diff --git a/wiki/_master-index.md b/wiki/_master-index.md
index 3e5db27..bfdfb1c 100644
--- a/wiki/_master-index.md
+++ b/wiki/_master-index.md
@@ -20,7 +20,7 @@ This 3-hop pattern works for hundreds of articles without vector search.
 |-------|-------------|----------|
 | [[wiki/obsidian-rag/_index\|obsidian-rag/]] | Karpathy's LLM wiki method — Obsidian RAG, setup, vs true RAG | 3 |
 | [[wiki/projects-overview/_index\|projects-overview/]] | All 42 Oliver Agency projects — grouped by server (optical-web-1, optical-dev, baic, box-cli) | 1 |
-| [[wiki/tech-patterns/_index\|tech-patterns/]] | Recurring tech stacks: FastAPI, React/Vite, Next.js, Azure AD, AI, Box, One2Edit, Redis/Celery, cost-tracker | 14 |
+| [[wiki/tech-patterns/_index\|tech-patterns/]] | Recurring tech stacks: FastAPI, React/Vite, Next.js, Azure AD, AI, Box, One2Edit, Redis/Celery, cost-tracker | 15 |
 | [[wiki/architecture/_index\|architecture/]] | Cross-cutting architectural patterns: Docker Compose, multi-agent AI, GCP timeout, RAG, hotfolder, optical-dev deploy, cost-tracker, new-project checklist, troubleshooting playbooks, ADR log | 10 |
 | [[wiki/client-knowledge/_index\|client-knowledge/]] | Per-client notes for Ford, H&M, L'Oréal, Barclays, Ferrero, 3M | 6 |
 | [[wiki/concepts/_index\|concepts/]] | Atomic knowledge extracted from Claude Code sessions | 61 |
diff --git a/wiki/tech-patterns/_index.md b/wiki/tech-patterns/_index.md
index aa9823c..ad4d2c5 100644
--- a/wiki/tech-patterns/_index.md
+++ b/wiki/tech-patterns/_index.md
@@ -28,6 +28,7 @@ Recurring technology stacks used across Oliver Agency projects. Each article cov
 | [[wiki/tech-patterns/cost-tracker-pricing-sources\|cost-tracker-pricing-sources]] | Three-layer pricing: LiteLLM auto-sync > YAML (non-LLM) > admin override; historical `effective_from/to` | ai-cost-tracker |
 | [[wiki/tech-patterns/cost-tracker-providers\|cost-tracker-providers]] | Billing units per provider: Gemini `usage_metadata` tokens, ElevenLabs/GCP TTS `len(text)` chars | All AI projects |
 | [[wiki/tech-patterns/runtime-credential-rotation-admin-panel\|Runtime Credential Rotation with Admin Panel]] | When you need to allow administrators to update time-sensitive API credentials (like monthly token r | — |
+| [[wiki/tech-patterns/xss-validation-false-positive-word-boundary\|Fixing XSS Validation False Positives in JSON Field Names]] | When a content security middleware rejects legitimate JSON payloads with "400 Bad Request" errors, a | — |
 
 ## Quick Decision Guide