diff --git a/docs/AUDIT_REDESIGN.md b/docs/AUDIT_REDESIGN.md
index a6b19de..878dd41 100644
--- a/docs/AUDIT_REDESIGN.md
+++ b/docs/AUDIT_REDESIGN.md
@@ -41,7 +41,7 @@ Status: ⬜ open · 🟦 in PR · ✅ fixed (commit hash on the right).
 
 | #   | Issue                                                                                                                              | Severity | Status | Fix commit |
 | --- | ---------------------------------------------------------------------------------------------------------------------------------- | :------: | :----: | ---------- |
-| C1  | Backend posts arbitrary user JS (`strategyCode`) to `/api/backtest` if A1+A2 are "fixed" naively. Must sandbox or refuse.            | 🔴       | ⬜     |            |
+| C1  | Backend posts arbitrary user JS (`strategyCode`) to `/api/backtest` if A1+A2 are "fixed" naively. Must sandbox or refuse.            | 🔴       | ✅     | 6aa001a    |
 | C2  | No FMP response cache. Free tier = 250 req/day. Every Home view load = 3 req. 80 page loads/day → quota burnt by lunch.            | 🟠       | ✅     | 0828007    |
 | C3  | `/api/screener` passes `sector` query through to FMP without an allow-list. Low-impact injection, but should validate.              | 🟡       | ⬜     |            |
 | C4  | `/api/news` passes `symbols` through to Alpaca without validation.                                                                  | 🟡       | ⬜     |            |