diff --git a/backend/app/api/v1/endpoints/audit.py b/backend/app/api/v1/endpoints/audit.py
index 420ff97..2ddea5d 100644
--- a/backend/app/api/v1/endpoints/audit.py
+++ b/backend/app/api/v1/endpoints/audit.py
@@ -491,7 +491,7 @@ async def get_security_analysis(
             AuditLog.tenant_id == current_tenant.id,
             AuditLog.action == 'user.update',
             AuditLog.created_at >= analysis_start,
-            AuditLog.new_values.contains('"role"')
+            AuditLog.new_values.op('?')('role')
         )
     ).group_by(User.email).having(func.count(AuditLog.id) >= 3)
     
diff --git a/backend/app/middleware/tenant.py b/backend/app/middleware/tenant.py
index 11aa855..45e8811 100644
--- a/backend/app/middleware/tenant.py
+++ b/backend/app/middleware/tenant.py
@@ -24,10 +24,17 @@ class TenantMiddleware(BaseHTTPMiddleware):
     EXCLUDED_PATHS = {
         "/health",
         "/",
+        "/api/v1/auth/login",
         "/v1/auth/login",
         "/docs",
+        "/api/v1/docs",
+        "/v1/docs",
         "/openapi.json",
-        "/redoc"
+        "/api/v1/openapi.json",
+        "/v1/openapi.json",
+        "/redoc",
+        "/api/v1/redoc",
+        "/v1/redoc"
     }
     
     async def dispatch(self, request: Request, call_next) -> Response: