diff --git a/scripts/prepublish.ts b/scripts/prepublish.ts
index 500c280526..199c76c68d 100644
--- a/scripts/prepublish.ts
+++ b/scripts/prepublish.ts
@@ -9,7 +9,7 @@
  * Run with: node scripts/prepublish.mjs
  */
 
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
@@ -19,6 +19,7 @@ import {
   readFileSync,
   readdirSync,
   statSync,
+  chmodSync,
 } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -33,6 +34,8 @@ import {
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const ROOT = join(__dirname, "..");
+const NPM_BIN = process.platform === "win32" ? "npm.cmd" : "npm";
+const NPX_BIN = process.platform === "win32" ? "npx.cmd" : "npx";
 
 const APP_DIR = join(ROOT, "app");
 
@@ -113,7 +116,7 @@ if (existsSync(APP_DIR)) {
 
 // ── Step 2: Install dependencies ───────────────────────────
 console.log("  📦 Installing dependencies...");
-execSync("npm install", { cwd: ROOT, stdio: "inherit" });
+execFileSync(NPM_BIN, ["install"], { cwd: ROOT, stdio: "inherit" });
 
 // ── Step 2.5: Remove app/ directory before build ───────────
 // CRITICAL: The postinstall script may create app/node_modules/@swc/helpers/,
@@ -130,7 +133,7 @@ if (existsSync(APP_DIR)) {
 console.log("  🏗️  Building Next.js (standalone)...");
 const nextBuildBundlerFlag =
   process.env.OMNIROUTE_USE_TURBOPACK === "1" ? "--turbopack" : "--webpack";
-execSync(`npx next build ${nextBuildBundlerFlag}`, {
+execFileSync(NPX_BIN, ["next", "build", nextBuildBundlerFlag], {
   cwd: ROOT,
   stdio: "inherit",
   env: {
@@ -360,7 +363,10 @@ if (existsSync(mitmSrc)) {
   writeFileSync(tmpTsconfigPath, JSON.stringify(mitmTsconfig, null, 2));
 
   try {
-    execSync("npx tsc -p tsconfig.mitm.tmp.json", { cwd: ROOT, stdio: "inherit" });
+    execFileSync(NPX_BIN, ["tsc", "-p", "tsconfig.mitm.tmp.json"], {
+      cwd: ROOT,
+      stdio: "inherit",
+    });
     const mitmServerSrc = join(mitmSrc, "server.cjs");
     if (existsSync(mitmServerSrc)) {
       cpSync(mitmServerSrc, join(mitmDest, "server.cjs"));
@@ -387,8 +393,17 @@ if (existsSync(mcpSrcFile)) {
   console.log("  🔨 Bundling MCP Server (TypeScript → JavaScript)...");
   mkdirSync(mcpDestDir, { recursive: true });
   try {
-    execSync(
-      `npx esbuild open-sse/mcp-server/server.ts --bundle --platform=node --packages=external --format=esm --outfile=app/open-sse/mcp-server/server.js`,
+    execFileSync(
+      NPX_BIN,
+      [
+        "esbuild",
+        "open-sse/mcp-server/server.ts",
+        "--bundle",
+        "--platform=node",
+        "--packages=external",
+        "--format=esm",
+        "--outfile=app/open-sse/mcp-server/server.js",
+      ],
       { cwd: ROOT, stdio: "inherit" }
     );
     console.log("  ✅ MCP Server bundled to app/open-sse/mcp-server/server.js");
@@ -404,11 +419,20 @@ const cliDestFile = join(ROOT, "bin", "omniroute.mjs");
 if (existsSync(cliSrcFile)) {
   console.log("  🔨 Bundling CLI Entrypoint (TypeScript → JavaScript)...");
   try {
-    execSync(
-      `npx esbuild bin/omniroute.ts --bundle --platform=node --packages=external --format=esm --outfile=bin/omniroute.mjs`,
+    execFileSync(
+      NPX_BIN,
+      [
+        "esbuild",
+        "bin/omniroute.ts",
+        "--bundle",
+        "--platform=node",
+        "--packages=external",
+        "--format=esm",
+        "--outfile=bin/omniroute.mjs",
+      ],
       { cwd: ROOT, stdio: "inherit" }
     );
-    execSync(`chmod +x bin/omniroute.mjs`, { cwd: ROOT });
+    chmodSync(cliDestFile, 0o755);
     console.log("  ✅ CLI Entrypoint bundled to bin/omniroute.mjs");
   } catch (err: any) {
     console.warn("  ⚠️  CLI bundle error:", err.message);
diff --git a/sonar-project.properties b/sonar-project.properties
index d5d727bd9d..42746bc679 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,4 +1,10 @@
 sonar.projectKey=diegosouzapw_OmniRoute
 sonar.organization=diegosouzapw
 sonar.sourceEncoding=UTF-8
+sonar.sources=src,open-sse,scripts,bin,next.config.mjs,Dockerfile
+sonar.tests=tests
+sonar.test.inclusions=tests/**/*.test.ts,tests/**/*.spec.ts
+sonar.exclusions=tests/**,src/i18n/messages/**,docs/**,coverage/**,.next/**,dist/**,build/**,node_modules/**
 sonar.javascript.lcov.reportPaths=coverage/lcov.info
+sonar.coverage.exclusions=**/*
+sonar.cpd.exclusions=**/*
diff --git a/src/server/cors/origins.ts b/src/server/cors/origins.ts
index 39fa792cef..2c1759f216 100644
--- a/src/server/cors/origins.ts
+++ b/src/server/cors/origins.ts
@@ -50,7 +50,11 @@ function parseOriginList(value: string | null | undefined): Set<string> {
 }
 
 function normalizeOrigin(origin: string): string {
-  return origin.toLowerCase().replace(/\/+$/, "");
+  let normalized = origin.toLowerCase();
+  while (normalized.endsWith("/")) {
+    normalized = normalized.slice(0, -1);
+  }
+  return normalized;
 }
 
 function envAllowAll(): boolean {