTypes": [
       "application/pdf",
       "image/png",
-      "image/jpeg"
+      "image/jpeg",
+      "image/svg+xml"
     ]
   }
 }
diff --git a/frontend/lib/auth-session.test.ts b/frontend/lib/auth-session.test.ts
new file mode 100644
index 0000000..1ef225e
--- /dev/null
+++ b/frontend/lib/auth-session.test.ts
@@ -0,0 +1,131 @@
+import {
+  clearSession,
+  getJwtExpiration,
+  getValidAccessToken,
+  getValidRefreshToken,
+  hasStoredSession,
+  resolvePostLoginPath,
+  storeSession,
+} from "./auth-session";
+
+const store: Record<string, string> = {};
+const localStorageMock = {
+  getItem: jest.fn((key: string) => store[key] ?? null),
+  setItem: jest.fn((key: string, value: string) => {
+    store[key] = value;
+  }),
+  removeItem: jest.fn((key: string) => {
+    delete store[key];
+  }),
+  clear: jest.fn(() => {
+    Object.keys(store).forEach((key) => delete store[key]);
+  }),
+  get length() {
+    return Object.keys(store).length;
+  },
+  key: jest.fn((index: number) => Object.keys(store)[index] ?? null),
+};
+
+function encodeJwtPart(value: object): string {
+  return btoa(JSON.stringify(value))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+}
+
+function createJwt(
+  expiresAt = Math.floor(Date.now() / 1000) + 3600,
+): string {
+  return `${encodeJwtPart({ alg: "HS256", typ: "JWT" })}.${encodeJwtPart({
+    sub: "user-1",
+    email: "user@example.com",
+    role: "user",
+    exp: expiresAt,
+  })}.signature`;
+}
+
+beforeEach(() => {
+  Object.keys(store).forEach((key) => delete store[key]);
+  Object.defineProperty(window, "localStorage", {
+    value: localStorageMock,
+    configurable: true,
+  });
+});
+
+describe("auth-session", () => {
+  it("stores and returns current backend-shaped JWTs", () => {
+    const accessToken = createJwt();
+    const refreshToken = createJwt();
+
+    expect(
+      storeSession({ access_token: accessToken, refresh_token: refreshToken }),
+    ).toBe(true);
+    expect(getValidAccessToken()).toBe(accessToken);
+    expect(getValidRefreshToken()).toBe(refreshToken);
+    expect(getJwtExpiration(accessToken)).toBeGreaterThan(Date.now() / 1000);
+    expect(hasStoredSession()).toBe(true);
+  });
+
+  it("fails closed for expired and malformed access tokens", () => {
+    store["auth-token"] = createJwt(Math.floor(Date.now() / 1000) - 1);
+    expect(getValidAccessToken()).toBeNull();
+
+    store["auth-token"] = "not-a-jwt";
+    expect(getValidAccessToken()).toBeNull();
+    expect(getJwtExpiration("not-a-jwt")).toBeNull();
+  });
+
+  it("removes a stale refresh token when the response has none", () => {
+    store["auth-refresh-token"] = createJwt();
+
+    expect(storeSession({ access_token: createJwt() })).toBe(true);
+    expect(getValidRefreshToken()).toBeNull();
+  });
+
+  it("does not fall back from a malformed canonical refresh token", () => {
+    store["auth-refresh-token"] = "malformed";
+    store["refresh-token"] = createJwt();
+    expect(getValidRefreshToken()).toBeNull();
+  });
+
+  it("rejects an expired session instead of partially storing it", () => {
+    expect(
+      storeSession({
+        access_token: createJwt(Math.floor(Date.now() / 1000) - 1),
+        refresh_token: createJwt(),
+      }),
+    ).toBe(false);
+    expect(hasStoredSession()).toBe(false);
+  });
+
+  it("strips the active locale before locale-aware navigation", () => {
+    expect(resolvePostLoginPath("/fr/settings/security", "fr")).toBe(
+      "/settings/security",
+    );
+    expect(resolvePostLoginPath("/fr?next=1", "fr")).toBe("/?next=1");
+    expect(resolvePostLoginPath("/fr//evil.example", "fr")).toBe("/");
+    expect(resolvePostLoginPath("/fr/\\evil.example", "fr")).toBe("/");
+    expect(resolvePostLoginPath(null, "fr")).toBe("/");
+  });
+
+  it("handles unavailable browser storage without throwing", () => {
+    Object.defineProperty(window, "localStorage", {
+      value: {
+        getItem: jest.fn(() => {
+          throw new Error("blocked");
+        }),
+        setItem: jest.fn(() => {
+          throw new Error("blocked");
+        }),
+        removeItem: jest.fn(() => {
+          throw new Error("blocked");
+        }),
+      },
+      configurable: true,
+    });
+
+    expect(getValidAccessToken()).toBeNull();
+    expect(storeSession({ access_token: createJwt() })).toBe(false);
+    expect(() => clearSession()).not.toThrow();
+  });
+});
diff --git a/frontend/lib/document-mapper.test.ts b/frontend/lib/document-mapper.test.ts
new file mode 100644
index 0000000..e7c6594
--- /dev/null
+++ b/frontend/lib/document-mapper.test.ts
@@ -0,0 +1,36 @@
+const mockDomPurifySanitize = jest.fn();
+
+jest.mock("dompurify", () => ({
+  __esModule: true,
+  default: { sanitize: mockDomPurifySanitize },
+}));
+
+import { toPublicDocumentView } from "./document-mapper";
+
+describe("toPublicDocumentView", () => {
+  it("maps API records without loading the browser sanitizer", () => {
+    const rawDocument = {
+      id: "doc-1",
+      documentHash: "0x123",
+      isVerified: "false",
+      ownerSecret: "private",
+    };
+    const result = toPublicDocumentView(rawDocument);
+
+    expect(result.isVerified).toBe(false);
+    expect(result.documentHash).toBe("0x123");
+    expect((result as { ownerSecret?: string }).ownerSecret).toBeUndefined();
+    expect(mockDomPurifySanitize).not.toHaveBeenCalled();
+  });
+
+  it("accepts only explicit truthy serialized values", () => {
+    expect(
+      toPublicDocumentView({ id: "1", documentHash: "0x1", isVerified: "true" })
+        .isVerified,
+    ).toBe(true);
+    expect(
+      toPublicDocumentView({ id: "2", documentHash: "0x2", isVerified: 1 })
+        .isVerified,
+    ).toBe(true);
+  });
+});
diff --git a/frontend/lib/document-mapper.ts b/frontend/lib/document-mapper.ts
new file mode 100644
index 0000000..be66f17
--- /dev/null
+++ b/frontend/lib/document-mapper.ts
@@ -0,0 +1,36 @@
+/**
+ * Maps untrusted API document records onto the fields intentionally exposed
+ * to the UI. This module has no DOM or sanitizer dependency.
+ */
+
+export interface PublicDocumentView {
+  id: string;
+  documentHash: string;
+  isVerified: boolean;
+  timestamp: string;
+}
+
+interface RawDocument {
+  id: string;
+  documentHash: string;
+  isVerified: boolean | string | number;
+  timestamp?: string;
+}
+
+function toVerified(value: RawDocument["isVerified"]): boolean {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value === 1;
+  if (typeof value === "string") {
+    return value.toLowerCase() === "true" || value === "1";
+  }
+  return false;
+}
+
+export function toPublicDocumentView(doc: RawDocument): PublicDocumentView {
+  return {
+    id: doc.id,
+    documentHash: doc.documentHash,
+    isVerified: toVerified(doc.isVerified),
+    timestamp: doc.timestamp || new Date().toISOString(),
+  };
+}
diff --git a/frontend/lib/document-sanitizer.test.ts b/frontend/lib/document-sanitizer.test.ts
new file mode 100644
index 0000000..6177163
--- /dev/null
+++ b/frontend/lib/document-sanitizer.test.ts
@@ -0,0 +1,83 @@
+import { sanitizeSvg } from "./document-sanitizer";
+
+describe("sanitizeSvg", () => {
+  it("removes active content and unsafe external references", () => {
+    const sanitized = sanitizeSvg(`
+      <svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)">
+        <script>alert(1)</script>
+        <foreignObject><div xmlns="http://www.w3.org/1999/xhtml">html</div></foreignObject>
+        <animate attributeName="href" values="javascript:alert(1)" />
+        <rect width="10" height="10" onclick="alert(1)" fill="url(https://attacker.example/paint)" />
+        <rect width="10" height="10" fill="u\\72l(https://attacker.example/paint)" />
+        <image href="data:image/svg+xml;base64,PHN2Zz48L3N2Zz4=" />
+        <a href="javascript:alert(1)">link</a>
+      </svg>
+    `);
+
+    expect(sanitized).toContain("<rect");
+    expect(sanitized).not.toMatch(
+      /script|foreignObject|animate|onload|onclick|javascript:|data:|attacker\.example/i,
+    );
+  });
+
+  it("preserves ordinary SVG attributes, local references, and CSS URLs", () => {
+    const sanitized = sanitizeSvg(`
+      <svg
+        xmlns="http://www.w3.org/2000/svg"
+        width="120"
+        height="40"
+        viewBox="0 0 120 40"
+        preserveAspectRatio="xMidYMid meet"
+        aria-labelledby="title"
+      >
+        <title id="title">Parcel A &amp; B</title>
+        <defs>
+          <linearGradient id="paint">
+            <stop offset="0" stop-color="#ffffff" />
+          </linearGradient>
+        </defs>
+        <path id="shape" d="M0 0 L120 40" fill="url(#paint)" stroke="#123456" stroke-width="2" />
+        <text aria-label="https://maps.example/Parcel"><textPath href="#shape">Parcel A</textPath></text>
+        <text aria-label="url(https://maps.example/reference)" data-reference="url(https://maps.example/data)">Reference text</text>
+      </svg>
+    `);
+
+    expect(sanitized).toContain('viewBox="0 0 120 40"');
+    expect(sanitized).toContain('preserveAspectRatio="xMidYMid meet"');
+    expect(sanitized).toContain('d="M0 0 L120 40"');
+    expect(sanitized).toContain('fill="url(#paint)"');
+    expect(sanitized).toContain('stroke="#123456"');
+    expect(sanitized).toContain('href="#shape"');
+    expect(sanitized).toContain('aria-label="https://maps.example/Parcel"');
+    expect(sanitized).toContain(
+      'aria-label="url(https://maps.example/reference)"',
+    );
+    expect(sanitized).toContain(
+      'data-reference="url(https://maps.example/data)"',
+    );
+  });
+
+  it("rejects DTD and external entity declarations", () => {
+    expect(() =>
+      sanitizeSvg(`
+        <!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+        <svg xmlns="http://www.w3.org/2000/svg"><text>&xxe;</text></svg>
+      `),
+    ).toThrow("Unsafe SVG declaration");
+  });
+
+  it("serializes predefined XML entities without custom expansion", () => {
+    const sanitized = sanitizeSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg"><text>A &amp; B</text></svg>',
+    );
+
+    expect(sanitized).toContain("A &amp; B");
+    expect(sanitized).not.toContain("A & B");
+  });
+
+  it("rejects non-SVG XML roots", () => {
+    expect(() =>
+      sanitizeSvg('<html xmlns="http://www.w3.org/1999/xhtml"></html>'),
+    ).toThrow("Invalid SVG document");
+  });
+});
diff --git a/frontend/lib/document-sanitizer.ts b/frontend/lib/document-sanitizer.ts
index 565dd9d..6f9b941 100644
--- a/frontend/lib/document-sanitizer.ts
+++ b/frontend/lib/document-sanitizer.ts
@@ -1,22 +1,246 @@
-export interface PublicDocumentView {
-  id: string;
-  documentHash: string;
-  isVerified: boolean;
-  timestamp: string;
+"use client";
+
+import DOMPurify from "dompurify";
+
+/**
+ * Browser-only SVG sanitization for untrusted upload markup. This module owns
+ * active-content removal; scalar values and API response mapping live in
+ * separate modules.
+ */
+
+const SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+const XLINK_NAMESPACE = "http://www.w3.org/1999/xlink";
+const XML_NAMESPACE = "http://www.w3.org/XML/1998/namespace";
+
+const FORBIDDEN_SVG_ELEMENTS = new Set([
+  "script",
+  "foreignobject",
+  "iframe",
+  "object",
+  "embed",
+  "style",
+  "animate",
+  "animatemotion",
+  "animatetransform",
+  "set",
+  "discard",
+  "audio",
+  "video",
+  "handler",
+  "listener",
+  "link",
+  "meta",
+  "image",
+  "feimage",
+  "font-face-uri",
+  "use",
+  "a",
+]);
+
+const ALLOWED_SVG_ELEMENTS = new Set([
+  "svg",
+  "g",
+  "defs",
+  "title",
+  "desc",
+  "path",
+  "rect",
+  "circle",
+  "ellipse",
+  "line",
+  "polyline",
+  "polygon",
+  "text",
+  "tspan",
+  "textpath",
+  "lineargradient",
+  "radialgradient",
+  "stop",
+  "clippath",
+  "pattern",
+  "marker",
+  "symbol",
+  "view",
+  "mask",
+  "filter",
+  "fegaussianblur",
+  "feoffset",
+  "feblend",
+  "fecolormatrix",
+  "fecomponenttransfer",
+  "fecomposite",
+  "fediffuselighting",
+  "feconvolvematrix",
+  "fedisplacementmap",
+  "fedropshadow",
+  "feflood",
+  "fefunca",
+  "fefuncb",
+  "fefuncg",
+  "fefuncr",
+  "femerge",
+  "femergenode",
+  "femorphology",
+  "fepointlight",
+  "fespecularlighting",
+  "fespotlight",
+  "fetile",
+  "feturbulence",
+  "switch",
+  "font",
+  "font-face",
+  "font-face-format",
+  "font-face-name",
+  "glyph",
+  "missing-glyph",
+  "hkern",
+  "vkern",
+  "tref",
+  "cursor",
+]);
+
+const URL_ATTRIBUTES = new Set([
+  "href",
+  "src",
+  "srcset",
+  "action",
+  "formaction",
+  "poster",
+  "background",
+  "codebase",
+  "cite",
+  "icon",
+  "manifest",
+  "profile",
+  "usemap",
+  "ping",
+  "longdesc",
+]);
+
+const CSS_URL_ATTRIBUTES = new Set([
+  "background-image",
+  "clip-path",
+  "color-profile",
+  "cursor",
+  "fill",
+  "filter",
+  "marker-end",
+  "marker-mid",
+  "marker-start",
+  "mask",
+  "stroke",
+]);
+
+function parseSvg(markup: string): SVGSVGElement {
+  const document = new window.DOMParser().parseFromString(
+    markup,
+    "image/svg+xml",
+  );
+  const root = document.documentElement;
+
+  if (
+    document.querySelector("parsererror") ||
+    root.localName.toLowerCase() !== "svg" ||
+    root.namespaceURI !== SVG_NAMESPACE
+  ) {
+    throw new Error("Invalid SVG document");
+  }
+
+  return root as SVGSVGElement;
 }
 
-interface RawDocument {
-  id: string;
-  documentHash: string;
-  isVerified: boolean | string | number;
-  timestamp?: string;
+function isLocalReference(value: string): boolean {
+  return /^#[A-Za-z0-9_.:-]+$/.test(value);
 }
 
-export function toPublicDocumentView(doc: RawDocument): PublicDocumentView {
-  return {
-    id: doc.id,
-    documentHash: doc.documentHash,
-    isVerified: Boolean(doc.isVerified),
-    timestamp: doc.timestamp || new Date().toISOString(),
-  };
+function isLocalCssReference(value: string): boolean {
+  return /^url\(\s*#[A-Za-z0-9_.:-]+\s*\)$/i.test(value.trim());
+}
+
+/** Sanitizes untrusted SVG markup and throws when no DOM sanitizer is available. */
+export function sanitizeSvg(markup: string): string {
+  if (
+    typeof window === "undefined" ||
+    !DOMPurify.isSupported ||
+    typeof window.DOMParser === "undefined" ||
+    typeof window.XMLSerializer === "undefined"
+  ) {
+    throw new Error("SVG sanitization is unavailable");
+  }
+
+  if (
+    /<!\s*(?:DOCTYPE|ENTITY)\b/i.test(markup) ||
+    /<\?(?!xml(?:\s|\?))/i.test(markup)
+  ) {
+    throw new Error("Unsafe SVG declaration");
+  }
+
+  const purified = String(
+    DOMPurify.sanitize(markup, {
+      USE_PROFILES: { svg: true, svgFilters: true },
+      FORBID_TAGS: Array.from(FORBIDDEN_SVG_ELEMENTS),
+      FORBID_ATTR: ["style"],
+      ALLOW_ARIA_ATTR: true,
+      ALLOW_UNKNOWN_PROTOCOLS: false,
+    }),
+  );
+  const root = parseSvg(purified);
+
+  for (const element of [root, ...Array.from(root.querySelectorAll("*"))]) {
+    if (
+      element.namespaceURI !== SVG_NAMESPACE ||
+      FORBIDDEN_SVG_ELEMENTS.has(element.localName.toLowerCase()) ||
+      !ALLOWED_SVG_ELEMENTS.has(element.localName.toLowerCase())
+    ) {
+      element.remove();
+      continue;
+    }
+
+    for (const attribute of Array.from(element.attributes)) {
+      const name = attribute.name.toLowerCase();
+      const localName = attribute.localName.toLowerCase();
+      const value = attribute.value;
+
+      if (name === "xmlns" || name.startsWith("xmlns:")) {
+        const isKnownNamespace =
+          value === SVG_NAMESPACE || value === XLINK_NAMESPACE;
+        if (!isKnownNamespace) element.removeAttributeNode(attribute);
+        continue;
+      }
+
+      if (
+        name.startsWith("on") ||
+        name === "style" ||
+        name === "xml:base" ||
+        (attribute.namespaceURI === XLINK_NAMESPACE && localName !== "href") ||
+        (attribute.namespaceURI === XML_NAMESPACE &&
+          localName !== "space" &&
+          localName !== "lang") ||
+        (attribute.namespaceURI !== null &&
+          attribute.namespaceURI !== XLINK_NAMESPACE &&
+          attribute.namespaceURI !== XML_NAMESPACE)
+      ) {
+        element.removeAttributeNode(attribute);
+        continue;
+      }
+
+      if (URL_ATTRIBUTES.has(localName) && !isLocalReference(value)) {
+        element.removeAttributeNode(attribute);
+        continue;
+      }
+
+      if (CSS_URL_ATTRIBUTES.has(localName)) {
+        const normalizedCssValue = value.replace(/\/\*[\s\S]*?\*\//g, "");
+        if (
+          (normalizedCssValue.includes("\\") ||
+            /\b(?:url|var|attr)\s*\(/i.test(normalizedCssValue)) &&
+          !isLocalCssReference(normalizedCssValue)
+        ) {
+          element.removeAttributeNode(attribute);
+        }
+      }
+    }
+  }
+
+  return new window.XMLSerializer().serializeToString(root);
 }
diff --git a/frontend/lib/sanitize.ts b/frontend/lib/sanitize.ts
index 1908af9..83a7dcc 100644
--- a/frontend/lib/sanitize.ts
+++ b/frontend/lib/sanitize.ts
@@ -1,18 +1,27 @@
+/**
+ * Sanitizers for scalar values rendered by the UI. `sanitizeText` is for
+ * text-only contexts, and `isSafeUrl` is for link targets. Neither function
+ * parses or sanitizes HTML or SVG markup.
+ */
+
 export function sanitizeText(input: string): string {
-  if (!input) return '';
+  if (!input) return "";
   return input
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#x27;');
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#x27;");
 }
 
+/**
+ * Returns true for HTTP(S), mailto, and relative inputs resolved against localhost.
+ */
 export function isSafeUrl(url: string): boolean {
   if (!url) return false;
   try {
-    const parsed = new URL(url, 'http://localhost');
-    return ['http:', 'https:', 'mailto:'].includes(parsed.protocol);
+    const parsed = new URL(url, "http://localhost");
+    return ["http:", "https:", "mailto:"].includes(parsed.protocol);
   } catch {
     return false;
   }
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 1abce39..2c04edf 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -14,6 +14,7 @@
         "@types/leaflet.markercluster": "^1.5.6",
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
+        "dompurify": "^3.4.1",
         "jspdf": "^3.0.1",
         "leaflet": "^1.9.4",
         "leaflet.markercluster": "^1.5.3",
@@ -5880,7 +5881,6 @@
       "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.1.tgz",
       "integrity": "sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw==",
       "license": "(MPL-2.0 OR Apache-2.0)",
-      "optional": true,
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
       }
diff --git a/frontend/package.json b/frontend/package.json
index e2e92e3..fd711c4 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -24,6 +24,7 @@
     "@types/leaflet.markercluster": "^1.5.6",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "dompurify": "^3.4.1",
     "jspdf": "^3.0.1",
     "leaflet": "^1.9.4",
     "leaflet.markercluster": "^1.5.3",
diff --git a/frontend/test-utils/admin-users-mutations.test.tsx b/frontend/test-utils/admin-users-mutations.test.tsx
new file mode 100644
index 0000000..ce9a0e4
--- /dev/null
+++ b/frontend/test-utils/admin-users-mutations.test.tsx
@@ -0,0 +1,94 @@
+import React from "react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import AdminUsersPage from "@/app/[locale]/(protected)/admin/users/page";
+
+const mockRequest = jest.fn();
+const mockRequestRaw = jest.fn();
+
+jest.mock("@/lib/api-client", () => ({
+  ApiError: class ApiError extends Error {},
+  getApiUrl: (path: string) => `http://localhost:3001/api/v1/${path}`,
+  request: (...args: unknown[]) => mockRequest(...args),
+  requestRaw: (...args: unknown[]) => mockRequestRaw(...args),
+}));
+
+jest.mock("@/lib/auth-session", () => ({
+  clearSession: jest.fn(),
+  getJwtClaims: () => ({ role: "admin", sub: "admin-1" }),
+  getValidAccessToken: () => "admin-access-token",
+}));
+
+const users = [
+  {
+    id: "user-1",
+    fullName: "Alice Example",
+    email: "alice@example.com",
+    role: "user",
+    createdAt: "2026-01-01T00:00:00.000Z",
+    lastLoginAt: null,
+    status: "active",
+  },
+  {
+    id: "user-2",
+    fullName: "Bob Example",
+    email: "bob@example.com",
+    role: "user",
+    createdAt: "2026-01-01T00:00:00.000Z",
+    lastLoginAt: null,
+    status: "active",
+  },
+];
+
+function renderPage() {
+  return render(<AdminUsersPage />);
+}
+
+async function selectAliceForDeletion() {
+  fireEvent.click(await screen.findByRole("checkbox", { name: "Select Alice Example" }));
+  fireEvent.click(screen.getByRole("button", { name: "Delete 1 selected" }));
+}
+
+describe("AdminUsersPage bulk deletion", () => {
+  beforeEach(() => {
+    mockRequest.mockReset();
+    mockRequestRaw.mockReset();
+    mockRequest.mockResolvedValue({
+      data: users,
+      total: users.length,
+      page: 1,
+      pageSize: 20,
+    });
+    jest.spyOn(window, "confirm").mockReturnValue(true);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("keeps selected users when a managed deletion fails", async () => {
+    mockRequestRaw.mockRejectedValue(new Error("delete failed"));
+    renderPage();
+
+    await selectAliceForDeletion();
+
+    await waitFor(() => expect(mockRequestRaw).toHaveBeenCalledTimes(1));
+    expect(mockRequestRaw).toHaveBeenCalledWith(
+      "http://localhost:3001/api/v1/users/user-1",
+      { method: "DELETE" },
+    );
+    expect(screen.getByText("alice@example.com")).toBeInTheDocument();
+    expect(screen.getByRole("alert")).toHaveTextContent("delete failed");
+  });
+
+  it("removes selected users only after all managed deletions succeed", async () => {
+    mockRequestRaw.mockResolvedValue({} as Response);
+    renderPage();
+
+    await selectAliceForDeletion();
+
+    await waitFor(() =>
+      expect(screen.queryByText("alice@example.com")).not.toBeInTheDocument(),
+    );
+    expect(screen.getByText("bob@example.com")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/test-utils/notification-bell.test.tsx b/frontend/test-utils/notification-bell.test.tsx
new file mode 100644
index 0000000..d848b6f
--- /dev/null
+++ b/frontend/test-utils/notification-bell.test.tsx
@@ -0,0 +1,99 @@
+import React from "react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import NotificationBell from "@/components/layout/NotificationBell";
+
+const mockRequest = jest.fn();
+const mockRequestRaw = jest.fn();
+const mockRouterPush = jest.fn();
+
+jest.mock("@/lib/api-client", () => ({
+  getApiUrl: (path: string) => `http://localhost:3001/api/v1/${path}`,
+  request: (...args: unknown[]) => mockRequest(...args),
+  requestRaw: (...args: unknown[]) => mockRequestRaw(...args),
+}));
+
+jest.mock("@/i18n/navigation", () => ({
+  useRouter: () => ({ push: mockRouterPush }),
+}));
+
+class MockWebSocket {
+  onmessage: ((event: MessageEvent) => void) | null = null;
+  onerror: (() => void) | null = null;
+  close = jest.fn();
+}
+
+function arrangeUnreadNotification() {
+  mockRequest.mockImplementation((url: string) => {
+    if (url.includes("unread-count")) {
+      return Promise.resolve({ count: 1 });
+    }
+    return Promise.resolve([
+      {
+        id: "notification-1",
+        type: "verification_complete",
+        title: "Verification complete",
+        body: "Your document is ready",
+        read: false,
+        createdAt: new Date().toISOString(),
+      },
+    ]);
+  });
+}
+
+function renderBell() {
+  return render(<NotificationBell />);
+}
+
+describe("NotificationBell", () => {
+  beforeEach(() => {
+    mockRequest.mockReset();
+    mockRequestRaw.mockReset();
+    mockRouterPush.mockReset();
+    Object.defineProperty(globalThis, "WebSocket", {
+      value: MockWebSocket,
+      configurable: true,
+    });
+    arrangeUnreadNotification();
+  });
+
+  it("keeps notifications unread when mark-all-read fails", async () => {
+    mockRequestRaw.mockRejectedValue(new Error("request failed"));
+    renderBell();
+
+    fireEvent.click(
+      await screen.findByRole("button", { name: /notifications, 1 unread/i }),
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Mark all as read" }));
+
+    await waitFor(() => expect(mockRequestRaw).toHaveBeenCalledTimes(1));
+    expect(mockRequestRaw).toHaveBeenCalledWith(
+      "http://localhost:3001/api/v1/notifications/read-all",
+      { method: "PATCH" },
+    );
+    expect(
+      screen.getByRole("button", { name: /notifications, 1 unread/i }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole("button", { name: "Mark all as read" }),
+    ).toBeInTheDocument();
+  });
+
+  it("updates notifications only after mark-all-read succeeds", async () => {
+    mockRequestRaw.mockResolvedValue({} as Response);
+    renderBell();
+
+    fireEvent.click(
+      await screen.findByRole("button", { name: /notifications, 1 unread/i }),
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Mark all as read" }));
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole("button", { name: "Notifications" }),
+      ).toBeInTheDocument();
+      expect(
+        screen.queryByRole("button", { name: "Mark all as read" }),
+      ).not.toBeInTheDocument();
+    });
+  });
+});