diff --git a/bugs.md b/bugs.md
index d86543fd..9322ac1c 100644
--- a/bugs.md
+++ b/bugs.md
@@ -180,30 +180,6 @@ tokens_to_expire = Repo.all_by(UserToken, user_id: user.id)
 
 ---
 
-### C11. BY DESIGN — No `force_ssl` in Production
-
-**File:** `config/prod.exs:41` — relies on Cloudflared proxy
-
-**Severity:** CRITICAL — HTTP downgrade / cleartext traffic risk
-
-**Description:** If Cloudflared is misconfigured, traffic arrives over plain HTTP with no redirect. No HSTS headers. Session cookies / API tokens sent in cleartext.
-
-**Fix:** Enable `force_ssl: [hsts: true]` in production endpoint config.
-
----
-
-### C12. FALSE POSITIVE — Race Condition in Device Quota Check
-
-**Files:** `lib/towerops/devices.ex:539-578, 586-598`
-
-**Severity:** CRITICAL — Concurrent device creation bypasses subscription limits
-
-**Description:** `create_device` locks org row with `FOR UPDATE` but this doesn't serialize inserts into the `devices` table. Two concurrent calls both pass quota check (same count), then both insert.
-
-**Fix:** Use `pg_advisory_xact_lock` keyed on `organization_id`, or move device count into the organization row.
-
----
-
 ### C13. ✓ FIXED — MikroTik Credentials Broadcast Over PubSub
 
 **File:** `lib/towerops/workers/mikrotik_backup_worker.ex:95-98`