diff --git a/docs/AUDIT_REDESIGN.md b/docs/AUDIT_REDESIGN.md
index 218d837..87e180f 100644
--- a/docs/AUDIT_REDESIGN.md
+++ b/docs/AUDIT_REDESIGN.md
@@ -43,7 +43,7 @@ Status: ⬜ open · 🟦 in PR · ✅ fixed (commit hash on the right).
 | --- | ---------------------------------------------------------------------------------------------------------------------------------- | :------: | :----: | ---------- |
 | C1  | Backend posts arbitrary user JS (`strategyCode`) to `/api/backtest` if A1+A2 are "fixed" naively. Must sandbox or refuse.            | 🔴       | ✅     | 6aa001a    |
 | C2  | No FMP response cache. Free tier = 250 req/day. Every Home view load = 3 req. 80 page loads/day → quota burnt by lunch.            | 🟠       | ✅     | 0828007    |
-| C3  | `/api/screener` passes `sector` query through to FMP without an allow-list. Low-impact injection, but should validate.              | 🟡       | ⬜     |            |
+| C3  | `/api/screener` passes `sector` query through to FMP without an allow-list. Low-impact injection, but should validate.              | 🟡       | ✅     | c173aeb    |
 | C4  | `/api/news` passes `symbols` through to Alpaca without validation.                                                                  | 🟡       | ⬜     |            |
 | C5  | Header `fetchMarketIndices` polls every 60 s even when the tab is hidden. Should pause via `document.visibilityState`.              | 🟡       | ⬜     |            |
 | C6  | `backend/.env.example` keeps `FMP_API_KEY=demo` AND `apiServer.ts` falls back to `'demo'`. Two sources of truth. Demo key is shared globally and rate-limited.  | 🟡       | ⬜     |            |