diff --git a/server/notifications.go b/server/notifications.go
index b6f3a6d..49d3476 100644
--- a/server/notifications.go
+++ b/server/notifications.go
@@ -181,6 +181,9 @@ func sendPushNotification(notification *Notification, uuids []string) error {
 			VAPIDPublicKey:  config.vapidKeys.public,
 			VAPIDPrivateKey: config.vapidKeys.private,
 			TTL:             30, // seconds,
+			HTTPClient: &http.Client{
+				Timeout: 10 * time.Second,
+			},
 		})
 		if err != nil {
 			log.Printf("error sending notifications: %s", err)
@@ -196,11 +199,11 @@ func sendPushNotification(notification *Notification, uuids []string) error {
 	return errors.Join(failures...)
 }
 
-func getPlaceholders(values ...string) (placeholders string, parameters []interface{}) {
+func getPlaceholders(values ...string) (placeholders string, parameters []any) {
 	n := len(values)
 	p := make([]string, n)
-	parameters = make([]interface{}, n)
-	for i := 0; i < n; i++ {
+	parameters = make([]any, n)
+	for i := range n {
 		p[i] = "?"
 		parameters[i] = values[i]
 	}
diff --git a/server/security/security.go b/server/security/security.go
index 921f3b5..2be6bed 100644
--- a/server/security/security.go
+++ b/server/security/security.go
@@ -57,7 +57,7 @@ func (s *Security) VerifySignature(clientKey uint32, msg []byte) bool {
 }
 
 func (s *Security) VerifyCounter(counter *uint32, msg []byte) bool {
-	if cnt := binary.BigEndian.Uint32(msg[4 : len(msg)-4]); *counter < cnt {
+	if cnt := binary.BigEndian.Uint32(msg[4:]); *counter < cnt {
 		*counter = cnt
 		return true
 	}