diff --git a/pom.xml b/pom.xml
index c135592..aafe34c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,7 +26,7 @@
         <maven.compiler.release>${java.version}</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-        <spring-boot.version>3.5.14-SNAPSHOT</spring-boot.version>
+        <spring-boot.version>3.5.16</spring-boot.version>
         <mybatis-spring-boot.version>3.0.5</mybatis-spring-boot.version>
         <lombok.version>1.18.44</lombok.version>
         <maven-clean-plugin.version>3.4.1</maven-clean-plugin.version>
@@ -205,28 +205,19 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>12.2.2</version>
+                <configuration>
+                    <autoUpdate>false</autoUpdate>
+                    <failBuildOnCVSS>7</failBuildOnCVSS>
+                    <skipProvidedScope>true</skipProvidedScope>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
-    <repositories>
-        <repository>
-            <id>spring-snapshots</id>
-            <name>Spring Snapshots</name>
-            <url>https://repo.spring.io/snapshot</url>
-            <releases>
-                <enabled>false</enabled>
-            </releases>
-        </repository>
-    </repositories>
-    <pluginRepositories>
-        <pluginRepository>
-            <id>spring-snapshots</id>
-            <name>Spring Snapshots</name>
-            <url>https://repo.spring.io/snapshot</url>
-            <releases>
-                <enabled>false</enabled>
-            </releases>
-        </pluginRepository>
-    </pluginRepositories>
+
 
     <profiles>
         <profile>
diff --git a/src/main/resources/application-dev.properties b/src/main/resources/application-dev.properties
new file mode 100644
index 0000000..074828d
--- /dev/null
+++ b/src/main/resources/application-dev.properties
@@ -0,0 +1,3 @@
+# dev 전용 오버라이드 (spring.profiles.active=dev 시 자동 로드)
+# MyBatis SQL/파라미터 디버깅 — dev 한정
+logging.level.org.apache.ibatis=TRACE
diff --git a/src/main/resources/application-live.properties b/src/main/resources/application-live.properties
new file mode 100644
index 0000000..250a8d6
--- /dev/null
+++ b/src/main/resources/application-live.properties
@@ -0,0 +1,3 @@
+# live(운영) 전용 오버라이드 (spring.profiles.active=live 시 자동 로드)
+# HTTPS 운영 — 세션 쿠키 Secure 강제
+server.servlet.session.cookie.secure=true
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 3207daa..524b0b2 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -25,6 +25,10 @@ app.webgl.frame-ancestors=self
 # upload storage (static 트리 밖 — 웹서버 직접 서빙 차단, 컨트롤러 권한게이트 경유)
 app.upload.game-storage-path=${user.home}/.bibimbap/uploads
 
+# session cookie hardening
+server.servlet.session.cookie.http-only=true
+server.servlet.session.cookie.same-site=lax
+
 # log
 mybatis.configuration.log-impl=org.apache.ibatis.logging.slf4j.Slf4jImpl
-logging.level.org.apache.ibatis=TRACE
+logging.level.org.apache.ibatis=WARN