diff --git a/backend/app/core/middleware.py b/backend/app/core/middleware.py
index 5ec606f..c8a72b9 100644
--- a/backend/app/core/middleware.py
+++ b/backend/app/core/middleware.py
@@ -24,7 +24,7 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         
         # Strict Transport Security (HTTPS only)
         # Note: Only enable in production with HTTPS
-        if not request.url.hostname in ["localhost", "127.0.0.1"]:
+        if request.url.hostname not in ["localhost", "127.0.0.1"]:
             response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
         
         # Content Security Policy (adjust based on frontend needs)
diff --git a/backend/tests/conftest.py b/backend/tests/conftest.py
index 5fb965c..08b8a8f 100644
--- a/backend/tests/conftest.py
+++ b/backend/tests/conftest.py
@@ -18,12 +18,8 @@ from app.core.security import get_password_hash, create_access_token
 TEST_DATABASE_URL = settings.DATABASE_URL.replace("/pop3_forwarder", "/pop3_forwarder_test")
 
 
-@pytest.fixture(scope="session")
-def event_loop() -> Generator:
-    """Create event loop for async tests"""
-    loop = asyncio.get_event_loop_policy().new_event_loop()
-    yield loop
-    loop.close()
+# Note: event_loop fixture removed - pytest-asyncio provides this automatically
+# when asyncio_mode = auto is set in pytest.ini
 
 
 @pytest.fixture(scope="function")
diff --git a/docs/ERRORS.md b/docs/ERRORS.md
index eec59b9..d7439f4 100644
--- a/docs/ERRORS.md
+++ b/docs/ERRORS.md
@@ -292,7 +292,7 @@ class ErrorResponse(BaseModel):
     code: str  # e.g., "MAIL_100"
     message: str  # Human-readable message
     details: dict = {}  # Additional context
-    timestamp: datetime = Field(default_factory=datetime.utcnow)
+    timestamp: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
     request_id: str = ""  # For tracing
 ```