diff --git a/csharp/App/Backend/Controllers/Controller.cs b/csharp/App/Backend/Controllers/Controller.cs
index 6cece6018..df0d4304a 100644
--- a/csharp/App/Backend/Controllers/Controller.cs
+++ b/csharp/App/Backend/Controllers/Controller.cs
@@ -2,6 +2,7 @@ using InnovEnergy.App.Backend.Database;
 using InnovEnergy.App.Backend.DataTypes;
 using InnovEnergy.App.Backend.DataTypes.Methods;
 using InnovEnergy.App.Backend.Relations;
+using InnovEnergy.Lib.Utils;
 using Microsoft.AspNetCore.Mvc;
 
 namespace InnovEnergy.App.Backend.Controllers;
@@ -113,7 +114,7 @@ public class Controller : ControllerBase
             .Ancestors()
             .SelectMany(f => f.UsersWithDirectAccess()
                 .Where(u => u.IsDescendantOf(user))
-                .Select(u => new { folderId = f.Id, folderName = f.Name, user = u }))
+                .Select(u => new { folderId = f.Id, folderName = f.Name, user = u.HidePassword() }))
             .ToList();
     }
 
@@ -151,7 +152,7 @@ public class Controller : ControllerBase
             .Ancestors()
             .SelectMany(f => f.UsersWithDirectAccess()
                 .Where(u => u.IsDescendantOf(user))
-                .Select(u => new { folderId = f.Id, folderName = f.Name, user = u }))
+                .Select(u => new { folderId = f.Id, folderName = f.Name, user = u.HidePassword() }))
             .ToList();
     }
     
@@ -188,6 +189,8 @@ public class Controller : ControllerBase
         if (user is null)
             return Unauthorized();
         
+        user.AccessibleInstallations().ForEach(i => i.FillOrderNumbers());
+        
         return user.AccessibleInstallations().ToList();
     }
     
@@ -317,9 +320,7 @@ public class Controller : ControllerBase
 
         if (!session.Update(updatedUser)) 
             return Unauthorized();
-        
-        updatedUser.Password = ""; // TODO: generic sanitize return values 
-        
+
         return updatedUser;
     }
     
diff --git a/csharp/App/Backend/DataTypes/DeletedFolder.cs b/csharp/App/Backend/DataTypes/DeletedFolder.cs
index 5fb1e5951..d25995835 100644
--- a/csharp/App/Backend/DataTypes/DeletedFolder.cs
+++ b/csharp/App/Backend/DataTypes/DeletedFolder.cs
@@ -1,6 +1,11 @@
+using SQLite;
+
 namespace InnovEnergy.App.Backend.DataTypes;
 
-public class DeletedFolder : Folder {}
+public class DeletedFolder : Folder
+{
+    [PrimaryKey]
+    public override Int64 Id { get; set; }
+}
 
-//Deleted Things need to have AT LEAST every property that normal things have
-//Todo "Restore" Function? -k
\ No newline at end of file
+//Deleted Things need to have AT LEAST every property that normal things have
\ No newline at end of file
diff --git a/csharp/App/Backend/DataTypes/DeletedInstallation.cs b/csharp/App/Backend/DataTypes/DeletedInstallation.cs
index 9c7f3d4d4..5cd103d84 100644
--- a/csharp/App/Backend/DataTypes/DeletedInstallation.cs
+++ b/csharp/App/Backend/DataTypes/DeletedInstallation.cs
@@ -1,7 +1,10 @@
+using SQLite;
+
 namespace InnovEnergy.App.Backend.DataTypes;
 
 //Deleted Things need to have AT LEAST every property that normal things have
 public class DeletedInstallation : Installation
 {
-
+    [PrimaryKey]
+    public override Int64 Id { get; set; }
 }
\ No newline at end of file
diff --git a/csharp/App/Backend/DataTypes/DeletedUser.cs b/csharp/App/Backend/DataTypes/DeletedUser.cs
index 7d7a5cad2..04e169dc8 100644
--- a/csharp/App/Backend/DataTypes/DeletedUser.cs
+++ b/csharp/App/Backend/DataTypes/DeletedUser.cs
@@ -7,4 +7,7 @@ namespace InnovEnergy.App.Backend.DataTypes;
 public class DeletedUser : User
 {
     public override String Name { get; set; } = null!;
+    
+    [PrimaryKey]
+    public override Int64 Id { get; set; }
 }
\ No newline at end of file
diff --git a/csharp/App/Backend/DataTypes/Installation.cs b/csharp/App/Backend/DataTypes/Installation.cs
index f149135a3..c4e625646 100644
--- a/csharp/App/Backend/DataTypes/Installation.cs
+++ b/csharp/App/Backend/DataTypes/Installation.cs
@@ -1,3 +1,5 @@
+using SQLite;
+
 namespace InnovEnergy.App.Backend.DataTypes;
 
 
@@ -8,12 +10,13 @@ public class Installation : TreeNode
     public String Country  { get; set; } = "";
     
     // TODO: make relation
-    public String OrderNumbers { get; set; } = "";
+    [Ignore] public IReadOnlyList<String> OrderNumbers { get; set; } = Array.Empty<String>();
 
     public Double Lat  { get; set; }
     public Double Long { get; set; }
 
     public String S3Bucket { get; set; } = "";
     public String S3Url    { get; set; } = "";
-    
+
+
 }
\ No newline at end of file
diff --git a/csharp/App/Backend/DataTypes/Methods/Folder.cs b/csharp/App/Backend/DataTypes/Methods/Folder.cs
index 10e8d41c2..9a7dfa766 100644
--- a/csharp/App/Backend/DataTypes/Methods/Folder.cs
+++ b/csharp/App/Backend/DataTypes/Methods/Folder.cs
@@ -52,8 +52,8 @@ public static class FolderMethods
     public static IEnumerable<Installation> ChildInstallations(this Folder parent)
     {
         return Db
-              .Installations
-              .Where(f => f.ParentId == parent.Id);
+            .Installations
+            .Where(f => f.ParentId == parent.Id);
     }
     
     public static IEnumerable<Folder> DescendantFolders(this Folder parent)
diff --git a/csharp/App/Backend/DataTypes/Methods/Installation.cs b/csharp/App/Backend/DataTypes/Methods/Installation.cs
index e1a0c766f..8319daa1f 100644
--- a/csharp/App/Backend/DataTypes/Methods/Installation.cs
+++ b/csharp/App/Backend/DataTypes/Methods/Installation.cs
@@ -111,7 +111,20 @@ public static class InstallationMethods
     {
         return Db.Installations.Any(i => i.Id == installation.Id);
     }
-    
 
+    public static IReadOnlyList<String> GetOrderNumbers(this Installation installation)
+    {
+        return Db.OrderNumber2Installation
+            .Where(i => i.InstallationId == installation.Id)
+            .Select(i => i.OrderNumber)
+            .ToReadOnlyList<String>();
+    }
+    
+    public static Installation FillOrderNumbers(this Installation installation)
+    {
+        installation.OrderNumbers = installation.GetOrderNumbers();
+        return installation;
+    }
+    
 }
 
diff --git a/csharp/App/Backend/DataTypes/Methods/Session.cs b/csharp/App/Backend/DataTypes/Methods/Session.cs
index 5bbff344c..564f90035 100644
--- a/csharp/App/Backend/DataTypes/Methods/Session.cs
+++ b/csharp/App/Backend/DataTypes/Methods/Session.cs
@@ -118,7 +118,6 @@ public static class SessionMethods
             && user.HasWriteAccess
             && user.HasAccessTo(installation)
             && Db.Create(installation.ToDeletedInstallation())
-            //   && installation.DeleteBucket().Result  // TODO
             && Db.Delete(installation);
     }
     
diff --git a/csharp/App/Backend/DataTypes/Methods/User.cs b/csharp/App/Backend/DataTypes/Methods/User.cs
index 4851c0d3f..c56b2c62b 100644
--- a/csharp/App/Backend/DataTypes/Methods/User.cs
+++ b/csharp/App/Backend/DataTypes/Methods/User.cs
@@ -29,17 +29,13 @@ public static class UserMethods
               .DirectlyAccessibleFolders()
               .SelectMany(f => f.DescendantFolders().Prepend(f))
               .Distinct();
-
-        // Distinct because the user might have direct access
-        // to a child folder of a folder he has already access to
-        // TODO shouldn't we prevent doubling permissions? -K"
-        // TODO yes we should -ig (still TODO)
-        // however we should still leave the distinct, defensive programming...
     }
 
     public static IEnumerable<TreeNode> AccessibleFoldersAndInstallations(this User user)
     {
         var folders       = user.AccessibleFolders() as IEnumerable<TreeNode>;
+        
+        user.AccessibleInstallations().ForEach(i => i.FillOrderNumbers());
         var installations = user.AccessibleInstallations();
 
         return folders.Concat(installations);
@@ -203,20 +199,4 @@ public static class UserMethods
         
         return user;
     }
-
-
-    // TODO?
-    private static Boolean IsValidEmail(String email)
-    {
-        try
-        {
-            var emailAddress = new MailAddress(email);
-        }
-        catch
-        {
-            return false;
-        }
-
-        return true;
-    }
 }
\ No newline at end of file
diff --git a/csharp/App/Backend/DataTypes/TreeNode.cs b/csharp/App/Backend/DataTypes/TreeNode.cs
index 796ab9cc2..b1a4a72fa 100644
--- a/csharp/App/Backend/DataTypes/TreeNode.cs
+++ b/csharp/App/Backend/DataTypes/TreeNode.cs
@@ -5,7 +5,7 @@ namespace InnovEnergy.App.Backend.DataTypes;
 public abstract partial class TreeNode
 {
     [PrimaryKey, AutoIncrement]
-    public         Int64  Id          { get; set; }
+    public virtual         Int64  Id          { get; set; }
     public virtual String Name        { get; set; } = "";  // overridden by User (unique)
     public         String Information { get; set; } = "";  // unstructured random info
 
diff --git a/csharp/App/Backend/DataTypes/User.cs b/csharp/App/Backend/DataTypes/User.cs
index ca075eecb..a9c6b4bdd 100644
--- a/csharp/App/Backend/DataTypes/User.cs
+++ b/csharp/App/Backend/DataTypes/User.cs
@@ -12,9 +12,5 @@ public class User : TreeNode
 
     [Unique]
     public override String Name { get; set; } = null!;
-    
-
-
-    // TODO: must reset pwd
 
 }
\ No newline at end of file
diff --git a/csharp/App/Backend/Database/Db.cs b/csharp/App/Backend/Database/Db.cs
index 086ca0d20..161e30485 100644
--- a/csharp/App/Backend/Database/Db.cs
+++ b/csharp/App/Backend/Database/Db.cs
@@ -16,15 +16,16 @@ public static partial class Db
 
     private static SQLiteConnection Connection { get; } = new SQLiteConnection(DbPath);
 
-    public static TableQuery<Session>             Sessions             => Connection.Table<Session>();
-    public static TableQuery<Folder>              Folders              => Connection.Table<Folder>();
-    public static TableQuery<DeletedFolder>       DeletedFolders       => Connection.Table<DeletedFolder>();
-    public static TableQuery<Installation>        Installations        => Connection.Table<Installation>();
-    public static TableQuery<DeletedInstallation> DeletedInstallations => Connection.Table<DeletedInstallation>();
-    public static TableQuery<User>                Users                => Connection.Table<User>();
-    public static TableQuery<DeletedUser>         DeletedUsers         => Connection.Table<DeletedUser>();
-    public static TableQuery<FolderAccess>        FolderAccess         => Connection.Table<FolderAccess>();
-    public static TableQuery<InstallationAccess>  InstallationAccess   => Connection.Table<InstallationAccess>();
+    public static TableQuery<Session>                   Sessions                    => Connection.Table<Session>();
+    public static TableQuery<Folder>                    Folders                     => Connection.Table<Folder>();
+    public static TableQuery<DeletedFolder>             DeletedFolders              => Connection.Table<DeletedFolder>();
+    public static TableQuery<Installation>              Installations               => Connection.Table<Installation>();
+    public static TableQuery<DeletedInstallation>       DeletedInstallations        => Connection.Table<DeletedInstallation>();
+    public static TableQuery<User>                      Users                       => Connection.Table<User>();
+    public static TableQuery<DeletedUser>               DeletedUsers                => Connection.Table<DeletedUser>();
+    public static TableQuery<FolderAccess>              FolderAccess                => Connection.Table<FolderAccess>();
+    public static TableQuery<InstallationAccess>        InstallationAccess          => Connection.Table<InstallationAccess>();
+    public static TableQuery<OrderNumber2Installation>  OrderNumber2Installation    => Connection.Table<OrderNumber2Installation>();
 
 
     public static void Init()
@@ -47,6 +48,7 @@ public static partial class Db
             Connection.CreateTable<FolderAccess>();
             Connection.CreateTable<InstallationAccess>();
             Connection.CreateTable<Session>();
+            Connection.CreateTable<OrderNumber2Installation>();
         });
 
         Observable.Interval(TimeSpan.FromDays(0.5))
diff --git a/csharp/App/Backend/Database/Read.cs b/csharp/App/Backend/Database/Read.cs
index 2cdc08d10..91e94bf7a 100644
--- a/csharp/App/Backend/Database/Read.cs
+++ b/csharp/App/Backend/Database/Read.cs
@@ -18,12 +18,12 @@ public static partial class Db
     public static Installation? GetInstallationById(Int64? id)
     {
         return Installations
-              .FirstOrDefault(i => i.Id == id);
+              .FirstOrDefault(i => i.Id == id)
+              .FillOrderNumbers();
     }
     
     public static User? GetUserById(Int64? id)
     {
-        //TODO Sanitize Password here
         return Users
             .FirstOrDefault(u => u.Id == id)
             .HidePassword();
@@ -31,7 +31,6 @@ public static partial class Db
     
     public static User? GetUserByName(String userName)
     {
-        //TODO Sanitize Password here
         return Users
               .FirstOrDefault(u => u.Name == userName)
               .HidePassword();
@@ -39,7 +38,6 @@ public static partial class Db
     
         public static User? GetUserWithPasswordByName(String userName)
     {
-        //TODO Sanitize Password here
         return Users
             .FirstOrDefault(u => u.Name == userName);
     }
diff --git a/csharp/App/Backend/Mailer/Mailer.cs b/csharp/App/Backend/Mailer/Mailer.cs
index ae3ce7f0b..096d5a549 100644
--- a/csharp/App/Backend/Mailer/Mailer.cs
+++ b/csharp/App/Backend/Mailer/Mailer.cs
@@ -14,23 +14,21 @@ public static class Mailer
             var email = new MimeMessage();
 
             email.From.Add(new MailboxAddress("InnovEnergy", "noreply@innov.energy"));
-            email.To.Add(new MailboxAddress(emailRecipientUser.Name, "fern95@ethereal.email")); //TODO CHANGE ME
+            email.To.Add(new MailboxAddress(emailRecipientUser.Name, emailRecipientUser.Email));
 
             email.Subject = "Create a new password for your Innovenergy-Account";
             email.Body = new TextPart(MimeKit.Text.TextFormat.Plain) { 
                 Text = "Dear " + emailRecipientUser.Name + "\n Please create a new password for your Innovenergy-account." +
                        "\n To do this just login at https://HEEEEELP"
             };
-            using (var smtp = new SmtpClient())
-            {
-                smtp.Connect(config.Url, config.Port, false);
+            
+            using var smtp = new SmtpClient();
+            smtp.Connect(config.Url, config.Port, false);
 
-                // Todo put me into urlAndKey.json
-                smtp.Authenticate(config.Username, config.Password);
+            smtp.Authenticate(config.Username, config.Password);
 
-                smtp.Send(email);
-                smtp.Disconnect(true);
-            }
+            smtp.Send(email);
+            smtp.Disconnect(true);
 
             return true;
         }
diff --git a/csharp/App/Backend/Mailer/SmptConfig.cs b/csharp/App/Backend/Mailer/SmptConfig.cs
index c52bbc251..02b63653a 100644
--- a/csharp/App/Backend/Mailer/SmptConfig.cs
+++ b/csharp/App/Backend/Mailer/SmptConfig.cs
@@ -1,13 +1,13 @@
+using System.Diagnostics.CodeAnalysis;
+
 namespace InnovEnergy.App.Backend.Mailer;
 
+[SuppressMessage("ReSharper", "ClassNeverInstantiated.Global")]
 public class SmptConfig
 {
-    public String Url { get; init; }
-    public String Username { get; init; }
-    public String Password { get; init; }
-    public Int32  Port { get; init; }
-
-    public SmptConfig()
-    { }
+    public String Url { get; init; } = null!;
+    public String Username { get; init; } = null!;
+    public String Password { get; init; } = null!;
+    public Int32  Port { get; init; } = 587;
 
 }
\ No newline at end of file
diff --git a/csharp/App/Backend/Relations/OrderNumber2Installation.cs b/csharp/App/Backend/Relations/OrderNumber2Installation.cs
new file mode 100644
index 000000000..ec2b7d84d
--- /dev/null
+++ b/csharp/App/Backend/Relations/OrderNumber2Installation.cs
@@ -0,0 +1,9 @@
+using SQLite;
+
+namespace InnovEnergy.App.Backend.Relations;
+
+public class OrderNumber2Installation : Relation<String, Int64>
+{
+    [Indexed] public String OrderNumber          { get => Left ; init => Left  = value;}
+    [Indexed] public Int64  InstallationId       { get => Right; init => Right = value;}
+}
\ No newline at end of file
diff --git a/csharp/App/Backend/S3/S3Access.cs b/csharp/App/Backend/S3/S3Access.cs
index b9705ee81..0084807c3 100644
--- a/csharp/App/Backend/S3/S3Access.cs
+++ b/csharp/App/Backend/S3/S3Access.cs
@@ -1,19 +1,12 @@
-using System.Text.Json;
+using System.Diagnostics.CodeAnalysis;
 using static System.IO.File;
 using static System.Text.Json.JsonSerializer;
 
 namespace InnovEnergy.App.Backend.S3;
 
+[SuppressMessage("Trimming", "IL2026:Members annotated with \'RequiresUnreferencedCodeAttribute\' require dynamic access otherwise can break functionality when trimming application code")]
 public static class S3Access
 {
-    // TODO: put these into Json files in /Resources and read them from
-    // there so they can be changed without recompiling
-    // they should be read from disk on each use,
-    // so the backend does not need to be restarted on change
-
-
     public static S3Cmd ReadOnly => Deserialize<S3Cmd>(OpenRead("./Resources/s3ReadOnlyKey.json"))!;
-
-
     public static S3Cmd ReadWrite => Deserialize<S3Cmd>(OpenRead("./Resources/s3ReadWriteKey.json"))!;
 }
\ No newline at end of file
diff --git a/csharp/App/Backend/db.sqlite b/csharp/App/Backend/db.sqlite
index ba4d77e62..f42846685 100644
Binary files a/csharp/App/Backend/db.sqlite and b/csharp/App/Backend/db.sqlite differ