diff --git a/scripts/contract-testing.mjs b/scripts/contract-testing.mjs
index 1d0d35fcf..8ac2b1ffc 100644
--- a/scripts/contract-testing.mjs
+++ b/scripts/contract-testing.mjs
@@ -2,8 +2,12 @@ import * as dotenv from 'dotenv';
 dotenv.config();
 
 const SUPABASE_URL = process.env.SUPABASE_URL || "https://pqpdolkaeqlyzpdpbizo.supabase.co";
-// Usando a chave de simulação estável definida para este projeto
-const SERVICE_ROLE_KEY = "a46c3981-244a-4f81-9f57-bab5c45b5cde"; 
+// Chave de simulação SOMENTE via env — nunca hardcoded no repositório.
+const SERVICE_ROLE_KEY = process.env.SIMULATION_BYPASS_KEY || process.env.SUPABASE_SERVICE_ROLE_KEY;
+if (!SERVICE_ROLE_KEY) {
+  console.error("❌ Defina SIMULATION_BYPASS_KEY (ou SUPABASE_SERVICE_ROLE_KEY) no .env antes de rodar o contract-testing.");
+  process.exit(2);
+}
 
 const CONTRACTS = [
   {
diff --git a/scripts/massive-load-test.mjs b/scripts/massive-load-test.mjs
index 56e613847..b241d08a5 100644
--- a/scripts/massive-load-test.mjs
+++ b/scripts/massive-load-test.mjs
@@ -2,7 +2,11 @@ import * as dotenv from 'dotenv';
 dotenv.config();
 
 const SUPABASE_URL = process.env.SUPABASE_URL || "https://pqpdolkaeqlyzpdpbizo.supabase.co";
-const SERVICE_ROLE_KEY = "a46c3981-244a-4f81-9f57-bab5c45b5cde";
+const SERVICE_ROLE_KEY = process.env.SIMULATION_BYPASS_KEY || process.env.SUPABASE_SERVICE_ROLE_KEY;
+if (!SERVICE_ROLE_KEY) {
+  console.error("❌ Defina SIMULATION_BYPASS_KEY (ou SUPABASE_SERVICE_ROLE_KEY) no .env antes de rodar o load-test.");
+  process.exit(2);
+}
 
 const CONCURRENCY = 5;
 const TOTAL_REQUESTS = 25;
diff --git a/src/components/common/EnhancedSpotlight.tsx b/src/components/common/EnhancedSpotlight.tsx
index dad4e1ffc..91ddecdfe 100644
--- a/src/components/common/EnhancedSpotlight.tsx
+++ b/src/components/common/EnhancedSpotlight.tsx
@@ -1,5 +1,5 @@
 import { useState, useEffect, useCallback, useMemo, useRef } from 'react';
-import { useOnboardingContext } from "@/contexts/OnboardingContext";
+import { useOptionalOnboardingContext } from '@/contexts/OnboardingContext';
 import { useNavigate } from 'react-router-dom';
 import { motion, AnimatePresence } from 'framer-motion';
 import Fuse from 'fuse.js';
@@ -19,10 +19,7 @@ export function EnhancedSpotlight() {
   const inputRef = useRef<HTMLInputElement>(null);
   const navigate = useNavigate();
   const { isDev, isAdmin } = useAuth();
-  let onboarding: any = null;
-  try {
-    onboarding = useOnboardingContext();
-  } catch (e) {}
+  const onboarding = useOptionalOnboardingContext();
 
   const handleRestartTour = () => {
     if (onboarding) {
diff --git a/src/components/layout/sidebar/SidebarBrandHeader.tsx b/src/components/layout/sidebar/SidebarBrandHeader.tsx
index f26b93e74..98cb7bef7 100644
--- a/src/components/layout/sidebar/SidebarBrandHeader.tsx
+++ b/src/components/layout/sidebar/SidebarBrandHeader.tsx
@@ -1,7 +1,7 @@
-import { forwardRef } from "react";
-import { AppLogo } from "../AppLogo";
-import { useOnboardingContext } from "@/contexts/OnboardingContext";
-import { useNavigate } from "react-router-dom";
+import { forwardRef } from 'react';
+import { AppLogo } from '../AppLogo';
+import { useOptionalOnboardingContext } from '@/contexts/OnboardingContext';
+import { useNavigate } from 'react-router-dom';
 
 interface SidebarBrandHeaderProps {
   isCollapsed: boolean;
@@ -10,13 +10,10 @@ interface SidebarBrandHeaderProps {
 export const SidebarBrandHeader = forwardRef<HTMLDivElement, SidebarBrandHeaderProps>(
   ({ isCollapsed }, ref) => {
     const navigate = useNavigate();
-    let onboarding: any = null;
-    try {
-      onboarding = useOnboardingContext();
-    } catch (e) {}
+    const onboarding = useOptionalOnboardingContext();
 
     const handleLogoClick = () => {
-      navigate("/");
+      navigate('/');
       if (onboarding && !isCollapsed) {
         onboarding.restartTour();
       }
@@ -24,18 +21,18 @@ export const SidebarBrandHeader = forwardRef<HTMLDivElement, SidebarBrandHeaderP
 
     if (isCollapsed) {
       return (
-        <div ref={ref} className="flex flex-col items-center justify-center py-6 mb-2">
+        <div ref={ref} className="mb-2 flex flex-col items-center justify-center py-6">
           <AppLogo showText={false} variant="sidebar" onClick={handleLogoClick} />
         </div>
       );
     }
 
     return (
-      <div ref={ref} className="px-4 py-5 mb-2">
+      <div ref={ref} className="mb-2 px-4 py-5">
         <AppLogo variant="sidebar" textClassName="text-sm" onClick={handleLogoClick} />
       </div>
     );
-  }
+  },
 );
 
-SidebarBrandHeader.displayName = "SidebarBrandHeader";
+SidebarBrandHeader.displayName = 'SidebarBrandHeader';
diff --git a/src/components/ui/ShortcutsHelpDialog.tsx b/src/components/ui/ShortcutsHelpDialog.tsx
index b08d9be5d..ada6c0ce9 100644
--- a/src/components/ui/ShortcutsHelpDialog.tsx
+++ b/src/components/ui/ShortcutsHelpDialog.tsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from "react";
+import { useState, useEffect } from 'react';
 import {
   Dialog,
   DialogContent,
@@ -6,18 +6,27 @@ import {
   DialogTitle,
   DialogDescription,
   DialogFooter,
-} from "@/components/ui/dialog";
-import { Badge } from "@/components/ui/badge";
-import { Button } from "@/components/ui/button";
-import { Command, Search, ShoppingCart, Plus, MessageSquare, Package, SlidersHorizontal, ImagePlus, Calculator, PlayCircle } from "lucide-react";
-import { useOnboardingContext } from "@/contexts/OnboardingContext";
+} from '@/components/ui/dialog';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import {
+  Command,
+  Search,
+  ShoppingCart,
+  Plus,
+  MessageSquare,
+  Package,
+  SlidersHorizontal,
+  ImagePlus,
+  Calculator,
+  PlayCircle,
+  type LucideIcon,
+} from 'lucide-react';
+import { useOptionalOnboardingContext } from '@/contexts/OnboardingContext';
 
 export function ShortcutsHelpDialog() {
   const [open, setOpen] = useState(false);
-  let onboarding: any = null;
-  try {
-    onboarding = useOnboardingContext();
-  } catch (e) {}
+  const onboarding = useOptionalOnboardingContext();
 
   const handleRestartTour = () => {
     if (onboarding) {
@@ -29,74 +38,90 @@ export function ShortcutsHelpDialog() {
   useEffect(() => {
     const handleKeyDown = (e: KeyboardEvent) => {
       // Open with '?' if not in an input
-      if (e.key === "?" && !e.ctrlKey && !e.metaKey && !e.altKey) {
+      if (e.key === '?' && !e.ctrlKey && !e.metaKey && !e.altKey) {
         const target = e.target as HTMLElement;
         const isInput =
-          target.tagName === "INPUT" ||
-          target.tagName === "TEXTAREA" ||
-          target.isContentEditable;
-        
+          target.tagName === 'INPUT' || target.tagName === 'TEXTAREA' || target.isContentEditable;
+
         if (!isInput) {
           setOpen(true);
         }
       }
     };
 
-    window.addEventListener("keydown", handleKeyDown);
-    return () => window.removeEventListener("keydown", handleKeyDown);
+    window.addEventListener('keydown', handleKeyDown);
+    return () => window.removeEventListener('keydown', handleKeyDown);
   }, []);
 
   return (
     <Dialog open={open} onOpenChange={setOpen}>
       <DialogContent className="max-w-2xl border-primary/20 bg-background/95 backdrop-blur-xl">
         <DialogHeader>
-          <div className="flex items-center gap-3 mb-2">
-            <div className="p-2 bg-primary/10 rounded-lg">
+          <div className="mb-2 flex items-center gap-3">
+            <div className="rounded-lg bg-primary/10 p-2">
               <Command className="h-5 w-5 text-primary" />
             </div>
-            <DialogTitle className="text-xl font-display">Atalhos de Teclado</DialogTitle>
+            <DialogTitle className="font-display text-xl">Atalhos de Teclado</DialogTitle>
           </div>
           <DialogDescription>
             Aumente sua produtividade usando os comandos rápidos do sistema.
           </DialogDescription>
         </DialogHeader>
 
-        <div className="grid grid-cols-1 md:grid-cols-2 gap-6 mt-4">
+        <div className="mt-4 grid grid-cols-1 gap-6 md:grid-cols-2">
           {/* Global Group */}
           <div className="space-y-4">
-            <h3 className="text-xs font-bold uppercase tracking-wider text-muted-foreground px-1">Comandos Globais</h3>
+            <h3 className="px-1 text-xs font-bold uppercase tracking-wider text-muted-foreground">
+              Comandos Globais
+            </h3>
             <div className="space-y-3">
-              <ShortcutItem icon={Search} label="Buscar Produto / Comando" keys={["Ctrl", "K"]} />
-              <ShortcutItem icon={MessageSquare} label="Assistente Oracle IA" keys={["Ctrl", "J"]} />
-              <ShortcutItem icon={Plus} label="Novo Orçamento" keys={["Ctrl", "Shift", "N"]} />
-              <ShortcutItem icon={ShoppingCart} label="Abrir Carrinho" keys={["Ctrl", "Shift", "C"]} />
-              <ShortcutItem icon={Command} label="Ver Atalhos" keys={["?"]} />
+              <ShortcutItem icon={Search} label="Buscar Produto / Comando" keys={['Ctrl', 'K']} />
+              <ShortcutItem
+                icon={MessageSquare}
+                label="Assistente Oracle IA"
+                keys={['Ctrl', 'J']}
+              />
+              <ShortcutItem icon={Plus} label="Novo Orçamento" keys={['Ctrl', 'Shift', 'N']} />
+              <ShortcutItem
+                icon={ShoppingCart}
+                label="Abrir Carrinho"
+                keys={['Ctrl', 'Shift', 'C']}
+              />
+              <ShortcutItem icon={Command} label="Ver Atalhos" keys={['?']} />
             </div>
           </div>
 
           {/* Navigation Group (Alt) */}
           <div className="space-y-4">
-            <h3 className="text-xs font-bold uppercase tracking-wider text-muted-foreground px-1">Navegação Rápida</h3>
+            <h3 className="px-1 text-xs font-bold uppercase tracking-wider text-muted-foreground">
+              Navegação Rápida
+            </h3>
             <div className="space-y-3">
-              <ShortcutItem icon={Package} label="Ir para Catálogo" keys={["Alt", "P"]} />
-              <ShortcutItem icon={Plus} label="Novo Orçamento" keys={["Alt", "N"]} />
-              <ShortcutItem icon={SlidersHorizontal} label="Super Filtro" keys={["Alt", "F"]} />
-              <ShortcutItem icon={ImagePlus} label="Gerador de Mockup" keys={["Alt", "M"]} />
-              <ShortcutItem icon={Calculator} label="Simulador" keys={["Alt", "S"]} />
-              <ShortcutItem icon={Package} label="Ir para Meus Kits" keys={["G", "K"]} sub="Sequência" />
+              <ShortcutItem icon={Package} label="Ir para Catálogo" keys={['Alt', 'P']} />
+              <ShortcutItem icon={Plus} label="Novo Orçamento" keys={['Alt', 'N']} />
+              <ShortcutItem icon={SlidersHorizontal} label="Super Filtro" keys={['Alt', 'F']} />
+              <ShortcutItem icon={ImagePlus} label="Gerador de Mockup" keys={['Alt', 'M']} />
+              <ShortcutItem icon={Calculator} label="Simulador" keys={['Alt', 'S']} />
+              <ShortcutItem
+                icon={Package}
+                label="Ir para Meus Kits"
+                keys={['G', 'K']}
+                sub="Sequência"
+              />
             </div>
           </div>
         </div>
 
-        <DialogFooter className="sm:justify-between items-center mt-6 pt-4 border-t border-border/50">
-          <p className="text-[10px] text-muted-foreground italic text-center sm:text-left mb-4 sm:mb-0">
-            Dica: Digite <code className="text-primary font-bold">/</code> na busca para ver comandos operacionais.
+        <DialogFooter className="mt-6 items-center border-t border-border/50 pt-4 sm:justify-between">
+          <p className="mb-4 text-center text-[10px] italic text-muted-foreground sm:mb-0 sm:text-left">
+            Dica: Digite <code className="font-bold text-primary">/</code> na busca para ver
+            comandos operacionais.
           </p>
-          <Button 
-            variant="outline" 
-            size="sm" 
+          <Button
+            variant="outline"
+            size="sm"
             onClick={handleRestartTour}
-            className="gap-2 text-xs h-8 border-primary/20 hover:bg-primary/10"
+            className="h-8 gap-2 border-primary/20 text-xs hover:bg-primary/10"
           >
             <PlayCircle className="h-3.5 w-3.5 text-primary" />
             Reiniciar Tour do Sistema
@@ -107,28 +132,45 @@ export function ShortcutsHelpDialog() {
   );
 }
 
-function ShortcutItem({ icon: Icon, label, keys, sub }: { icon: any, label: string, keys: string[], sub?: string }) {
+function ShortcutItem({
+  icon: Icon,
+  label,
+  keys,
+  sub,
+}: {
+  icon: LucideIcon;
+  label: string;
+  keys: string[];
+  sub?: string;
+}) {
   return (
-    <div className="flex items-center justify-between group">
+    <div className="group flex items-center justify-between">
       <div className="flex items-center gap-2.5">
-        <div className="p-1.5 rounded bg-muted/50 text-muted-foreground group-hover:bg-primary/10 group-hover:text-primary transition-colors">
+        <div className="rounded bg-muted/50 p-1.5 text-muted-foreground transition-colors group-hover:bg-primary/10 group-hover:text-primary">
           <Icon className="h-3.5 w-3.5" />
         </div>
         <div>
           <span className="text-sm font-medium">{label}</span>
-          {sub && <span className="block text-[10px] text-muted-foreground leading-none">{sub}</span>}
+          {sub && (
+            <span className="block text-[10px] leading-none text-muted-foreground">{sub}</span>
+          )}
         </div>
       </div>
-      <div className="flex gap-1 items-center">
+      <div className="flex items-center gap-1">
         {keys.map((key, i) => (
           <span key={i} className="flex items-center">
-            <Badge variant="outline" className="h-5 px-1.5 text-[10px] font-mono bg-muted/30 border-border/50 shadow-sm">
+            <Badge
+              variant="outline"
+              className="h-5 border-border/50 bg-muted/30 px-1.5 font-mono text-[10px] shadow-sm"
+            >
               {key}
             </Badge>
-            {i < keys.length - 1 && <span className="text-[10px] text-muted-foreground px-0.5">+</span>}
+            {i < keys.length - 1 && (
+              <span className="px-0.5 text-[10px] text-muted-foreground">+</span>
+            )}
           </span>
         ))}
       </div>
     </div>
   );
-}
\ No newline at end of file
+}
diff --git a/src/contexts/OnboardingContext.tsx b/src/contexts/OnboardingContext.tsx
index 1d8ad4790..96a6104d3 100644
--- a/src/contexts/OnboardingContext.tsx
+++ b/src/contexts/OnboardingContext.tsx
@@ -1,5 +1,5 @@
-import React, { createContext, useContext } from "react";
-import { useOnboarding as useOnboardingHook } from "@/hooks/ui";
+import React, { createContext, useContext } from 'react';
+import { useOnboarding as useOnboardingHook } from '@/hooks/ui';
 
 type OnboardingContextType = ReturnType<typeof useOnboardingHook>;
 
@@ -7,17 +7,23 @@ const OnboardingContext = createContext<OnboardingContextType | null>(null);
 
 export function OnboardingProvider({ children }: { children: React.ReactNode }) {
   const onboarding = useOnboardingHook();
-  return (
-    <OnboardingContext.Provider value={onboarding}>
-      {children}
-    </OnboardingContext.Provider>
-  );
+  return <OnboardingContext.Provider value={onboarding}>{children}</OnboardingContext.Provider>;
 }
 
 export function useOnboardingContext(): OnboardingContextType {
   const ctx = useContext(OnboardingContext);
   if (!ctx) {
-    throw new Error("useOnboardingContext must be used within OnboardingProvider");
+    throw new Error('useOnboardingContext must be used within OnboardingProvider');
   }
   return ctx;
 }
+
+/**
+ * Variante segura para componentes que podem renderizar antes do
+ * <OnboardingProvider /> (ex.: Sidebar, Spotlight, atalhos globais).
+ * Retorna `null` em vez de lançar — assim os callers param de embrulhar
+ * o hook em try/catch (anti-pattern que viola react-hooks/rules-of-hooks).
+ */
+export function useOptionalOnboardingContext(): OnboardingContextType | null {
+  return useContext(OnboardingContext);
+}
diff --git a/src/hooks/ui/useGlobalShortcuts.ts b/src/hooks/ui/useGlobalShortcuts.ts
index 5cf07652f..914aa08e0 100644
--- a/src/hooks/ui/useGlobalShortcuts.ts
+++ b/src/hooks/ui/useGlobalShortcuts.ts
@@ -1,22 +1,22 @@
 /**
  * Global keyboard shortcuts for power users.
- * 
+ *
  * Registry (complementa os atalhos Alt+* da sidebar):
  * Ctrl/Cmd + K → Focus search (busca inteligente)
  * Ctrl/Cmd + J → Open Flow (assistente IA)
  * Ctrl/Cmd + Shift + N → New quote
  * Ctrl/Cmd + Shift + C → Open cart
  * ? → Help / Restart Tour
- * 
+ *
  * Existing Alt shortcuts (sidebar): Alt+N novo orçamento, Alt+O orçamentos,
  *   Alt+R carrinhos, Alt+P produtos, Alt+F super filtro, Alt+M mockup, Alt+S simulador.
  *   Header: Alt+F favoritos, Alt+C comparar, Alt+T tema.
  */
-import { useEffect, useCallback } from "react";
-import { useNavigate } from "react-router-dom";
-import { useOracleVoiceBridge } from "@/stores/oracleVoiceBridge";
-import { useSearchStore } from "@/stores/useSearchStore";
-import { useOnboardingContext } from "@/contexts/OnboardingContext";
+import { useEffect, useCallback } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { useOracleVoiceBridge } from '@/stores/oracleVoiceBridge';
+import { useSearchStore } from '@/stores/useSearchStore';
+import { useOptionalOnboardingContext } from '@/contexts/OnboardingContext';
 
 interface ShortcutHandlers {
   onSearchFocus?: () => void;
@@ -30,39 +30,33 @@ export function useGlobalShortcuts(handlers?: ShortcutHandlers) {
   const navigate = useNavigate();
   const openOracle = useOracleVoiceBridge((s) => s.openOracle);
   const { open: searchOpen, setOpen: setOpenSearch } = useSearchStore();
-  let onboarding: any = null;
-  try {
-    onboarding = useOnboardingContext();
-  } catch (e) {
-    // Context may not be available outside MainLayout
-  }
+  // Context may not be available outside MainLayout — variante segura.
+  const onboarding = useOptionalOnboardingContext();
 
   const handleKeyDown = useCallback(
     (e: KeyboardEvent) => {
       const isMod = e.metaKey || e.ctrlKey;
       const target = e.target as HTMLElement;
       const isInput =
-        target.tagName === "INPUT" ||
-        target.tagName === "TEXTAREA" ||
-        target.isContentEditable;
+        target.tagName === 'INPUT' || target.tagName === 'TEXTAREA' || target.isContentEditable;
 
       // G then K (within 800ms) → open kit library — no modifier, ignored in inputs
       if (!isMod && !e.altKey && !e.shiftKey && !isInput) {
-        if (e.key === "g" || e.key === "G") {
+        if (e.key === 'g' || e.key === 'G') {
           lastGAt = Date.now();
           return;
         }
-        if ((e.key === "k" || e.key === "K") && Date.now() - lastGAt < 800) {
+        if ((e.key === 'k' || e.key === 'K') && Date.now() - lastGAt < 800) {
           e.preventDefault();
           lastGAt = 0;
-          navigate("/meus-kits");
+          navigate('/meus-kits');
           return;
         }
       }
 
       if (!isMod) {
         // "?" → Ajuda e reiniciar tour se disponível
-        if (e.key === "?" && !isInput) {
+        if (e.key === '?' && !isInput) {
           e.preventDefault();
           if (onboarding) {
             onboarding.restartTour();
@@ -73,7 +67,7 @@ export function useGlobalShortcuts(handlers?: ShortcutHandlers) {
       }
 
       // Ctrl/Cmd + K → Toggle search palette (works even inside inputs)
-      if (e.key === "k" || e.key === "K") {
+      if (e.key === 'k' || e.key === 'K') {
         e.preventDefault();
         const nextState = !searchOpen;
         setOpenSearch(nextState);
@@ -82,31 +76,31 @@ export function useGlobalShortcuts(handlers?: ShortcutHandlers) {
       }
 
       // Ctrl/Cmd + J → Open Flow (no conflict with browser shortcuts)
-      if (e.key === "j" && !isInput) {
+      if (e.key === 'j' && !isInput) {
         e.preventDefault();
         openOracle();
         return;
       }
 
       // Ctrl/Cmd + Shift + N → New quote (Shift avoids browser new-window)
-      if (e.key === "N" && e.shiftKey && !isInput) {
+      if (e.key === 'N' && e.shiftKey && !isInput) {
         e.preventDefault();
-        navigate("/orcamentos/novo");
+        navigate('/orcamentos/novo');
         return;
       }
 
       // Ctrl/Cmd + Shift + C → Open cart
-      if ((e.key === "C" || e.key === "c") && e.shiftKey && !isInput) {
+      if ((e.key === 'C' || e.key === 'c') && e.shiftKey && !isInput) {
         e.preventDefault();
         handlers?.onToggleCart?.();
         return;
       }
     },
-    [navigate, openOracle, handlers, searchOpen, setOpenSearch]
+    [navigate, openOracle, handlers, searchOpen, setOpenSearch],
   );
 
   useEffect(() => {
-    document.addEventListener("keydown", handleKeyDown);
-    return () => document.removeEventListener("keydown", handleKeyDown);
+    document.addEventListener('keydown', handleKeyDown);
+    return () => document.removeEventListener('keydown', handleKeyDown);
   }, [handleKeyDown]);
 }
diff --git a/supabase/functions/_shared/auth.ts b/supabase/functions/_shared/auth.ts
index 7ba9dbfee..983bafa78 100644
--- a/supabase/functions/_shared/auth.ts
+++ b/supabase/functions/_shared/auth.ts
@@ -28,15 +28,15 @@ export async function authenticateRequest(req: Request): Promise<AuthResult> {
   const supabaseAnonKey = Deno.env.get('SUPABASE_ANON_KEY')!;
   const serviceRoleKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!;
   const simulationKey = Deno.env.get('SIMULATION_BYPASS_KEY');
-  // Fallback para chave de simulação de elite (hardcoded para ambiente de dev/teste)
-  const ELITE_SIM_KEY = "a46c3981-244a-4f81-9f57-bab5c45b5cde";
 
   const rawToken = authHeader.slice(7).trim();
   const localServiceClient = createClient(supabaseUrl, serviceRoleKey);
 
-  // ⚡ FAST-PATH: Bypasse para chamadas do sistema (service_role ou simulation)
-  const isServiceRole = (serviceRoleKey && rawToken === serviceRoleKey.trim());
-  const isSimulation = (simulationKey && rawToken === simulationKey.trim()) || (rawToken === ELITE_SIM_KEY);
+  // ⚡ FAST-PATH: Bypasse para chamadas do sistema (service_role ou simulation).
+  // IMPORTANTE: a chave de simulação DEVE vir da env `SIMULATION_BYPASS_KEY` —
+  // qualquer fallback hardcoded vira backdoor visível no repositório.
+  const isServiceRole = !!(serviceRoleKey && rawToken === serviceRoleKey.trim());
+  const isSimulation = !!(simulationKey && rawToken === simulationKey.trim());
   
   if (isServiceRole || isSimulation) {
     return {
diff --git a/supabase/functions/test-contract-orchestrator/index.ts b/supabase/functions/test-contract-orchestrator/index.ts
index f73d16610..94c874b9c 100644
--- a/supabase/functions/test-contract-orchestrator/index.ts
+++ b/supabase/functions/test-contract-orchestrator/index.ts
@@ -23,23 +23,36 @@ Deno.serve(async (req) => {
   const supabase = createClient(supabaseUrl, serviceRoleKey);
 
   const results = [];
-  const SIM_BYPASS = "a46c3981-244a-4f81-9f57-bab5c45b5cde";
+
+  // SIM_BYPASS é resolvido SEMPRE da env / cofre — nunca hardcoded.
+  // Sem chave, o teste de bridge é pulado em vez de expor um backdoor no repo.
+  let SIM_BYPASS: string | null = null;
+  try {
+    const secretRes = await resolveCredential("SIMULATION_BYPASS_KEY", supabase);
+    SIM_BYPASS = secretRes?.value ?? Deno.env.get("SIMULATION_BYPASS_KEY") ?? null;
+  } catch {
+    SIM_BYPASS = Deno.env.get("SIMULATION_BYPASS_KEY") ?? null;
+  }
 
   try {
     // 1. Testar external-db-bridge (Operação de Select Mocado ou Simples)
     const bridgeStart = performance.now();
     try {
+      if (!SIM_BYPASS) {
+        results.push({ name: "external-db-bridge", skipped: "SIMULATION_BYPASS_KEY ausente" });
+      } else {
       const bridgeRes = await fetch(`${supabaseUrl}/functions/v1/external-db-bridge`, {
         method: "POST",
         headers: { "Authorization": `Bearer ${SIM_BYPASS}`, "Content-Type": "application/json" },
         body: JSON.stringify({ operation: "select", table: "products", limit: 1 })
       });
-      results.push({ 
-        name: "external-db-bridge", 
-        status: bridgeRes.status, 
-        ok: bridgeRes.ok, 
-        latency: performance.now() - bridgeStart 
+      results.push({
+        name: "external-db-bridge",
+        status: bridgeRes.status,
+        ok: bridgeRes.ok,
+        latency: performance.now() - bridgeStart
       });
+      }
     } catch (e) {
       results.push({ name: "external-db-bridge", error: String(e) });
     }
@@ -51,6 +64,12 @@ Deno.serve(async (req) => {
       // Usar o segredo que inserimos no DB via resolveCredential para assinar corretamente
       const secretRes = await resolveCredential("SIMULATION_BYPASS_KEY", supabase);
       const secret = secretRes.value || SIM_BYPASS;
+      if (!secret) {
+        results.push({ name: "webhook-inbound", skipped: "SIMULATION_BYPASS_KEY ausente" });
+        return new Response(JSON.stringify({ results }, null, 2), {
+          headers: { ...corsHeaders, "Content-Type": "application/json" },
+        });
+      }
       const signature = "sha256=" + await hmacSign(JSON.stringify(payload), secret);