diff --git a/app/controllers/auth.controller.js b/app/controllers/auth.controller.js
index 6e49762..ef70e58 100644
--- a/app/controllers/auth.controller.js
+++ b/app/controllers/auth.controller.js
@@ -3,6 +3,7 @@ const bcrypt = require("bcryptjs");
 const jwt = require("jsonwebtoken");
 require("dotenv").config();
 const sanitize = require("sanitize-html");
+const logger = require("../services/logger");
 
 const User = db.user;
 const EstablishmentUser = db.EstablishmentUser;
@@ -79,9 +80,9 @@ exports.login = async (req, res) => {
 
     res.cookie("auth_token", token, {
       httpOnly: true,
-      secure: isProd,               // only true in production (HTTPS)
-      sameSite: isProd ? "none" : "lax", // 'none' requires HTTPS, so use 'lax' locally
-      maxAge: 6 * 60 * 60 * 1000,   // 6 hours
+      secure: isProd,               
+      sameSite: isProd ? "none" : "lax", 
+      maxAge: 6 * 60 * 60 * 1000,   
     });
 
 
@@ -95,9 +96,10 @@ exports.login = async (req, res) => {
     // return res.status(200).json({ status: "success", message: "Login successful", data: token });
     
   } catch (err) {
+    logger.error(err.message);
     return res.status(500).json({
       status: "failed",
-      message: err.message,
+      message: "Internal server error",
     });
   }
 };
diff --git a/app/controllers/establishment.controller.js b/app/controllers/establishment.controller.js
index a5506ef..dc5205f 100644
--- a/app/controllers/establishment.controller.js
+++ b/app/controllers/establishment.controller.js
@@ -20,6 +20,7 @@ const { version } = require("os");
 const sequelize = db.sequelize;
 const { sanitizeForLog } = require("../utils/sanitize");
 const sanitize = require("sanitize-html");
+const crypto = require('crypto');
 
 const sanitizeStringValue = (value) =>
   typeof value === "string"
@@ -1472,7 +1473,17 @@ exports.establishmentBulkUpload = async (req, res) => {
         created_by: req.user.id
       }, { transaction: transaction });
 
-      const autoPassword = Math.random().toString(36).slice(-10);
+      const generateSecurePassword = (length = 12) => {
+      const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@#$%';
+      let password = '';
+      const randomBytes = crypto.randomBytes(length);      
+      for (let i = 0; i < length; i++) {
+        password += chars[randomBytes[i] % chars.length];
+      }      
+      return password;
+    };
+
+      const autoPassword = generateSecurePassword(12);
       const hashed = await bcrypt.hash(autoPassword, 10);
 
       await EstablishmentUser.create({
diff --git a/app/controllers/establishment_user.controller.js b/app/controllers/establishment_user.controller.js
index 7eab21c..4350741 100644
--- a/app/controllers/establishment_user.controller.js
+++ b/app/controllers/establishment_user.controller.js
@@ -177,7 +177,7 @@ exports.updateUser = async (req, res) => {
     return res.status(200).send({'status':"success",'message':"Record updated successfully",'data': "" }); 
 
   } catch (err) {
-    logger.error('Error on updating user', { error: err.message });
+    logger.error('Error on updating user:', err.message );
     return res.status(500).send({'status':"failed",'message': "Internal server error" });
   }
 };
@@ -191,16 +191,14 @@ exports.changeUserPassword = async (req, res) => {
     // Validate inputs
     if (!old_password || !new_password || !confirm_password) {
       return res.status(400).send({
-        status: "error",
-        code: "MISSING_FIELDS",
+        status: "failed",
         message: "All password fields are required"
       });
     }
 
     if (new_password !== confirm_password) {
       return res.status(400).send({
-        status: "error",
-        code: "PASSWORD_MISMATCH",
+        status: "failed",
         message: "New password and confirm password do not match"
       });
     }
@@ -209,8 +207,7 @@ exports.changeUserPassword = async (req, res) => {
     const user = await EstablishmentUser.findByPk(userId);
     if (!user) {
       return res.status(404).send({
-        status: "error",
-        code: "USER_NOT_FOUND",
+        status: "failed",
         message: "User not found"
       });
     }
@@ -219,8 +216,7 @@ exports.changeUserPassword = async (req, res) => {
     const isMatch = await bcrypt.compare(old_password, user.password);
     if (!isMatch) {
       return res.status(401).send({
-        status: "error",
-        code: "OLD_PASSWORD_INCORRECT",
+        status: "failed",
         message: "Old password is incorrect"
       });
     }
@@ -233,20 +229,20 @@ exports.changeUserPassword = async (req, res) => {
     );
 
     return res.status(200).send({
-      status: "ok",
-      code: "PASSWORD_UPDATED",
+      status: "success",
       message: "Password updated successfully"
     });
 
   } catch (err) {
+    logger.error(err.message);
     return res.status(500).send({
-      status: "error",
-      code: "SERVER_ERROR",
+      status: "failed",
       message: "An unexpected error occurred"
     });
   }
 };
 
+
 // Delete user
 exports.deleteUser = async (req, res) => {
   try {
diff --git a/app/controllers/unitMasterController.js b/app/controllers/unitMasterController.js
index 34d3b3d..7b29533 100644
--- a/app/controllers/unitMasterController.js
+++ b/app/controllers/unitMasterController.js
@@ -59,7 +59,6 @@ exports.createUnit = async (req, res) => {
       }
     }
 
-    // SAFE: no Sequelize.where, no SQL functions
     const existingUOM = await UnitMaster.findOne({
       where: {
         uom: cleaned
diff --git a/app/routes/routes.js b/app/routes/routes.js
index 05cb509..07d515b 100644
--- a/app/routes/routes.js
+++ b/app/routes/routes.js
@@ -2798,8 +2798,8 @@ router.post("/forgot-password/request-otp", establishmentController.forgotPasswo
  *             properties:
  *               registered_email: { type: string, example: "contact@abcindustries.com" }
  *               otp: { type: string, example: "123456" }
- *               password: { type: string, example: "ExamplePassword123!" }
- *               confirm_password: { type: string, example: "ExamplePassword123!" }
+ *               password: { type: string, example: "<pwd>" }
+ *               confirm_password: { type: string, example: "<pwd>" }
  *     responses:
  *       200:
  *         description: Password reset successfully