diff --git a/worker/src/web.py b/worker/src/web.py
index e215c88..1664aed 100644
--- a/worker/src/web.py
+++ b/worker/src/web.py
@@ -2,34 +2,18 @@ import os
 import logging
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI, Request, HTTPException
+from fastapi import FastAPI, Request
 from fastapi.responses import HTMLResponse, JSONResponse
-from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
-from fastapi.security import HTTPBasic, HTTPBasicCredentials
 import asyncpg
 
 from db import get_pool
 
 logger = logging.getLogger(__name__)
 
-USERNAME = os.getenv("WEB_UI_USERNAME", "admin")
-PASSWORD = os.getenv("WEB_UI_PASSWORD", "admin")
-
-security = HTTPBasic()
 templates = Jinja2Templates(directory="templates")
 
 
-def get_current_user(credentials: HTTPBasicCredentials):
-    if credentials.username == USERNAME and credentials.password == PASSWORD:
-        return credentials.username
-    raise HTTPException(
-        status_code=401,
-        detail="Invalid credentials",
-        headers={"WWW-Authenticate": "Basic"},
-    )
-
-
 async def query(sql: str, *args) -> list:
     """Execute a query and return rows as dicts."""
     try:
@@ -87,32 +71,6 @@ async def lifespan(app: FastAPI):
 app = FastAPI(title="Willhaben Tracker Web UI", lifespan=lifespan)
 
 
-# ─── Middleware ───────────────────────────────────────────────
-
-@app.middleware("http")
-async def auth_middleware(request: Request, call_next):
-    credentials = None
-    auth_header = request.headers.get("authorization")
-    if auth_header and auth_header.startswith("Basic "):
-        import base64
-        try:
-            decoded = base64.b64decode(auth_header[6:]).decode("utf-8")
-            username, password = decoded.split(":", 1)
-            credentials = HTTPBasicCredentials(username=username, password=password)
-        except Exception:
-            pass
-
-    if not credentials or not get_current_user(credentials):
-        return JSONResponse(
-            status_code=401,
-            content={"detail": "Authentication required"},
-            headers={"WWW-Authenticate": "Basic realm='Willhaben Tracker'"},
-        )
-
-    response = await call_next(request)
-    return response
-
-
 # ─── Routes ───────────────────────────────────────────────────
 
 @app.get("/", response_class=HTMLResponse)