diff --git a/app/templates/security.php b/app/templates/security.php
index df4d5fc..0d071be 100644
--- a/app/templates/security.php
+++ b/app/templates/security.php
@@ -35,6 +35,7 @@
                                 </div>
                                 <div class="card-body">
                                     <form method="POST" class="mb-4">
+<?php include 'csrf_token.php'; ?>
                                         <input type="hidden" name="action" value="add_whitelist">
                                         <div class="row g-3">
                                             <div class="col-md-4">
@@ -76,6 +77,7 @@
                                                 <td><?= htmlspecialchars($ip['created_at']) ?></td>
                                                 <td>
                                                     <form method="POST" style="display: inline;">
+<?php include 'csrf_token.php'; ?>
                                                         <input type="hidden" name="action" value="remove_whitelist">
                                                         <input type="hidden" name="ip_address" value="<?= htmlspecialchars($ip['ip_address']) ?>">
                                                         <button type="submit" class="btn btn-sm btn-danger" onclick="return confirm('Are you sure you want to remove this IP from whitelist?')">Remove</button>
@@ -102,6 +104,7 @@
                                 </div>
                                 <div class="card-body">
                                     <form method="POST" class="mb-4">
+<?php include 'csrf_token.php'; ?>
                                         <input type="hidden" name="action" value="add_blacklist">
                                         <div class="row g-3">
                                             <div class="col-md-3">
@@ -148,6 +151,7 @@
                                                 <td><?= $ip['expiry_time'] ? htmlspecialchars($ip['expiry_time']) : 'Never' ?></td>
                                                 <td>
                                                     <form method="POST" style="display: inline;">
+<?php include 'csrf_token.php'; ?>
                                                         <input type="hidden" name="action" value="remove_blacklist">
                                                         <input type="hidden" name="ip_address" value="<?= htmlspecialchars($ip['ip_address']) ?>">
                                                         <button type="submit" class="btn btn-sm btn-danger" onclick="return confirm('Are you sure you want to remove this IP from blacklist?')">Remove</button>
@@ -198,7 +202,7 @@
                                         <tbody>
 <?php $stmt = $rateLimiter->db->prepare("
     SELECT ip_address, username, attempted_at
-    FROM {$rateLimiter->ratelimitTable}
+    FROM {$rateLimiter->authRatelimitTable}
     ORDER BY attempted_at DESC
     LIMIT 10
 ");