Worked on the pretix/pretix repository to deliver two key security features focused on backend robustness. Developed a modular Content-Security-Policy (CSP) header system in Python, introducing structured placeholder replacement to prevent format-string vulnerabilities and domain injection, while adding a sanitization layer to filter invalid characters. Enhanced maintainability by removing redundant exemption logic and implemented comprehensive unit tests to verify CSP rendering and merging. Additionally, strengthened staff impersonation session management by enforcing stricter session validation and integrating detailed logging, ensuring secure tracking and invalidation of staff sessions. The work emphasized middleware, security, and unit testing within a Django backend environment.