The import/export boundary regression test no longer demonstrates a partial regular-expression sanitizer that handled only one URL scheme and complete HTML tags. Its deterministic observation callback now proves that HTML and javascript:, vbscript: and data: payloads reach the sanitizer boundary, while the production callback remains DOMPurify. This resolves CodeQL alerts 448 and 449 without creating a misleading sanitizer example. The findings were confined to test code and exposed no runtime path, so there is no attributable security event to report in Admin Panel Problems or researcher to add to the Hall of Fame.

One common filename boundary now sanitizes names before upload and whenever a name is displayed, archived or downloaded. It preserves the content-derived extension inside the classic Amiga FFS 30-character limit and removes an incomplete bracketed suffix instead of producing names such as Online Gantt 20260905 (1.gantt. The maintained JavaScript file-type detector handles binary magic bytes before the bounded libmagic/text fallback; Online Gantt JSON retains its application-owned .gantt extension. Existing attachment metadata is corrected only when an authorized read needs it, not by an eager database-wide rename.

The common Problems fold now fills available usernames and obtains trusted, proxy-aware request addresses for all report streams. IPv4 and IPv6 remain separate, while available Cloudflare and other supported proxy/CDN headers add a display-only country flag, city, region and coordinates. DDP lockout reports now forward their known username, source address and headers instead of showing an empty actor beside “locked one address.” Location never participates in a security decision.