diff --git a/Dockerfile b/Dockerfile
index a8c5e24..bd737ae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,6 +45,8 @@ RUN apt-get update \
       /var/lib/apt/lists/* \
       /var/tmp/*
 
+RUN useradd -ms /bin/bash fgc
+
 # RUN node --version
 # RUN npm --version
 
@@ -61,10 +63,16 @@ RUN npm install
 # From 1.38 Playwright will no longer install browser automatically for playwright, but apparently still for playwright-firefox: https://github.com/microsoft/playwright/releases/tag/v1.38.0
 # RUN npx playwright install firefox
 
-COPY . .
+# Only copy the files we actually need in the image to avoid accidentally adding secrets.
+COPY *.js ./
+COPY eslint.config.js jsconfig.json sonar-project.properties ./
+COPY src ./src
+COPY test ./test
+COPY docker-entrypoint.sh ./
 
 # Shell scripts need Linux line endings. On Windows, git might be configured to check out dos/CRLF line endings, so we convert them for those people in case they want to build the image. They could also use --config core.autocrlf=input
 RUN dos2unix ./*.sh && chmod +x ./*.sh
+RUN chown -R fgc:fgc /fgc
 COPY docker-entrypoint.sh /usr/local/bin/
 
 ARG COMMIT=""
@@ -87,8 +95,9 @@ LABEL org.opencontainers.image.title="free-games-claimer" \
 # Configure VNC via environment variables:
 ENV VNC_PORT 5900
 ENV NOVNC_PORT 6080
-EXPOSE 5900
-EXPOSE 6080
+# Ports are not exposed by default; publish explicitly with -p when you really need GUI access.
+# EXPOSE 5900
+# EXPOSE 6080
 
 # Configure Xvfb via environment variables:
 ENV WIDTH 1920
@@ -98,6 +107,8 @@ ENV DEPTH 24
 # Show browser instead of running headless
 ENV SHOW 1
 
+USER fgc
+
 # Script to setup display server & VNC is always executed.
 ENTRYPOINT ["docker-entrypoint.sh"]
 # Default command to run. This is replaced by appending own command, e.g. `docker run ... node prime-gaming` to only run this script.
diff --git a/aliexpress.js b/aliexpress.js
index 6d654d3..f10dc46 100644
--- a/aliexpress.js
+++ b/aliexpress.js
@@ -40,7 +40,7 @@ const auth = async url => {
   console.log('auth', url);
   await page.goto(url, { waitUntil: 'domcontentloaded' });
   // redirects to https://login.aliexpress.com/?return_url=https%3A%2F%2Fwww.aliexpress.com%2Fp%2Fcoin-pc-index%2Findex.html
-  await Promise.any([page.waitForURL(/.*login\.aliexpress.com.*/).then(async () => {
+  await Promise.any([page.waitForURL(url => url.includes('login.aliexpress.com')).then(async () => {
     // manual login
     console.error('Not logged in! Will wait for 120s for you to login...');
     // await page.waitForTimeout(120*1000);
diff --git a/prime-gaming.js b/prime-gaming.js
index 0c982bd..00e8466 100644
--- a/prime-gaming.js
+++ b/prime-gaming.js
@@ -385,7 +385,9 @@ try {
     const detailLoc = page.locator('[data-a-target="DescriptionItemDetails"], [data-testid="DescriptionItemDetails"]');
     if (await detailLoc.count()) {
       const item_text = await detailLoc.first().innerText();
-      store = item_text.toLowerCase().replace(/.* on /, '').slice(0, -1);
+      const lower = item_text.toLowerCase();
+      const onPos = lower.lastIndexOf(' on ');
+      if (onPos >= 0) store = lower.slice(onPos + 4).replace(/[.!]$/, '');
     } else if (url.includes('/claims/')) {
       const slug = url.split('/claims/')[1]?.split('/')[0] || '';
       if (slug.includes('gog')) store = 'gog.com';
diff --git a/src/util.js b/src/util.js
index 0709e21..df6a29a 100644
--- a/src/util.js
+++ b/src/util.js
@@ -121,10 +121,11 @@ export const notify = html => new Promise(resolve => {
     if (cfg.debug) console.debug('notify: NOTIFY is not set!');
     return resolve();
   }
+  const appriseBin = process.env.APPRISE_BIN || '/usr/local/bin/apprise';
   const args = [cfg.notify, '-i', 'html', '-b', `'${html}'`];
   if (cfg.notify_title) args.push('-t', cfg.notify_title);
-  if (cfg.debug) console.debug(`apprise ${args.join(' ')}`); // this also doesn't escape, but it's just for info
-  execFile('apprise', args, (error, stdout, stderr) => {
+  if (cfg.debug) console.debug(`${appriseBin} ${args.join(' ')}`); // this also doesn't escape, but it's just for info
+  execFile(appriseBin, args, (error, stdout, stderr) => {
     if (error) {
       console.log(`error: ${error.message}`);
       if (error.message.includes('command not found')) {
diff --git a/src/version.js b/src/version.js
index cd054d8..b5cf838 100644
--- a/src/version.js
+++ b/src/version.js
@@ -1,10 +1,12 @@
 // check if running the latest version
 
 import { log } from 'console';
-import { execFile } from 'child_process';
+import { execFile } from 'node:child_process';
+
+const gitBin = process.env.GIT_BIN || '/usr/bin/git';
 
 const runGit = (...args) => new Promise((resolve, reject) => {
-  execFile('git', args, { cwd: process.cwd() }, (error, stdout, stderr) => {
+  execFile(gitBin, args, { cwd: process.cwd() }, (error, stdout, stderr) => {
     if (stderr) console.error(`stderr: ${stderr}`);
     // if (stdout) console.log(`stdout: ${stdout}`);
     if (error) {