diff --git a/app.py b/app.py
index 84a123a..19c164e 100644
--- a/app.py
+++ b/app.py
@@ -1284,35 +1284,19 @@ async def system_sysctl_audit(host: str, _=Depends(_verify)):
 
 
 def _host_forensics_command(since_hours: int) -> str:
-    script = f'''import glob, json, os, re, subprocess
+    script = f'''import glob, json, os, subprocess
 
 def run(command):
     proc = subprocess.run(command, shell=True, text=True, capture_output=True, timeout=30)
     return {{"rc": proc.returncode, "stdout": proc.stdout.strip()[-12000:], "stderr": proc.stderr.strip()[-1000:]}}
 
-def safe_git_diff(paths):
-    proc = subprocess.run(["git", "-C", "/app-config/ansible", "diff", "--"] + paths, text=True, capture_output=True, timeout=30)
-    sensitive = re.compile(r"pass|secret|token|api[_-]?key|private[_-]?key", re.I)
+def redacted_git_diff():
+    proc = subprocess.run(["git", "-C", "/app-config/ansible", "diff", "--", "iso-builder/build-iso.sh", "iso-builder/preseed.cfg.tpl", "pfannkuchen.ini"], text=True, capture_output=True, timeout=30)
+    sensitive = ("password", "passwd", "secret", "token", "private", "credential", "ssh-rsa", "ssh-ed25519")
     lines = []
     for line in proc.stdout.splitlines():
-        lines.append("[REDACTED SENSITIVE DIFF LINE]" if sensitive.search(line) else line)
-    return {{"rc": proc.returncode, "stdout": "\\n".join(lines)[-12000:], "stderr": proc.stderr.strip()[-4000:]}}
-
-def kuma_outline_monitors():
-    path = "/app-config/kuma/kuma.db"
-    if not os.path.exists(path):
-        return {{"rc": 0, "stdout": "[]", "stderr": ""}}
-    try:
-        import sqlite3
-        connection = sqlite3.connect("file:" + path + "?mode=ro", uri=True)
-        columns = [row[1] for row in connection.execute("pragma table_info(monitor)")]
-        wanted = [name for name in ("id", "name", "url", "hostname", "active") if name in columns]
-        rows = [dict(zip(wanted, row)) for row in connection.execute("select " + ",".join(wanted) + " from monitor")]
-        selected = [row for row in rows if "outline" in json.dumps(row).lower() or "wiki.sascha-lutz.de" in json.dumps(row).lower()]
-        connection.close()
-        return {{"rc": 0, "stdout": json.dumps(selected), "stderr": ""}}
-    except Exception as exc:
-        return {{"rc": 1, "stdout": "", "stderr": str(exc)}}
+        lines.append("[REDACTED SENSITIVE DIFF LINE]" if any(word in line.lower() for word in sensitive) else line)
+    return {{"rc": proc.returncode, "stdout": "\\n".join(lines)[-12000:], "stderr": proc.stderr.strip()[-1000:]}}
 
 checks = {{
     "hostname": run("hostnamectl --static 2>/dev/null || hostname"),
@@ -1336,9 +1320,8 @@ checks = {{
     "recent_iso_builder_files": run("find /app-config/ansible/iso-builder -type f -mmin -{since_hours * 60} -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\\n' 2>/dev/null | sort"),
     "ansible_git_status": run("git -C /app-config/ansible status --short 2>/dev/null || true"),
     "minecraft_inventory": run("grep -in 'minecraft' /app-config/ansible/pfannkuchen.ini 2>/dev/null || true"),
-    "iso_builder_diff_redacted": safe_git_diff(["iso-builder/build-iso.sh", "iso-builder/preseed.cfg.tpl", "pfannkuchen.ini"]),
+    "iso_builder_diff_redacted": redacted_git_diff(),
     "iso_builder_hashes": run("sha256sum /app-config/ansible/iso-builder/* 2>/dev/null || true"),
-    "kuma_outline_monitors": kuma_outline_monitors(),
 }}
 print(json.dumps(checks))
 '''