diff --git a/app/Group.php b/app/Group.php
index d61feb3f5c..1a2dbebb32 100644
--- a/app/Group.php
+++ b/app/Group.php
@@ -538,6 +538,16 @@ public function setDistanceAttribute($val)
         $this->distance = $val;
     }
 
+    /**
+     * The group description is Quill-authored HTML which we render unescaped, so it has to
+     * be sanitised.  Doing it in the mutator rather than in the controllers means every
+     * write path - v2 API, web forms, imports, seeders - is covered by one rule.
+     */
+    public function setFreeTextAttribute($val)
+    {
+        $this->attributes['free_text'] = is_null($val) ? null : \Stevebauman\Purify\Facades\Purify::clean($val);
+    }
+
     public function createDiscourseGroup() {
         // Get the host who created the group.
         $success = false;
diff --git a/app/GroupTags.php b/app/GroupTags.php
index 0fb7af1294..add7c175db 100644
--- a/app/GroupTags.php
+++ b/app/GroupTags.php
@@ -23,6 +23,14 @@ class GroupTags extends Model
      */
     protected $fillable = ['tag_name', 'description', 'network_id'];
 
+    /**
+     * Tag descriptions are rendered with v-html in NetworkPage.vue, so sanitise on write.
+     */
+    public function setDescriptionAttribute($val)
+    {
+        $this->attributes['description'] = is_null($val) ? null : \Stevebauman\Purify\Facades\Purify::clean($val);
+    }
+
     /**
      * The attributes that should be hidden for arrays.
      *
diff --git a/app/Http/Controllers/API/DeviceController.php b/app/Http/Controllers/API/DeviceController.php
index 2fed4219d8..0eada58fcb 100644
--- a/app/Http/Controllers/API/DeviceController.php
+++ b/app/Http/Controllers/API/DeviceController.php
@@ -368,9 +368,19 @@ public function updateDevicev2(Request $request, $iddevices): JsonResponse
             ) = $this->validateDeviceParams($request,false);
 
         $event = Party::findOrFail($eventid);
+        $device = Device::findOrFail($iddevices);
 
-        if (!Fixometer::userHasEditEventsDevicesPermission($eventid, $user->id)) {
-            // Only hosts can add devices to events.
+        // Authorise against the event the device actually belongs to.  Checking only the
+        // eventid from the request body would let a host of any event edit any device in
+        // the database just by naming their own event here - deleteDevicev2 below already
+        // derives the event from the record for this reason.
+        if (!Fixometer::userHasEditEventsDevicesPermission($device->event, $user->id)) {
+            // Only hosts can edit devices on events.
+            abort(403);
+        }
+
+        // Moving a device to a different event needs rights on the destination too.
+        if ($eventid != $device->event && !Fixometer::userHasEditEventsDevicesPermission($eventid, $user->id)) {
             abort(403);
         }
 
@@ -393,7 +403,6 @@ public function updateDevicev2(Request $request, $iddevices): JsonResponse
             'repaired_by' => $user->id,
         ];
 
-        $device = Device::findOrFail($iddevices);
         $device->update($data);
 
         event(new DeviceCreatedOrUpdated($device));
diff --git a/app/Http/Controllers/API/EventController.php b/app/Http/Controllers/API/EventController.php
index 93907489b5..4bce981963 100644
--- a/app/Http/Controllers/API/EventController.php
+++ b/app/Http/Controllers/API/EventController.php
@@ -292,6 +292,16 @@ public function getEventv2(Request $request, $idevents)
     {
         $party = Party::findOrFail($idevents);
 
+        // Events on approved groups are public, but an event on a group still awaiting
+        // moderation is not - and the resource returns its exact lat/lng, which for a
+        // pending group may be someone's home address.  This is the same rule the web
+        // event page applies; getEventsForGroupv2 already gates on the group too.
+        $user = Auth::user() ?: auth('api')->user();
+
+        if (! Fixometer::userHasViewPartyPermission($idevents, $user ? $user->id : null, $party)) {
+            abort(404);
+        }
+
         return \App\Http\Resources\Party::make($party);
     }
 
@@ -472,7 +482,16 @@ public function createEventv2(Request $request): JsonResponse
         $autoapprove = $group->auto_approve;
 
         if (!Fixometer::userCanCreateEvents($user)) {
-            // TODO: This doesn't check that they are a host of this particular group.
+            abort(403);
+        }
+
+        // Being a host of *some* group is not enough - the event has to be on a group you
+        // have authority over.  Without this, any host could attach events to any group,
+        // and because event visibility is inherited from the group's approved flag those
+        // events go public with no moderation.  Admins are covered by
+        // userHasEditGroupPermission; network coordinators are checked separately because
+        // their authority comes from the group's networks rather than users_groups.
+        if (!Fixometer::userHasEditGroupPermission($groupid, $user->id) && !$user->isCoordinatorForGroup($group)) {
             abort(403);
         }
 
diff --git a/app/Http/Controllers/CalendarEventsController.php b/app/Http/Controllers/CalendarEventsController.php
index 8bad356db3..9fae161a27 100644
--- a/app/Http/Controllers/CalendarEventsController.php
+++ b/app/Http/Controllers/CalendarEventsController.php
@@ -112,7 +112,7 @@ public function allEventsByArea(Request $request, $area)
 
     public function allEvents(Request $request, $env_hash)
     {
-        if ($env_hash != env('CALENDAR_HASH')) {
+        if ($env_hash !== env('CALENDAR_HASH')) {
             return abort(404);
         }
 
diff --git a/app/Http/Controllers/DeviceController.php b/app/Http/Controllers/DeviceController.php
index 2c0e359826..f68d119897 100644
--- a/app/Http/Controllers/DeviceController.php
+++ b/app/Http/Controllers/DeviceController.php
@@ -67,6 +67,19 @@ public function index($search = null): \Illuminate\View\View
 
     public function imageUpload(Request $request, $id)
     {
+        // Same rule as deleteImage below.  Only an existing device can be checked - a
+        // device that hasn't been created yet has no event to authorise against, which
+        // is the accepted tradeoff already documented there.
+        if ($id > 0) {
+            $user = Auth::user();
+            $event_id = Device::findOrFail($id)->event;
+            $in_event = EventsUsers::where('event', $event_id)->where('user', $user->id)->first();
+
+            if (! Fixometer::hasRole($user, 'Administrator') && ! is_object($in_event)) {
+                abort(403);
+            }
+        }
+
         try {
             $images = [];
 
diff --git a/app/Http/Controllers/ExportController.php b/app/Http/Controllers/ExportController.php
index 4dc9c9ffb5..2a48b2dbfd 100644
--- a/app/Http/Controllers/ExportController.php
+++ b/app/Http/Controllers/ExportController.php
@@ -72,7 +72,8 @@ public function devices(Request $request, $idevents = NULL, $idgroups = NULL)
         }
 
         $filename .= '.csv';
-        $file = fopen(base_path() . DIRECTORY_SEPARATOR . 'public' . DIRECTORY_SEPARATOR . $filename, 'w+');
+        $fullpath = $this->exportPath($filename);
+        $file = fopen($fullpath, 'w+');
 
         $me = auth()->user();
 
@@ -121,7 +122,7 @@ public function devices(Request $request, $idevents = NULL, $idgroups = NULL)
                     }
                 }
 
-                fputcsv($file, [
+                fputcsv($file, $this->csvSafeRow([
                     $device->item_type,
                     $device->deviceCategory->name,
                     $device->brand,
@@ -135,7 +136,7 @@ public function devices(Request $request, $idevents = NULL, $idgroups = NULL)
                     $wasteImpact,
                     $co2Diverted,
                     $device->deviceCategory->powered ? 'Powered' : 'Unpowered'
-                ]);
+                ]));
             }
         }
 
@@ -145,7 +146,7 @@ public function devices(Request $request, $idevents = NULL, $idgroups = NULL)
             'Content-Type' => 'text/csv',
         ];
 
-        return Response::download(base_path() . DIRECTORY_SEPARATOR . 'public' . DIRECTORY_SEPARATOR . $filename, $filename, $headers);
+        return Response::download($fullpath, $filename, $headers)->deleteFileAfterSend(true);
     }
 
     /**
@@ -220,11 +221,12 @@ private function exportEvents($parties) {
         // write content to file
         $filename = 'events.csv';
 
-        $file = fopen($filename, 'w+');
+        $fullpath = $this->exportPath($filename);
+        $file = fopen($fullpath, 'w+');
         fputcsv($file, $headers);
 
         foreach ($PartyArray as $d) {
-            fputcsv($file, $d);
+            fputcsv($file, $this->csvSafeRow($d));
         }
         fclose($file);
 
@@ -232,6 +234,37 @@ private function exportEvents($parties) {
             'Content-Type' => 'text/csv',
         ];
 
-        return Response::download($filename, $filename, $headers);
+        return Response::download($fullpath, $filename, $headers)->deleteFileAfterSend(true);
+    }
+
+    /**
+     * Somewhere to build an export that is not served by the webserver.  These files were
+     * previously written into public/ under a name derived from the group or venue, where
+     * they persisted and could be fetched by anyone who guessed the name.
+     */
+    private function exportPath($filename)
+    {
+        $dir = storage_path('app' . DIRECTORY_SEPARATOR . 'exports');
+
+        if (! is_dir($dir)) {
+            mkdir($dir, 0755, true);
+        }
+
+        return $dir . DIRECTORY_SEPARATOR . $filename;
+    }
+
+    /**
+     * Spreadsheets treat a cell starting with =, +, - or @ as a formula, so prefix those
+     * with an apostrophe.  Device fields are free text entered at events.
+     */
+    private function csvSafeRow(array $row)
+    {
+        return array_map(function ($value) {
+            if (is_string($value) && $value !== '' && in_array($value[0], ['=', '+', '-', '@'], true)) {
+                return "'" . $value;
+            }
+
+            return $value;
+        }, $row);
     }
 }
diff --git a/app/Http/Controllers/GroupController.php b/app/Http/Controllers/GroupController.php
index 7ae9c17d39..deb7f86eb8 100644
--- a/app/Http/Controllers/GroupController.php
+++ b/app/Http/Controllers/GroupController.php
@@ -384,7 +384,7 @@ public function postSendInvite(Request $request): RedirectResponse
 
         // Don't log to Sentry - legitimate user error.
         return redirect()->back()->with('warning', __('groups.invite_success_apart_from', [
-            'emails' => rtrim(implode(', ', $not_sent))
+            'emails' => e(rtrim(implode(', ', $not_sent)))
         ]));
     }
 
@@ -473,7 +473,7 @@ public function delete($id): RedirectResponse
                 return redirect('/user/forbidden');
             } else {
                 return redirect('/group')->with('success', __('groups.delete_succeeded', [
-                    'name' => $name,
+                    'name' => e($name),
                 ]));
             }
         } else {
@@ -602,7 +602,7 @@ public function getJoinGroup($group_id): RedirectResponse
             return redirect()
                 ->back()
                 ->with('success', __('groups.now_following', [
-                    'name' => $group->name,
+                    'name' => e($group->name),
                     'link' => url('/group/view/'.$group->idgroups),
                 ]));
         } catch (\Exception $e) {
@@ -615,6 +615,14 @@ public function getJoinGroup($group_id): RedirectResponse
 
     public function imageUpload(Request $request, $id)
     {
+        // Same rule as ajaxDeleteImage below - uploading replaces the group's existing
+        // image, so it needs the same authority as deleting it.
+        $user = Auth::user();
+
+        if (! Fixometer::hasRole($user, 'Administrator') && ! Fixometer::userHasEditGroupPermission($id, $user->id)) {
+            abort(403);
+        }
+
         try {
             if (isset($_FILES) && ! empty($_FILES)) {
                 $existing_image = Fixometer::hasImage($id, 'groups', true);
diff --git a/app/Http/Controllers/NetworkController.php b/app/Http/Controllers/NetworkController.php
index ef39106cce..ef269b8022 100644
--- a/app/Http/Controllers/NetworkController.php
+++ b/app/Http/Controllers/NetworkController.php
@@ -136,6 +136,14 @@ public function update(Request $request, Network $network): RedirectResponse
                     ->withWarning('Image uploads are disabled on this site.');
             }
 
+            // This is the one upload path that doesn't go through FixometerFile, which
+            // restricts uploads to jpg/png/gif by sniffing the content.  Without a rule
+            // here the extension comes from whatever mime type is detected, so an SVG -
+            // which can carry script and is served from our own origin - would be stored.
+            $request->validate([
+                'network_logo' => 'image|mimes:jpeg,jpg,png,gif|max:5120',
+            ]);
+
             // Determine the correct disk to use (s3 on Fly, public_uploads in dev)
             $disk = config('filesystems.default') === 's3' ? 's3' : 'public_uploads';
 
diff --git a/app/Http/Controllers/PartyController.php b/app/Http/Controllers/PartyController.php
index da01ced133..60dd80d009 100644
--- a/app/Http/Controllers/PartyController.php
+++ b/app/Http/Controllers/PartyController.php
@@ -746,6 +746,15 @@ public function cancelInvite($event_id): RedirectResponse
 
     public function imageUpload(Request $request, $id)
     {
+        // Same rule as deleteImage below: you must be an admin or have some
+        // involvement in the event to attach photos to it.
+        $user = Auth::user();
+        $in_event = EventsUsers::where('event', $id)->where('user', $user->id)->first();
+
+        if (! Fixometer::hasRole($user, 'Administrator') && ! is_object($in_event)) {
+            abort(403);
+        }
+
         try {
             if (empty($_FILES) && ! empty($request->files)) {
                 // Shim to handle uploads from Tests
diff --git a/app/Http/Controllers/RoleController.php b/app/Http/Controllers/RoleController.php
index 6f98bd2ee0..8987c41fea 100644
--- a/app/Http/Controllers/RoleController.php
+++ b/app/Http/Controllers/RoleController.php
@@ -55,9 +55,8 @@ public function edit($id, Request $request): View
 
             if ($request->getMethod() == 'POST') {
                 $permissions = $request->get('permissions');
-                $formid = (int) substr(strrchr($request->get('formId'), '_'), 1);
 
-                $update = $role->edit($formid, $permissions);
+                $update = $role->edit($id, $permissions);
                 if (! $update) {
                     $response['danger'] = 'Something went wrong. Could <strong>not</strong> update the permissions.';
                     \Sentry\CaptureMessage($response['danger']);
diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php
index 7368f67b62..e31579371d 100644
--- a/app/Http/Controllers/UserController.php
+++ b/app/Http/Controllers/UserController.php
@@ -197,10 +197,11 @@ public function postProfilePasswordEdit(Request $request): RedirectResponse
             $user->setPassword(Hash::make($request->input('new-password')));
             $user->save();
 
-            $user->update([
-            'recovery' => substr(bin2hex(openssl_random_pseudo_bytes(32)), 0, 24),
-            'recovery_expires' => strftime('%Y-%m-%d %X', time() + (24 * 60 * 60)),
-            ]);
+            // Changing your password used to mint a fresh 24 hour recovery token as a side
+            // effect, which left a live password-reset code on every account that had ever
+            // changed its password.  Rotate the API token instead, so a token stolen before
+            // the change stops working.
+            $user->rotateAPIToken();
 
             event(new PasswordChanged($user, $oldPassword));
 
@@ -283,7 +284,7 @@ public function postSoftDeleteUser(Request $request): RedirectResponse
 
         if (Auth::id() !== $user_id) {
             return redirect('user/all')->with('danger', __('profile.soft_deleted', [
-                'name' => $old_user_name
+                'name' => e($old_user_name)
             ]));
         } else {
             return redirect('login');
@@ -451,12 +452,17 @@ public function reset(Request $request)
         $User = new User;
         $user = null;
 
-        $recovery = $request->recovery;
+        $recovery = $request->input('recovery');
 
-        if (!$recovery) {
+        // Only a plain, non-empty string can be a recovery code.  Anything else - an array
+        // in particular - must be rejected before it reaches the query.  filter_var()
+        // returns false for an array, Laravel binds false as the integer 0, and MySQL
+        // then compares the VARCHAR column to 0 numerically, which coerces every
+        // non-numeric token in the table to 0 and matches a real user's live code.
+        if (!is_string($recovery) || $recovery === '') {
+            $recovery = null;
             $valid_code = false;
         } else {
-            $recovery = filter_var($recovery, FILTER_SANITIZE_STRING);
             $user = $User->where('recovery', '=', $recovery)->first();
 
             if (is_object($user) && strtotime($user->recovery_expires) > time()) {
@@ -483,11 +489,19 @@ public function reset(Request $request)
                 $email = $user->email;
                 $oldPassword = $user->password;
 
+                // Spend the recovery code as part of the same update, so a link can't be
+                // replayed for the rest of its 24 hour window.
                 $update = $user->update([
                     'password' => Hash::make($pwd),
+                    'recovery' => null,
+                    'recovery_expires' => null,
                 ]);
 
                 if ($update) {
+                    // A password reset is the remedy for a compromised account, so it has to
+                    // invalidate the API token too - otherwise a stolen token outlives it.
+                    $user->rotateAPIToken();
+
                     event(new PasswordChanged($user, $oldPassword));
                     return redirect('login')->with('success', __('passwords.updated'));
                 } else {
diff --git a/app/Http/Middleware/AcceptUserInvites.php b/app/Http/Middleware/AcceptUserInvites.php
index 25b1d42cf7..4658374340 100644
--- a/app/Http/Middleware/AcceptUserInvites.php
+++ b/app/Http/Middleware/AcceptUserInvites.php
@@ -45,13 +45,13 @@ public function handle(Request $request, Closure $next): Response
                         $acceptance->delete();
                         $request->session()->push('invites-feedback', __('groups.you_have_joined', [
                             'url' => url("/group/view/{$group->idgroups}"),
-                            'name' => $group->name
+                            'name' => e($group->name)
                         ]));
 
                     // Else that must mean the User is already part of the Group.
                         // We can then delete the Invite and create a new session
                     } else {
-                        $request->session()->push('invites-feedback', 'You are already a member of <a class="plain-link" href='.url("/group/view/{$group->idgroups}").">{$group->name}</a>");
+                        $request->session()->push('invites-feedback', 'You are already a member of <a class="plain-link" href="'.url("/group/view/{$group->idgroups}").'">'.e($group->name).'</a>');
                     }
                 }
                 $request->session()->forget('groups');
@@ -78,13 +78,13 @@ public function handle(Request $request, Closure $next): Response
                         $acceptance->delete();
                         $request->session()->push('invites-feedback', __('events.you_have_joined', [
                             'url' => url("/party/view/{$event->idevents}"),
-                            'name' => $event->venue
+                            'name' => e($event->venue)
                         ]));
 
                     // Else that must mean the User is already part of the Event.
                         // We can then delete the Invite and create a new session
                     } else {
-                        $request->session()->push('invites-feedback', 'You are already a member of <a class="plain-link" href='.url("/party/view/{$event->idevents}").">{$event->venue}</a>");
+                        $request->session()->push('invites-feedback', 'You are already a member of <a class="plain-link" href="'.url("/party/view/{$event->idevents}").'">'.e($event->venue).'</a>');
                     }
                 }
                 $request->session()->forget('events');
diff --git a/app/Http/Middleware/EnsureAPIToken.php b/app/Http/Middleware/EnsureAPIToken.php
index 6be9294091..909c770e16 100644
--- a/app/Http/Middleware/EnsureAPIToken.php
+++ b/app/Http/Middleware/EnsureAPIToken.php
@@ -24,7 +24,7 @@ public function handle(Request $request, Closure $next): Response
             $response = $next($request);
 
             if (method_exists($response, 'withCookie')) {
-                $response = $response->withCookie(cookie()->forever('restarters_apitoken', $token, null, null, false, false));
+                $response = $response->withCookie(cookie()->forever('restarters_apitoken', $token, null, null, $request->secure(), false));
             }
 
             return $response;
diff --git a/app/Network.php b/app/Network.php
index 231e3c4d2f..eb4069c18a 100644
--- a/app/Network.php
+++ b/app/Network.php
@@ -12,6 +12,15 @@ class Network extends Model
 {
     use HasFactory;
 
+    /**
+     * The network description is rendered with v-html in NetworkPage.vue, so sanitise it
+     * on write for the same reason as Group::setFreeTextAttribute().
+     */
+    public function setDescriptionAttribute($val)
+    {
+        $this->attributes['description'] = is_null($val) ? null : \Stevebauman\Purify\Facades\Purify::clean($val);
+    }
+
     /**
      * Get tags belonging to this network.
      */
diff --git a/app/Party.php b/app/Party.php
index cfc6a8a4fd..ac9ab31e9a 100644
--- a/app/Party.php
+++ b/app/Party.php
@@ -774,6 +774,15 @@ public function setEventEndUtcAttribute($val) {
         $this->attributes['event_end_utc'] = $dt->toDateTimeString();
     }
 
+    /**
+     * The event description is Quill-authored HTML which we render unescaped - on a public
+     * page - so it has to be sanitised.  Done in the mutator so every write path is
+     * covered by one rule.
+     */
+    public function setFreeTextAttribute($val) {
+        $this->attributes['free_text'] = is_null($val) ? null : \Stevebauman\Purify\Facades\Purify::clean($val);
+    }
+
     // Mutators for previous event_date/start/end fields.  These are now superceded by the UTC fields and therefore
     // should never be set directly.  Throw exceptions to ensure that they are not.
     public function setEventDateAttribute($val) {
diff --git a/app/Services/CheckAuthService.php b/app/Services/CheckAuthService.php
deleted file mode 100644
index 67b3648f35..0000000000
--- a/app/Services/CheckAuthService.php
+++ /dev/null
@@ -1,99 +0,0 @@
-<?php
-
-namespace App\Services;
-
-use Illuminate\Http\Request;
-use App\Helpers\Fixometer;
-use App\User;
-use Cookie;
-use Illuminate\Http\Resources\Json\JsonResource;
-use Lang;
-
-class CheckAuthService extends JsonResource
-{
-    /**
-     * @var object
-     */
-    private $menu;
-
-    /**
-     * @var bool
-     */
-    private $authenticated = null;
-
-    /**
-     * @var object
-     */
-    private $user;
-
-    /**
-     * @var string
-     */
-    private $edit_profile_link = '';
-
-    /**
-     * @var bool
-     */
-    private $is_admin = null;
-
-    /**
-     * @var bool
-     */
-    private $is_host = null;
-
-    public function __construct()
-    {
-        $this->edit_profile_link = url('/profile/edit/');
-
-        $this->menu = collect([
-            'general' => collect([]),
-            'reporting' => collect([]),
-            'user' => collect([]),
-        ]);
-
-        if (Cookie::get('authenticated')) {
-            $this->handle(Cookie::get('authenticated'));
-        }
-
-        $this->menu->get('general')->put(Lang::get('general.about_page'), Lang::get('general.about_page_url'));
-        $this->menu->get('general')->put(Lang::get('general.guidelines_page'), Lang::get('general.guidelines_page_url'));
-        $this->menu->get('general')->put(Lang::get('general.privacy_page'), Lang::get('general.privacy_page_url'));
-        $this->menu->get('general')->put(Lang::get('general.menu_help_feedback'), Lang::get('general.help_feedback_url'));
-        $this->menu->get('general')->put(Lang::get('general.menu_help_feedback'), Lang::get('general.help_feedback_url'));
-        $this->menu->get('general')->put(Lang::get('general.menu_faq'), Lang::get('general.faq_url'));
-        $this->menu->get('general')->put(Lang::get('general.therestartproject'), Lang::get('general.restartproject_url'));
-    }
-
-    private function handle($email)
-    {
-        $this->user = User::where('email', $email)->first();
-
-        if (! $this->user) {
-            return false;
-        }
-
-        $this->authenticated = true;
-        $this->edit_profile_link = $this->edit_profile_link.$this->user->id;
-
-        if ($this->is_host || $this->is_admin) {
-            $this->menu->get('reporting')->put('header', 'Reporting');
-
-            $this->menu->get('reporting')->put(Lang::get('general.party_reporting'), url('search'));
-
-            $this->menu->get('reporting')->put('reporting_spacer', 'spacer');
-        }
-    }
-
-    /**
-     * Transform the resource into an array.
-     */
-    public function toArray(Request $request): array
-    {
-        return [
-            'authenticated' => $this->authenticated,
-            'edit_profile_link' => $this->edit_profile_link,
-            'is_admin' => $this->is_admin,
-            'menu' => $this->menu->toArray(),
-        ];
-    }
-}
diff --git a/app/User.php b/app/User.php
index cc03afc130..10ef4c7a01 100644
--- a/app/User.php
+++ b/app/User.php
@@ -585,6 +585,22 @@ public function ensureAPIToken()
         return $api_token;
     }
 
+    /**
+     * Issue a new API token, invalidating the previous one.
+     *
+     * The token is a bearer credential for the whole API and is readable by the client's
+     * JavaScript, so anything that revokes access to the account - a password change or
+     * reset - has to replace it as well.
+     */
+    public function rotateAPIToken()
+    {
+        $api_token = \Illuminate\Support\Str::random(60);
+        $this->api_token = $api_token;
+        $this->save();
+
+        return $api_token;
+    }
+
     public function notifications()
     {
         return $this->morphMany(
diff --git a/composer.json b/composer.json
index 08ef157820..dac1f7f737 100644
--- a/composer.json
+++ b/composer.json
@@ -41,6 +41,7 @@
         "spatie/calendar-links": "^1.6",
         "spatie/laravel-validation-rules": "^3.4",
         "spinen/laravel-discourse-sso": "^2.8",
+        "stevebauman/purify": "^6.0",
         "symfony/http-client": "^6.2",
         "symfony/http-foundation": "^6.2",
         "symfony/mailgun-mailer": "^6.2",
diff --git a/composer.lock b/composer.lock
index 1903d38c14..d078b4c20f 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "bc96c0e7ddaad3d938052527512d5360",
+    "content-hash": "b47f3e23a394eb8308341eb299c09e40",
     "packages": [
         {
             "name": "addwiki/mediawiki-api",
@@ -1615,6 +1615,67 @@
             ],
             "time": "2023-06-01T07:04:22+00:00"
         },
+        {
+            "name": "ezyang/htmlpurifier",
+            "version": "v4.19.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/ezyang/htmlpurifier.git",
+                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/b287d2a16aceffbf6e0295559b39662612b77fcf",
+                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf",
+                "shasum": ""
+            },
+            "require": {
+                "php": "~5.6.0 || ~7.0.0 || ~7.1.0 || ~7.2.0 || ~7.3.0 || ~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0"
+            },
+            "require-dev": {
+                "cerdic/css-tidy": "^1.7 || ^2.0",
+                "simpletest/simpletest": "dev-master"
+            },
+            "suggest": {
+                "cerdic/css-tidy": "If you want to use the filter 'Filter.ExtractStyleBlocks'.",
+                "ext-bcmath": "Used for unit conversion and imagecrash protection",
+                "ext-iconv": "Converts text to and from non-UTF-8 encodings",
+                "ext-tidy": "Used for pretty-printing HTML"
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "library/HTMLPurifier.composer.php"
+                ],
+                "psr-0": {
+                    "HTMLPurifier": "library/"
+                },
+                "exclude-from-classmap": [
+                    "/library/HTMLPurifier/Language/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-2.1-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Edward Z. Yang",
+                    "email": "admin@htmlpurifier.org",
+                    "homepage": "http://ezyang.com"
+                }
+            ],
+            "description": "Standards compliant HTML filter written in PHP",
+            "homepage": "http://htmlpurifier.org/",
+            "keywords": [
+                "html"
+            ],
+            "support": {
+                "issues": "https://github.com/ezyang/htmlpurifier/issues",
+                "source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.0"
+            },
+            "time": "2025-10-17T16:34:55+00:00"
+        },
         {
             "name": "filp/whoops",
             "version": "2.18.4",
@@ -6999,6 +7060,72 @@
             },
             "time": "2024-04-14T21:40:02+00:00"
         },
+        {
+            "name": "stevebauman/purify",
+            "version": "v6.3.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/stevebauman/purify.git",
+                "reference": "deba4aa55a45a7593c369b52d481c87b545a5bf8"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/stevebauman/purify/zipball/deba4aa55a45a7593c369b52d481c87b545a5bf8",
+                "reference": "deba4aa55a45a7593c369b52d481c87b545a5bf8",
+                "shasum": ""
+            },
+            "require": {
+                "ezyang/htmlpurifier": "^4.17",
+                "illuminate/contracts": "^7.0|^8.0|^9.0|^10.0|^11.0|^12.0|^13.0",
+                "illuminate/support": "^7.0|^8.0|^9.0|^10.0|^11.0|^12.0|^13.0",
+                "php": ">=7.4"
+            },
+            "require-dev": {
+                "orchestra/testbench": "^5.0|^6.0|^7.0|^8.0|^9.0|^10.0|^11.0",
+                "phpunit/phpunit": "^8.0|^9.0|^10.0|^11.5.3|^12.5.12"
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "aliases": {
+                        "Purify": "Stevebauman\\Purify\\Facades\\Purify"
+                    },
+                    "providers": [
+                        "Stevebauman\\Purify\\PurifyServiceProvider"
+                    ]
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Stevebauman\\Purify\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Steve Bauman",
+                    "email": "steven_bauman@outlook.com"
+                }
+            ],
+            "description": "An HTML Purifier / Sanitizer for Laravel",
+            "keywords": [
+                "Purifier",
+                "clean",
+                "cleaner",
+                "html",
+                "laravel",
+                "purification",
+                "purify"
+            ],
+            "support": {
+                "issues": "https://github.com/stevebauman/purify/issues",
+                "source": "https://github.com/stevebauman/purify/tree/v6.3.2"
+            },
+            "time": "2026-03-18T16:42:42+00:00"
+        },
         {
             "name": "swagger-api/swagger-ui",
             "version": "v5.28.0",
diff --git a/config/purify.php b/config/purify.php
new file mode 100644
index 0000000000..f1d9e1cda7
--- /dev/null
+++ b/config/purify.php
@@ -0,0 +1,114 @@
+<?php
+
+use Stevebauman\Purify\Definitions\Html5Definition;
+
+/*
+|--------------------------------------------------------------------------
+| HTML sanitisation for user-authored rich text
+|--------------------------------------------------------------------------
+|
+| Group and event descriptions are Quill-authored HTML that we render unescaped, so
+| they are sanitised on write (see Group::setFreeTextAttribute and friends).
+|
+| The allowlist below is deliberately WIDER than the package default, because it was
+| derived from what the live content actually contains rather than from a guess. A
+| survey of the production data found ~5,100 links with target=, ~4,500 with rel=,
+| ~7,100 style attributes, ~1,300 class attributes, plus div, hr, sub, sup, font and a
+| handful of tables - all of which the default allowlist would have silently stripped
+| the next time a host edited their group. It also found zero instances of <script>,
+| <iframe>, <embed>, <object>, <form>, javascript: URLs or on* handlers, so nothing
+| legitimate depends on those.
+|
+| What keeps this safe is not the element list but HTMLPurifier's model: on* handlers
+| are never allowed at all, URIs are restricted to the schemes in URI.AllowedSchemes
+| (so javascript: cannot survive in href or src), and style attributes are parsed and
+| filtered down to CSS.AllowedProperties, so expression() and url(javascript:) go too.
+| HTML.TargetNoopener additionally forces rel="noopener" onto target="_blank" links.
+|
+| If you widen this, add elements and attributes - do not add schemes or relax
+| CSS.AllowedProperties to include anything that can fetch a URL.
+|
+*/
+
+return [
+
+    'default' => 'default',
+
+    'configs' => [
+
+        'default' => [
+            'Core.Encoding' => 'utf-8',
+            'HTML.Doctype' => 'HTML 4.01 Transitional',
+
+            'HTML.AllowedElements' => implode(',', [
+                // Text flow and headings.
+                'p', 'br', 'span', 'div', 'hr', 'pre', 'blockquote',
+                'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+                // Inline formatting, all of which appears in the live content.
+                'strong', 'b', 'em', 'i', 'u', 's', 'strike', 'del', 'ins', 'sub', 'sup', 'small', 'big', 'font',
+                // Lists.
+                'ul', 'ol', 'li',
+                // Links and images.
+                'a', 'img',
+                // A few groups use tables for opening hours and the like.
+                'table', 'thead', 'tbody', 'tr', 'td', 'th', 'caption',
+            ]),
+
+            'HTML.AllowedAttributes' => implode(',', [
+                // Quill uses class for alignment/indent; style is used throughout.
+                '*.class', '*.style', '*.title', '*.dir', '*.lang',
+                'a.href', 'a.target', 'a.rel', 'a.name',
+                'img.src', 'img.alt', 'img.width', 'img.height',
+                'table.border', 'table.summary',
+                'td.colspan', 'td.rowspan', 'td.abbr',
+                'th.colspan', 'th.rowspan', 'th.abbr', 'th.scope',
+                'font.color', 'font.size', 'font.face',
+                'ol.start', 'ol.type', 'li.value',
+                // Legacy presentational align, which the Transitional doctype rewrites into
+                // text-align CSS. Only p@center and table@left appear in the live data, but
+                // dropping it silently re-flows those descriptions.
+                'p.align', 'div.align', 'table.align', 'td.align', 'th.align', 'tr.align',
+                'h1.align', 'h2.align', 'h3.align', 'h4.align', 'h5.align', 'h6.align', 'img.align',
+            ]),
+
+            // Restricted to the properties the live content actually uses. Nothing here can
+            // reference a URL, and `position` is deliberately absent: absolute positioning
+            // inside user content is a UI-redressing vector.
+            'CSS.AllowedProperties' => implode(',', [
+                'font', 'font-size', 'font-family', 'font-weight', 'font-style', 'font-variant',
+                'color', 'background-color',
+                'text-align', 'text-decoration', 'text-indent', 'text-transform',
+                'line-height', 'letter-spacing', 'white-space', 'vertical-align', 'direction',
+                'margin', 'margin-top', 'margin-bottom', 'margin-left', 'margin-right',
+                'padding', 'padding-top', 'padding-bottom', 'padding-left', 'padding-right',
+                'border', 'border-collapse', 'border-color', 'border-style', 'border-width',
+                'width', 'height', 'list-style-type', 'list-style-position',
+            ]),
+            // box-sizing appears in the live data (pasted from elsewhere) but HTMLPurifier
+            // has no validator for it, and listing a property it cannot validate is a hard
+            // error rather than a no-op. It is cosmetic, so it gets dropped.
+
+            // Links opening in a new tab are common in the live content, so allow the
+            // target values that make sense and let HTMLPurifier add rel="noopener".
+            'Attr.AllowedFrameTargets' => '_blank,_self',
+            'HTML.TargetNoopener' => true,
+            'HTML.TargetNoreferrer' => false,
+
+            // Leave authored markup alone; we are sanitising, not reformatting.
+            'AutoFormat.AutoParagraph' => false,
+            'AutoFormat.RemoveEmpty' => false,
+        ],
+
+    ],
+
+    'definitions' => Html5Definition::class,
+
+    'css-definitions' => null,
+
+    'serializer' => [
+        // Laravel's cache rather than a serializer directory, so nothing on disk has to
+        // be writable in CI or on the Fly volumes.
+        'cache' => \Stevebauman\Purify\Cache\CacheDefinitionCache::class,
+    ],
+
+];
diff --git a/resources/js/app.js b/resources/js/app.js
index 4cc54ab738..4d107b6e55 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -1076,3 +1076,33 @@ function initAutocomplete() {
 // Start jQuery initialization (called earlier on line 509, don't duplicate here)
 // initializeJQuery();
 
+
+
+// Destructive actions are POST-only so that CSRF applies. Links marked
+// data-method="post" are submitted as a form carrying the CSRF token rather than
+// navigated to. Deliberately not a <button type="submit">: these links sit inside other
+// forms, where a nested form is dropped by the browser and an extra submit button would
+// be clicked ahead of the real save button.
+document.addEventListener('click', function (e) {
+  const link = e.target.closest ? e.target.closest('a[data-method="post"]') : null
+
+  if (!link) {
+    return
+  }
+
+  e.preventDefault()
+
+  const meta = document.querySelector('meta[name="csrf-token"]')
+  const form = document.createElement('form')
+  form.method = 'POST'
+  form.action = link.getAttribute('href')
+
+  const token = document.createElement('input')
+  token.type = 'hidden'
+  token.name = '_token'
+  token.value = meta ? meta.getAttribute('content') : ''
+  form.appendChild(token)
+
+  document.body.appendChild(form)
+  form.submit()
+})
diff --git a/resources/js/components/GroupActions.vue b/resources/js/components/GroupActions.vue
index 849541b805..f61e856896 100644
--- a/resources/js/components/GroupActions.vue
+++ b/resources/js/components/GroupActions.vue
@@ -110,7 +110,20 @@ export default {
       this.$refs.confirmArchive.show()
     },
     async deleteConfirmed() {
-      window.location = '/group/delete/' + this.idgroups
+      // Deleting is a POST so that it carries a CSRF token - navigating to a GET URL
+      // meant any page could trigger it in an admin's browser.
+      const form = document.createElement('form')
+      form.method = 'POST'
+      form.action = '/group/delete/' + this.idgroups
+
+      const token = document.createElement('input')
+      token.type = 'hidden'
+      token.name = '_token'
+      token.value = this.$store.getters['auth/CSRF']
+      form.appendChild(token)
+
+      document.body.appendChild(form)
+      form.submit()
     },
     async archiveConfirmed() {
       const group = this.group
diff --git a/resources/js/components/GroupPage.vue b/resources/js/components/GroupPage.vue
index 49b2a14360..51f07f58bc 100644
--- a/resources/js/components/GroupPage.vue
+++ b/resources/js/components/GroupPage.vue
@@ -159,8 +159,10 @@ export default {
       return this.$store.getters['groups/get'](this.idgroups)
     },
     translatedHaveLeft() {
+      // The string wraps :name in an <a> and this is rendered with v-html, so the group
+      // name has to be escaped here.
       return this.__('groups.now_unfollowed', {
-        name: this.group.name,
+        name: this.escapeHtml(this.group.name),
         link: '/group/view/' + this.group.id
       })
     }
diff --git a/resources/js/mixins/lang.js b/resources/js/mixins/lang.js
index 9128e8e681..38c4af0cbb 100644
--- a/resources/js/mixins/lang.js
+++ b/resources/js/mixins/lang.js
@@ -33,6 +33,21 @@ export default {
                 Sentry.captureMessage("Missing translation " + key)
                 return key
             }
+        },
+        // Translation strings can contain markup, and the translator interpolates
+        // :placeholder values into it without escaping.  Any value that comes from the
+        // database has to be escaped by the caller before it reaches a v-html binding.
+        escapeHtml(value) {
+            if (value === null || value === undefined) {
+                return ''
+            }
+
+            return String(value)
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;')
+                .replace(/'/g, '&#039;')
         }
     }
 }
diff --git a/resources/js/store/devices.js b/resources/js/store/devices.js
index 839b04a078..af4c87e30f 100644
--- a/resources/js/store/devices.js
+++ b/resources/js/store/devices.js
@@ -260,7 +260,7 @@ export default {
     async deleteImage({commit, rootGetters}, params) {
       if (params.id && params.idxref) {
         const url = '/device/image/delete/' + params.id + '/' + params.idxref
-        const ret = await axios.get(url, {
+        const ret = await axios.post(url, {}, {
           headers: {
             'X-CSRF-TOKEN': rootGetters['auth/CSRF']
           }
diff --git a/resources/views/auth/register-new.blade.php b/resources/views/auth/register-new.blade.php
index 02003a279a..0b4f4ce71f 100644
--- a/resources/views/auth/register-new.blade.php
+++ b/resources/views/auth/register-new.blade.php
@@ -43,7 +43,7 @@
                   @foreach ($skills[$key] as $skill)
                     <div class="col-6 col-lg-3">
                         <input @if( is_array(old('skills')) && in_array($skill->id, old('skills')) ) checked @endif type="checkbox" name="skills[]" id="skill-{{ $skill->id }}" class="styled-checkbox" value="{{ $skill->id }}">
-                        <label for="skill-{{ $skill->id }}" class="btn btn-checkbox"><span>@lang($skill->skill_name)</span></label>
+                        <label for="skill-{{ $skill->id }}" class="btn btn-checkbox"><span>{{ __($skill->skill_name) }}</span></label>
                     </div>
                   @endforeach
               </div>
diff --git a/resources/views/events/edit.blade.php b/resources/views/events/edit.blade.php
index 4dc4530a13..233f29320c 100644
--- a/resources/views/events/edit.blade.php
+++ b/resources/views/events/edit.blade.php
@@ -17,7 +17,7 @@
         <div class="row">
       <div class="col">
         <h1 class="mb-30 mr-30">
-            @lang('events.editing', ['event' => '<a style="color:black; text-decoration:underline" href="/party/view/'. $formdata['idevents'] .'">'. $formdata['venue'] .'</a>'])
+            @lang('events.editing', ['event' => '<a style="color:black; text-decoration:underline" href="/party/view/'. intval($formdata['idevents']) .'">'. e($formdata['venue']) .'</a>'])
         </h1>
       </div>
     </div>
@@ -91,7 +91,7 @@
                         <div id="device-image-{{ $formdata['idevents'] }}" class="dz-image">
                           <a href="/uploads/{{ $image->path }}" data-toggle="lightbox">
                           <img src="/uploads/thumbnail_{{ $image->path }}" alt="placeholder"></a>
-                          <a href="/party/image/delete/{{ $formdata['idevents'] }}/{{{ $image->idimages }}}/{{{ $image->path }}}" data-device-id="{{ $formdata['idevents'] }}" class="dz-remove ajax-delete-image">Remove file</a>
+                          <a href="/party/image/delete/{{ $formdata['idevents'] }}/{{{ $image->idimages }}}/{{{ $image->path }}}" data-method="post" data-device-id="{{ $formdata['idevents'] }}" class="dz-remove ajax-delete-image">Remove file</a>
                         </div>
                       @endforeach
                     @endif
diff --git a/resources/views/events/view.blade.php b/resources/views/events/view.blade.php
index fb0aff8ae3..8908ae38d5 100644
--- a/resources/views/events/view.blade.php
+++ b/resources/views/events/view.blade.php
@@ -42,7 +42,7 @@
       @if (\Session::has('prompt-follow-group'))
         <div class="alert alert-info" style="min-height: 88px;">
           <div class="row">
-            <div class="col-md-8 col-lg-9 d-flex flex-column align-content-center">@lang('events.follow_hosting_group', ['group' => $event->theGroup->name])</div>
+            <div class="col-md-8 col-lg-9 d-flex flex-column align-content-center">@lang('events.follow_hosting_group', ['group' => e($event->theGroup->name)])</div>
             <div class="col-md-4 col-lg-3 d-flex flex-column align-content-center">
               <a href="/group/join/{{ $event->theGroup->idgroups }}" class="btn btn-info">@lang('groups.join_group_button')</a>
             </div>
diff --git a/resources/views/includes/modals/event-description.blade.php b/resources/views/includes/modals/event-description.blade.php
index 7eece6a26d..b3d74e1684 100644
--- a/resources/views/includes/modals/event-description.blade.php
+++ b/resources/views/includes/modals/event-description.blade.php
@@ -6,7 +6,7 @@
 
       <div class="modal-header">
 
-        <h5 id="eventDescriptionLabel">@lang('events.about_event_name_header', ['event' => $formdata->venue])</h5>
+        <h5 id="eventDescriptionLabel">@lang('events.about_event_name_header', ['event' => e($formdata->venue)])</h5>
         @include('partials.cross')
 
       </div>
diff --git a/resources/views/includes/modals/event-invite-to.blade.php b/resources/views/includes/modals/event-invite-to.blade.php
index 29fd70e9ce..df1839d10d 100644
--- a/resources/views/includes/modals/event-invite-to.blade.php
+++ b/resources/views/includes/modals/event-invite-to.blade.php
@@ -68,7 +68,7 @@
                 <div class="form-check">
                   <label class="form-check-label" for="invites_to_volunteers">
                     <input type="checkbox" name="invite_group" class="form-check-input" id="invites_to_volunteers" value="1" data-member-emails="{{ implode(',', $memberEmails) }}">
-                    @lang('events.send_invites_to_restarters_tickbox', ['group' => $formdata->group_name])
+                    @lang('events.send_invites_to_restarters_tickbox', ['group' => e($formdata->group_name)])
                   </label>
                 </div>
                 <br>
diff --git a/resources/views/includes/modals/event-share-stats.blade.php b/resources/views/includes/modals/event-share-stats.blade.php
index f6c82359be..0a5035653e 100644
--- a/resources/views/includes/modals/event-share-stats.blade.php
+++ b/resources/views/includes/modals/event-share-stats.blade.php
@@ -14,7 +14,7 @@
 
       <div class="modal-body">
 
-          <p>@lang('events.share_stats_message', ['date' => $event->getFormattedLocalStart(), 'event_name' => $formdata->venue, 'number_devices' => $stats['fixed_devices']])</p>
+          <p>@lang('events.share_stats_message', ['date' => $event->getFormattedLocalStart(), 'event_name' => e($formdata->venue), 'number_devices' => $stats['fixed_devices']])</p>
 
         <div id="accordionEvent" class="accordion__share mt-4">
 
diff --git a/resources/views/includes/modals/group-description.blade.php b/resources/views/includes/modals/group-description.blade.php
index b928232910..0bda30a9b6 100644
--- a/resources/views/includes/modals/group-description.blade.php
+++ b/resources/views/includes/modals/group-description.blade.php
@@ -6,7 +6,7 @@
 
       <div class="modal-header">
 
-        <h5 id="groupDescriptionLabel">@lang('groups.about_group_name_header', ['group' => $group->name])</h5>
+        <h5 id="groupDescriptionLabel">@lang('groups.about_group_name_header', ['group' => e($group->name)])</h5>
         @include('partials.cross')
 
       </div>
diff --git a/resources/views/includes/modals/group-share-stats.blade.php b/resources/views/includes/modals/group-share-stats.blade.php
index 1ad7cc0d79..d7ac30e584 100644
--- a/resources/views/includes/modals/group-share-stats.blade.php
+++ b/resources/views/includes/modals/group-share-stats.blade.php
@@ -13,7 +13,7 @@
 
       <div class="modal-body">
 
-        <p>@lang('groups.share_stats_message', ['group' => $group->name])</p>
+        <p>@lang('groups.share_stats_message', ['group' => e($group->name)])</p>
 
         <div id="accordionGroup" class="accordion__share mt-4">
 
diff --git a/resources/views/layouts/navbar.blade.php b/resources/views/layouts/navbar.blade.php
index 4b27c95753..612e49be43 100644
--- a/resources/views/layouts/navbar.blade.php
+++ b/resources/views/layouts/navbar.blade.php
@@ -134,7 +134,7 @@
                               @if ( App\Helpers\Fixometer::hasRole(Auth::user(), 'NetworkCoordinator') )
                                   @if (count(Auth::user()->networks) == 1)
                                       @php( $network = Auth::user()->networks->first() )
-                                      <li><a href="{{ route('networks.show', $network->id) }}">@lang('networks.general.particular_network', ['networkName' => $network->name])</a></li>
+                                      <li><a href="{{ route('networks.show', $network->id) }}">@lang('networks.general.particular_network', ['networkName' => e($network->name)])</a></li>
                                   @else
                                       <li><a href="{{ route('networks.index') }}">@lang('networks.general.networks')</a></li>
                                   @endif
diff --git a/resources/views/networks/partials/add-group-modal.blade.php b/resources/views/networks/partials/add-group-modal.blade.php
index 9c1014997b..3b441e32df 100644
--- a/resources/views/networks/partials/add-group-modal.blade.php
+++ b/resources/views/networks/partials/add-group-modal.blade.php
@@ -5,7 +5,7 @@
 
     <div class="modal-header">
 
-        <h5 id="addVolunteerEventLabel">@lang('networks.show.add_groups_modal_header', ['name' => $network->name])</h5>
+        <h5 id="addVolunteerEventLabel">@lang('networks.show.add_groups_modal_header', ['name' => e($network->name)])</h5>
         @include('partials.cross')
 
     </div>
diff --git a/resources/views/partials/log-accordion.blade.php b/resources/views/partials/log-accordion.blade.php
index 4d9c2413a1..7017aa144a 100644
--- a/resources/views/partials/log-accordion.blade.php
+++ b/resources/views/partials/log-accordion.blade.php
@@ -5,7 +5,13 @@
           <div class="card-header p-0" id="heading{{{ $audit->id }}}">
             <h5 class="mb-0">
               <button class="btn btn-link text-left" type="button" data-toggle="collapse" data-target="#collapse{{{ $audit->id }}}" aria-expanded="true" aria-controls="collapse{{{ $audit->id }}}">
-                  @lang($type.'.'.$audit->event.'.metadata', $audit->getMetadata())
+                  {{-- @lang() compiles to an unescaped echo and the translator does not escape
+                       its replacements, while the metadata strings wrap them in markup.  Two of
+                       the values are attacker-controlled: user_name is a display name, and
+                       audit_url is the request URL including its query string.  Escape the
+                       values rather than the string, so the markup in the string survives. --}}
+                  @php($metadata = collect($audit->getMetadata())->map(fn ($v) => is_null($v) ? '' : e(is_scalar($v) ? (string) $v : json_encode($v)))->all())
+                  @lang($type.'.'.$audit->event.'.metadata', $metadata)
               </button>
             </h5>
           </div>
@@ -18,7 +24,7 @@
                             {{-- Some updated data is an array. --}}
                             @php($modified['new'] = is_array($modified['new']) ? json_encode($modified['new']) : $modified['new'])
                             @if(gettype($modified) == 'string')
-                            <td>@lang($type.'.'.$audit->event.'.modified.'.$attribute, $modified)</td>
+                            <td>@lang($type.'.'.$audit->event.'.modified.'.$attribute, ['old' => e($modified), 'new' => e($modified)])</td>
                             @else
                             <td>{{ $type.'.'.$audit->event.'.modified.'.$attribute . " " . json_encode($modified) }}</td>
                             @endif
diff --git a/resources/views/skills/edit.blade.php b/resources/views/skills/edit.blade.php
index 635559651b..3fa643222f 100644
--- a/resources/views/skills/edit.blade.php
+++ b/resources/views/skills/edit.blade.php
@@ -63,7 +63,7 @@
 
             <div class="button-group row">
                 <div class="col-6 d-flex align-items-center justify-content-start">
-                    <a href="/skills/delete/{{ $skill->id }}" class="btn btn-primary btn-danger">@lang('admin.delete-skill')</a>
+                    <a href="/skills/delete/{{ $skill->id }}" data-method="post" class="btn btn-primary btn-danger">@lang('admin.delete-skill')</a>
                 </div>
                 <div class="col-6 d-flex align-items-center justify-content-end">
                     <button type="submit" class="btn btn-primary btn-create">@lang('admin.save-skill')</button>
diff --git a/resources/views/tags/edit.blade.php b/resources/views/tags/edit.blade.php
index 033764e3a3..fa7386672c 100644
--- a/resources/views/tags/edit.blade.php
+++ b/resources/views/tags/edit.blade.php
@@ -52,7 +52,7 @@
 
         <div class="button-group row">
             <div class="col-6 d-flex align-items-center justify-content-start">
-                <a href="/tags/delete/{{ $tag->id }}" class="btn btn-primary btn-danger">@lang('admin.delete-tag')</a>
+                <a href="/tags/delete/{{ $tag->id }}" data-method="post" class="btn btn-primary btn-danger">@lang('admin.delete-tag')</a>
             </div>
             <div class="col-6 d-flex align-items-center justify-content-end">
                 <button type="submit" class="btn btn-primary btn-create">@lang('admin.save-tag')</button>
diff --git a/resources/views/user/all.blade.php b/resources/views/user/all.blade.php
index 50223f5f10..c33e5c10e2 100644
--- a/resources/views/user/all.blade.php
+++ b/resources/views/user/all.blade.php
@@ -98,7 +98,7 @@
                     @if (isset($role) && $r->idroles == $role)
                       <option value="{{ $r->idroles }}" selected>{{ $r->role }}</option>
                     @else
-                      <option value="{{ $r->idroles }}">@lang($r->role)</option>
+                      <option value="{{ $r->idroles }}">{{ __($r->role) }}</option>
                     @endif
                   @endforeach
                 </select>
@@ -181,7 +181,7 @@
                         </span>
                       </td>
                       <td>
-                          @lang($u->role)
+                          {{ __($u->role) }}
                       </td>
                       <td class="d-none d-sm-table-cell">
                         @if (!empty($u->location))
diff --git a/resources/views/user/profile-new.blade.php b/resources/views/user/profile-new.blade.php
index 4052bc85fc..9a8c7b6cc5 100644
--- a/resources/views/user/profile-new.blade.php
+++ b/resources/views/user/profile-new.blade.php
@@ -60,7 +60,7 @@
               @if ($user->biography)
                   {{ $user->biography }}
               @else
-                  <em>@lang('profile.no_bio', ['name' => $user->name])</em>
+                  <em>@lang('profile.no_bio', ['name' => e($user->name)])</em>
               @endif
           </p>
         </div>
diff --git a/resources/views/user/profile/profile.blade.php b/resources/views/user/profile/profile.blade.php
index 80fc2d4ac4..f197772218 100644
--- a/resources/views/user/profile/profile.blade.php
+++ b/resources/views/user/profile/profile.blade.php
@@ -103,12 +103,12 @@
             <label for="tags[]">@lang('general.your_repair_skills'):</label>
             <select id="tags" name="tags[]" class="form-control" multiple size="10">
                 @foreach( App\Helpers\Fixometer::skillCategories() as $key => $skill_category )
-                    <optgroup label="@lang($skill_category)">
+                    <optgroup label="{{ __($skill_category) }}">
                     @foreach ($skills[$key] as $skill)
                         @if ( !empty($user_skills) && in_array($skill->id, $user_skills))
-                        <option value="{{ $skill->id }}" selected>@lang($skill->skill_name)</option>
+                        <option value="{{ $skill->id }}" selected>{{ __($skill->skill_name) }}</option>
                         @else
-                        <option value="{{ $skill->id }}">@lang($skill->skill_name)</option>
+                        <option value="{{ $skill->id }}">{{ __($skill->skill_name) }}</option>
                         @endif
                     @endforeach
                     </optgroup>
diff --git a/routes/web.php b/routes/web.php
index c6cd8338ce..78480bd7de 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -334,7 +334,7 @@
         });
         Route::get('/search', [DeviceController::class, 'search']);
         Route::post('/image-upload/{id}', [DeviceController::class, 'imageUpload']);
-        Route::get('/image/delete/{iddevices}/{idxref}', [DeviceController::class, 'deleteImage']);
+        Route::post('/image/delete/{iddevices}/{idxref}', [DeviceController::class, 'deleteImage']);
     });
 
     Route::resource('networks', NetworkController::class)->only([
@@ -355,13 +355,13 @@
         Route::get('/accept-invite/{id}/{hash}', [GroupController::class, 'confirmInvite']);
         Route::get('/join/{id}', [GroupController::class, 'getJoinGroup']);
         Route::post('/image-upload/{id}', [GroupController::class, 'imageUpload']);
-        Route::get('/image/delete/{idgroups}/{id}/{path}', [GroupController::class, 'ajaxDeleteImage']);
+        Route::post('/image/delete/{idgroups}/{id}/{path}', [GroupController::class, 'ajaxDeleteImage']);
         Route::get('/', [GroupController::class, 'mine'])->name('groups');
         Route::get('/all', [GroupController::class, 'all']);
         Route::get('/mine', [GroupController::class, 'mine']);
         Route::get('/nearby', [GroupController::class, 'nearby']);
         Route::get('/network/{id}', [GroupController::class, 'network']);
-        Route::get('/delete/{id}', [GroupController::class, 'delete']);
+        Route::post('/delete/{id}', [GroupController::class, 'delete']);
     });
 
     //Party Controller
@@ -375,7 +375,6 @@
         Route::post('/edit/{id}', [PartyController::class, 'edit']);
         Route::get('/duplicate/{id}', [PartyController::class, 'duplicate']);
         Route::post('/delete/{id}', [PartyController::class, 'deleteEvent']);
-        Route::get('/deleteimage', [PartyController::class, 'deleteimage']);
         Route::get('/join/{id}', [PartyController::class, 'getJoinEvent']);
         Route::post('/invite', [PartyController::class, 'postSendInvite']);
         Route::get('/accept-invite/{id}/{hash}', [PartyController::class, 'confirmInvite']);
@@ -384,7 +383,7 @@
         Route::get('/get-group-emails-with-names/{event_id}', [PartyController::class, 'getGroupEmailsWithNames']);
         Route::post('/update-quantity', [PartyController::class, 'updateQuantity']);
         Route::post('/image-upload/{id}', [PartyController::class, 'imageUpload']);
-        Route::get('/image/delete/{idevents}/{id}/{path}', [PartyController::class, 'deleteImage']);
+        Route::post('/image/delete/{idevents}/{id}/{path}', [PartyController::class, 'deleteImage']);
         Route::get('/contribution/{id}', [PartyController::class, 'getContributions']);
         Route::post('/update-volunteerquantity', [PartyController::class, 'updateVolunteerQuantity']);
     });
@@ -403,7 +402,7 @@
         Route::post('/create', [BrandsController::class, 'postCreateBrand']);
         Route::get('/edit/{id}', [BrandsController::class, 'getEditBrand']);
         Route::post('/edit/{id}', [BrandsController::class, 'postEditBrand']);
-        Route::get('/delete/{id}', [BrandsController::class, 'getDeleteBrand']);
+        Route::post('/delete/{id}', [BrandsController::class, 'getDeleteBrand']);
     });
 
     //Skills Controller
@@ -412,7 +411,7 @@
         Route::post('/create', [SkillsController::class, 'postCreateSkill']);
         Route::get('/edit/{id}', [SkillsController::class, 'getEditSkill']);
         Route::post('/edit/{id}', [SkillsController::class, 'postEditSkill']);
-        Route::get('/delete/{id}', [SkillsController::class, 'getDeleteSkill']);
+        Route::post('/delete/{id}', [SkillsController::class, 'getDeleteSkill']);
     });
 
     //GroupTags Controller
@@ -421,7 +420,7 @@
         Route::post('/create', [GroupTagsController::class, 'postCreateTag']);
         Route::get('/edit/{id}', [GroupTagsController::class, 'getEditTag']);
         Route::post('/edit/{id}', [GroupTagsController::class, 'postEditTag']);
-        Route::get('/delete/{id}', [GroupTagsController::class, 'getDeleteTag']);
+        Route::post('/delete/{id}', [GroupTagsController::class, 'getDeleteTag']);
     });
 });
 
@@ -458,10 +457,6 @@
 
     Route::post('/set-cookie', InformationAlertCookieController::class);
 
-    Route::get('/test/check-auth', function () {
-        return new \App\Services\CheckAuthService;
-    });
-
     Route::prefix('style')->group(function () {
         Route::get('/', [StyleController::class, 'index']);
         Route::get('/guide', [StyleController::class, 'guide']);
diff --git a/tests/Feature/Brands/BrandsTest.php b/tests/Feature/Brands/BrandsTest.php
index d22bb2f7cc..51540619cd 100644
--- a/tests/Feature/Brands/BrandsTest.php
+++ b/tests/Feature/Brands/BrandsTest.php
@@ -42,7 +42,7 @@ public function testBasic(): void
         $response->assertSee('UT Brand2');
 
         // Delete
-        $response = $this->get('/brands/delete/' . $brand->id);
+        $response = $this->post('/brands/delete/' . $brand->id);
         $response->assertRedirect();
         $response->assertSessionHas('message');
     }
@@ -66,7 +66,7 @@ public function testErrors(): void {
         ]);
         $response->assertRedirect('/user/forbidden');
 
-        $response = $this->get('/brands/delete/1');
+        $response = $this->post('/brands/delete/1');
         $response->assertRedirect('/user/forbidden');
     }
 }
diff --git a/tests/Feature/Devices/EditTest.php b/tests/Feature/Devices/EditTest.php
index ed5448b7f0..7944bc4ce6 100644
--- a/tests/Feature/Devices/EditTest.php
+++ b/tests/Feature/Devices/EditTest.php
@@ -141,7 +141,7 @@ public function testDeviceEditAddImage(): void {
         self::assertEquals(2, count($ret['images']));
 
         // Delete one
-        $response3 = $this->json('GET', '/device/image/delete/' . $iddevices . '/' . $ret['images'][0]['idxref'], $params);
+        $response3 = $this->json('POST', '/device/image/delete/' . $iddevices . '/' . $ret['images'][0]['idxref'], $params);
         $this->assertTrue($response3->isRedirection());
         $response3->assertSessionHas('message');
         $this->assertEquals('Thank you, the image has been deleted', \Session::get('message'));
@@ -197,7 +197,7 @@ public function testDeviceAddAddImage(): void {
         self::assertEquals(2, count($ret['images']));
 
         // Delete one
-        $response3 = $this->json('GET', '/device/image/delete/' . $iddevices . '/' . $ret['images'][0]['idxref'], $params);
+        $response3 = $this->json('POST', '/device/image/delete/' . $iddevices . '/' . $ret['images'][0]['idxref'], $params);
         $this->assertTrue($response3->isRedirection());
         $response3->assertSessionHas('message');
         $this->assertEquals('Thank you, the image has been deleted', \Session::get('message'));
diff --git a/tests/Feature/Events/ExportTest.php b/tests/Feature/Events/ExportTest.php
index 75cacbd516..a653e54856 100644
--- a/tests/Feature/Events/ExportTest.php
+++ b/tests/Feature/Events/ExportTest.php
@@ -88,7 +88,12 @@ public function testExport($role): void
         $event2->approved = true;
         $event2->save();
 
+        // group3 is deliberately left unapproved and unrelated to $user - the point of the
+        // test is that its data stays out of $user's export - so create its event as the
+        // admin rather than as $user, who has no authority over that group.
+        $this->actingAs($admin);
         $idevents3 = $this->createEvent($group3->idgroups, '2000-01-01');
+        $this->actingAs($user);
         $event3 = Party::find($idevents3);
         $event3->approved = true;
         $event3->save();
@@ -113,7 +118,7 @@ public function testExport($role): void
         // Export parties.
         $response = $this->get("/export/groups/{$group1->idgroups}/events");
         $response->assertSuccessful();
-        $filename = 'events.csv';
+        $filename = storage_path('app/exports') . '/events.csv';
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -122,7 +127,7 @@ public function testExport($role): void
 
         $response = $this->get("/export/groups/{$group2->idgroups}/events");
         $response->assertSuccessful();
-        $filename = 'events.csv';
+        $filename = storage_path('app/exports') . '/events.csv';
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -131,7 +136,7 @@ public function testExport($role): void
 
         $response = $this->get("/export/networks/{$network->id}/events");
         $response->assertSuccessful();
-        $filename = 'events.csv';
+        $filename = storage_path('app/exports') . '/events.csv';
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -147,7 +152,7 @@ public function testExport($role): void
         // Export devices.
         $response = $this->get("/export/devices");
         $header = $response->headers->get('content-disposition');
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
 
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
@@ -168,7 +173,7 @@ public function testExport($role): void
         // Export devices for a particular event.
         $response = $this->get("/export/devices/event/$idevents1");
         $header = $response->headers->get('content-disposition');
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -177,7 +182,7 @@ public function testExport($role): void
 
         $response = $this->get("/export/devices/event/$idevents2");
         $header = $response->headers->get('content-disposition');
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -185,7 +190,7 @@ public function testExport($role): void
 
         $response = $this->get("/export/devices/event/$idevents3");
         $header = $response->headers->get('content-disposition');
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -199,7 +204,7 @@ public function testExport($role): void
         // Export devices for a particular group.
         $response = $this->get("/export/devices/group/{$group1->idgroups}");
         $header = $response->headers->get('content-disposition');
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -207,7 +212,7 @@ public function testExport($role): void
 
         $response = $this->get("/export/devices/group/{$group2->idgroups}");
         $header = $response->headers->get('content-disposition');
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -215,7 +220,7 @@ public function testExport($role): void
 
         $response = $this->get("/export/devices/group/{$group3->idgroups}");
         $header = $response->headers->get('content-disposition');
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
         $fh = fopen($filename, 'r');
         fgetcsv($fh);
         $row2 = fgetcsv($fh);
@@ -276,7 +281,7 @@ public function testSlashesExport()
         $this->assertStringContainsString($expectedFilename, $header);
 
         // Verify the file can be read
-        $filename = public_path() . '/' . $expectedFilename;
+        $filename = storage_path('app/exports') . '/' . $expectedFilename;
         $this->assertFileExists($filename);
         $fh = fopen($filename, 'r');
         $this->assertNotFalse($fh);
@@ -294,7 +299,7 @@ public function testSlashesExport()
         $this->assertStringContainsString('.csv', $header);
 
         // Verify the event export file can be read and contains event data
-        $filename = public_path() . '/' . substr($header, strpos($header, 'filename=') + 9);
+        $filename = storage_path('app/exports') . '/' . substr($header, strpos($header, 'filename=') + 9);
         $this->assertFileExists($filename);
         $fh = fopen($filename, 'r');
         $this->assertNotFalse($fh);
@@ -354,7 +359,7 @@ public function testEmdashInGroupNameExport()
             $response = $this->get("/export/networks/{$network->id}/events");
             $response->assertSuccessful();
 
-            $filename = 'events.csv';
+            $filename = storage_path('app/exports') . '/events.csv';
             $this->assertFileExists($filename);
             $fh = fopen($filename, 'r');
             $this->assertNotFalse($fh);
diff --git a/tests/Feature/Events/ModerationEventPhotosNotificationTest.php b/tests/Feature/Events/ModerationEventPhotosNotificationTest.php
index 4885ee1203..d5f0cb96b7 100644
--- a/tests/Feature/Events/ModerationEventPhotosNotificationTest.php
+++ b/tests/Feature/Events/ModerationEventPhotosNotificationTest.php
@@ -89,7 +89,7 @@ function ($notification, $channels, $admin) use ($event) {
         $image = \DB::select("SELECT idimages, path FROM images ORDER BY idimages DESC LIMIT 1");
         $idimages = $image[0]->idimages;
         $path = $image[0]->path;
-        $response = $this->get("/party/image/delete/{$event->idevents}/$idimages/$path");
+        $response = $this->post("/party/image/delete/{$event->idevents}/$idimages/$path");
         $response->assertRedirect();
         $response->assertSessionHas('success');
     }
diff --git a/tests/Feature/Events/OnlineEventsTest.php b/tests/Feature/Events/OnlineEventsTest.php
index 699312de81..a6f3ce98a4 100644
--- a/tests/Feature/Events/OnlineEventsTest.php
+++ b/tests/Feature/Events/OnlineEventsTest.php
@@ -32,7 +32,9 @@ public function a_host_can_create_an_online_event(): void
         $group->makeMemberAHost($host);
 
         // act
-        $eventAttributes = Party::factory()->raw(['online' => true]);
+        // PartyFactory creates its own group, so point the event at the group this host
+        // actually hosts - otherwise this is testing cross-group event creation.
+        $eventAttributes = Party::factory()->raw(['online' => true, 'group' => $group->idgroups]);
         $response = $this->post('/api/v2/events?api_token=' . $host->api_token, $this->eventAttributesToAPI($eventAttributes));
         $response->assertSuccessful();
         $idevents = Party::latest()->first()->idevents;
diff --git a/tests/Feature/Fixometer/BasicTest.php b/tests/Feature/Fixometer/BasicTest.php
index 09a9e7dcb4..eaea370106 100644
--- a/tests/Feature/Fixometer/BasicTest.php
+++ b/tests/Feature/Fixometer/BasicTest.php
@@ -131,7 +131,7 @@ public function testExport(): void {
 
         // Bit hacky, but grab the file that was created.  Can't find a way to do this in Laravel easily, though it's
         // probably possible using mocking.
-        $filename = base_path() . DIRECTORY_SEPARATOR . 'public' . DIRECTORY_SEPARATOR . 'repair-data.csv';
+        $filename = storage_path('app' . DIRECTORY_SEPARATOR . 'exports') . DIRECTORY_SEPARATOR . 'repair-data.csv';
         $fh = fopen($filename, 'r');
 
         # Skip headers.
diff --git a/tests/Feature/Groups/GroupDeleteTest.php b/tests/Feature/Groups/GroupDeleteTest.php
index f81e0c0125..e35725f8e4 100644
--- a/tests/Feature/Groups/GroupDeleteTest.php
+++ b/tests/Feature/Groups/GroupDeleteTest.php
@@ -22,14 +22,14 @@ public function testDelete(): void
             $user = \App\User::factory()->{lcfirst($role)}()->create();
             $this->actingAs($user);
             $this->followingRedirects();
-            $response = $this->get("/group/delete/$id");
+            $response = $this->post("/group/delete/$id");
             $this->assertStringContainsString('Sorry, but you do not have the permissions to perform that action', $response->getContent());
         }
 
         $user = \App\User::factory()->administrator()->create();
         $this->actingAs($user);
         $this->followingRedirects();
-        $response = $this->get("/group/delete/$id");
+        $response = $this->post("/group/delete/$id");
         $this->assertStringContainsString(__('groups.delete_succeeded', [
             'name' => $name,
         ]), $response->getContent());
@@ -49,7 +49,7 @@ public function testCanDeleteWithEmptyEvent(): void
         $user = \App\User::factory()->administrator()->create();
         $this->actingAs($user);
         $this->followingRedirects();
-        $response = $this->get("/group/delete/$id");
+        $response = $this->post("/group/delete/$id");
         $this->assertStringContainsString(__('groups.delete_succeeded', [
             'name' => $name,
         ]), $response->getContent());
@@ -68,13 +68,13 @@ public function testCantDeleteWithDevice(): void
         $user = \App\User::factory()->administrator()->create();
         $this->actingAs($user);
         $this->followingRedirects();
-        $response = $this->get("/group/delete/$id");
+        $response = $this->post("/group/delete/$id");
         $this->assertStringContainsString('Sorry, but you do not have the permissions to perform that action.', $response->getContent());
 
         // Delete the event - still shouldn't be deletable as a device exists.
         Party::find($idevents)->delete();
 
-        $response = $this->get("/group/delete/$id");
+        $response = $this->post("/group/delete/$id");
         $response->assertRedirect('/user/forbidden');
     }
 
@@ -93,7 +93,7 @@ public function testCanDeleteWithDeletedEvent(): void
 
         // Should
         $event->delete();
-        $response = $this->get("/group/delete/$id");
+        $response = $this->post("/group/delete/$id");
         $response->assertRedirect();
         $response->assertSessionHas('success');
     }
diff --git a/tests/Feature/Groups/GroupEditTest.php b/tests/Feature/Groups/GroupEditTest.php
index 1f91b1c7de..7534a6d6fe 100644
--- a/tests/Feature/Groups/GroupEditTest.php
+++ b/tests/Feature/Groups/GroupEditTest.php
@@ -131,7 +131,7 @@ public function image_upload(): void {
         $image = \DB::select("SELECT idimages, path FROM images ORDER BY idimages DESC LIMIT 1");
         $idimages = $image[0]->idimages;
         $path = $image[0]->path;
-        $response = $this->get("/group/image/delete/{$group->idgroups}/$idimages/$path");
+        $response = $this->post("/group/image/delete/{$group->idgroups}/$idimages/$path");
         $response->assertOk();
         self::assertEquals('Thank you, the image has been deleted', $response->getContent());
     }
diff --git a/tests/Feature/Groups/GroupTagsTest.php b/tests/Feature/Groups/GroupTagsTest.php
index b51bb4a050..c90232e8d3 100644
--- a/tests/Feature/Groups/GroupTagsTest.php
+++ b/tests/Feature/Groups/GroupTagsTest.php
@@ -90,12 +90,12 @@ public function testDelete(): void {
         $tag = GroupTags::factory()->create();
 
         $admin = $this->loginAsTestUser(Role::RESTARTER);
-        $response = $this->get('/tags/delete/' . $tag->id);
+        $response = $this->post('/tags/delete/' . $tag->id);
         $response->assertRedirect('/user/forbidden');
 
         $admin = $this->loginAsTestUser(Role::ADMINISTRATOR);
 
-        $response = $this->get('/tags/delete/' . $tag->id);
+        $response = $this->post('/tags/delete/' . $tag->id);
         $response->assertRedirect();
         $response->assertSessionHas('success');
     }
diff --git a/tests/Feature/Security/AuthorizationHardeningTest.php b/tests/Feature/Security/AuthorizationHardeningTest.php
new file mode 100644
index 0000000000..160533df0f
--- /dev/null
+++ b/tests/Feature/Security/AuthorizationHardeningTest.php
@@ -0,0 +1,293 @@
+<?php
+
+namespace Tests\Feature\Security;
+
+use App\Device;
+use App\Group;
+use App\Party;
+use App\Role;
+use App\User;
+use App\UserGroups;
+use Tests\TestCase;
+
+/**
+ * Missing per-object authorization checks.
+ *
+ * Two families here:
+ *
+ *  1. The three image-upload endpoints, where the sibling delete-image endpoint
+ *     got an ownership check and the upload endpoint did not.
+ *  2. updateDevicev2, which authorises against an event id taken from the request
+ *     body but mutates a device identified by the URL path — the two were never
+ *     reconciled. Plus createEventv2, which only checks that the caller hosts
+ *     *some* group (a standing TODO in the code).
+ *
+ * Written before the fixes; these should fail on the unpatched code.
+ */
+class AuthorizationHardeningTest extends TestCase
+{
+    /** Make $user a host of a newly created, approved group. */
+    private function makeHostOfNewGroup(User $user): Group
+    {
+        $group = Group::factory()->create(['approved' => true]);
+        UserGroups::create([
+            'user' => $user->id,
+            'group' => $group->idgroups,
+            'status' => 1,
+            'role' => Role::HOST,
+        ]);
+
+        return $group;
+    }
+
+    // -------------------------------------------------------------------------
+    // Image uploads
+    // -------------------------------------------------------------------------
+
+    /** @test */
+    public function a_stranger_cannot_upload_an_image_to_a_group(): void
+    {
+        $this->withExceptionHandling();
+
+        $host = User::factory()->host()->create();
+        $group = $this->makeHostOfNewGroup($host);
+
+        $stranger = User::factory()->restarter()->create();
+        $this->actingAs($stranger);
+
+        $response = $this->post('/group/image-upload/' . $group->idgroups);
+
+        $response->assertStatus(403);
+    }
+
+    /** @test */
+    public function a_group_host_can_still_upload_an_image_to_their_own_group(): void
+    {
+        $this->withExceptionHandling();
+
+        $host = User::factory()->host()->create();
+        $group = $this->makeHostOfNewGroup($host);
+
+        $this->actingAs($host);
+
+        // No file is attached, so nothing is stored — we are asserting only that
+        // the authorization guard lets a legitimate host through.
+        $response = $this->post('/group/image-upload/' . $group->idgroups);
+
+        $this->assertNotEquals(403, $response->getStatusCode());
+    }
+
+    /** @test */
+    public function a_stranger_cannot_upload_an_image_to_an_event(): void
+    {
+        $this->withExceptionHandling();
+
+        $host = User::factory()->host()->create();
+        $group = $this->makeHostOfNewGroup($host);
+        $event = Party::factory()->create(['group' => $group->idgroups]);
+
+        $stranger = User::factory()->restarter()->create();
+        $this->actingAs($stranger);
+
+        $response = $this->post('/party/image-upload/' . $event->idevents);
+
+        $response->assertStatus(403);
+    }
+
+    /** @test */
+    public function a_stranger_cannot_upload_an_image_to_a_device(): void
+    {
+        $this->withExceptionHandling();
+
+        $host = User::factory()->host()->create();
+        $group = $this->makeHostOfNewGroup($host);
+        $event = Party::factory()->create(['group' => $group->idgroups]);
+        $device = Device::factory()->fixed()->create(['event' => $event->idevents]);
+
+        $stranger = User::factory()->restarter()->create();
+        $this->actingAs($stranger);
+
+        $response = $this->post('/device/image-upload/' . $device->iddevices);
+
+        $response->assertStatus(403);
+    }
+
+    // -------------------------------------------------------------------------
+    // updateDevicev2: guard object must match the mutated object
+    // -------------------------------------------------------------------------
+
+    /** @test */
+    public function a_host_cannot_hijack_a_device_belonging_to_another_groups_event(): void
+    {
+        $this->withExceptionHandling();
+
+        // Victim group, with an event and a device on it.
+        $victimHost = User::factory()->host()->create();
+        $victimGroup = $this->makeHostOfNewGroup($victimHost);
+        $victimEvent = Party::factory()->create(['group' => $victimGroup->idgroups]);
+        $victimDevice = Device::factory()->fixed()->create([
+            'event' => $victimEvent->idevents,
+            'brand' => 'VictimBrand',
+        ]);
+
+        // Attacker hosts their own unrelated group and event.
+        $attacker = User::factory()->host()->create();
+        $attackerGroup = $this->makeHostOfNewGroup($attacker);
+        $attackerEvent = Party::factory()->create(['group' => $attackerGroup->idgroups]);
+
+        $this->actingAs($attacker);
+
+        // The permission check inspects `eventid` (the attacker's own event) while
+        // the device actually mutated comes from the path.
+        $response = $this->json('PATCH', '/api/v2/devices/' . $victimDevice->iddevices, [
+            'eventid' => $attackerEvent->idevents,
+            'category' => 111,
+            'item_type' => 'Hijacked',
+            'brand' => 'AttackerBrand',
+            'model' => 'AttackerModel',
+            'problem' => 'Hijacked',
+            'repair_status' => Device::REPAIR_STATUS_FIXED_STR,
+        ]);
+
+        $response->assertStatus(403);
+
+        $fresh = $victimDevice->fresh();
+        $this->assertEquals($victimEvent->idevents, $fresh->event, 'The device must not be reassigned to another event.');
+        $this->assertEquals('VictimBrand', $fresh->brand, 'The device must not be overwritten.');
+    }
+
+    /** @test */
+    public function a_host_can_still_update_a_device_on_their_own_event(): void
+    {
+        $this->withExceptionHandling();
+
+        $host = User::factory()->host()->create();
+        $group = $this->makeHostOfNewGroup($host);
+        $event = Party::factory()->create(['group' => $group->idgroups]);
+        $device = Device::factory()->fixed()->create([
+            'event' => $event->idevents,
+            'brand' => 'OriginalBrand',
+        ]);
+
+        $this->actingAs($host);
+
+        $response = $this->json('PATCH', '/api/v2/devices/' . $device->iddevices, [
+            'eventid' => $event->idevents,
+            'category' => 111,
+            'item_type' => 'Kettle',
+            'brand' => 'UpdatedBrand',
+            'model' => 'SomeModel',
+            'problem' => 'Broken',
+            'repair_status' => Device::REPAIR_STATUS_FIXED_STR,
+        ]);
+
+        $response->assertSuccessful();
+        $this->assertEquals('UpdatedBrand', $device->fresh()->brand);
+    }
+
+    // -------------------------------------------------------------------------
+    // createEventv2: must host *that* group
+    // -------------------------------------------------------------------------
+
+    /** @test */
+    public function a_host_cannot_create_an_event_on_a_group_they_do_not_host(): void
+    {
+        $this->withExceptionHandling();
+
+        $victimHost = User::factory()->host()->create();
+        $victimGroup = $this->makeHostOfNewGroup($victimHost);
+
+        // Attacker is a host, but only of their own group.
+        $attacker = User::factory()->host()->create();
+        $this->makeHostOfNewGroup($attacker);
+
+        $this->actingAs($attacker);
+
+        $response = $this->json('POST', '/api/v2/events', [
+            'groupid' => $victimGroup->idgroups,
+            'start' => '2130-01-01T10:00:00+00:00',
+            'end' => '2130-01-01T12:00:00+00:00',
+            'title' => 'Spam event',
+            'description' => 'Spam',
+            'location' => 'London',
+            'timezone' => 'Europe/London',
+        ]);
+
+        $response->assertStatus(403);
+        $this->assertEquals(0, Party::where('group', $victimGroup->idgroups)->count());
+    }
+
+    /** @test */
+    public function a_host_can_still_create_an_event_on_their_own_group(): void
+    {
+        $this->withExceptionHandling();
+
+        $host = User::factory()->host()->create();
+        $group = $this->makeHostOfNewGroup($host);
+
+        $this->actingAs($host);
+
+        $response = $this->json('POST', '/api/v2/events', [
+            'groupid' => $group->idgroups,
+            'start' => '2130-01-01T10:00:00+00:00',
+            'end' => '2130-01-01T12:00:00+00:00',
+            'title' => 'Legitimate event',
+            'description' => 'Repair away',
+            'location' => 'London',
+            'timezone' => 'Europe/London',
+        ]);
+
+        $response->assertSuccessful();
+        $this->assertEquals(1, Party::where('group', $group->idgroups)->count());
+    }
+
+    // -------------------------------------------------------------------------
+    // Stale debug scaffolding
+    // -------------------------------------------------------------------------
+
+    /** @test */
+    public function the_check_auth_debug_endpoint_is_gone(): void
+    {
+        $this->withExceptionHandling();
+
+        $response = $this->get('/test/check-auth');
+
+        $response->assertStatus(404);
+    }
+
+    // -------------------------------------------------------------------------
+    // Destructive actions must not be reachable by GET
+    // -------------------------------------------------------------------------
+
+    /**
+     * Laravel's CSRF middleware only covers POST/PUT/PATCH/DELETE, so a destructive action
+     * on a GET route can be triggered by any page an admin happens to load. These are all
+     * POST now; a GET must not reach the controller at all.
+     *
+     * @test
+     */
+    public function destructive_actions_are_not_reachable_by_get(): void
+    {
+        $this->withExceptionHandling();
+
+        $admin = User::factory()->administrator()->create();
+        $this->actingAs($admin);
+
+        $group = Group::factory()->create(['approved' => true]);
+        $skill = \App\Skills::create(['skill_name' => 'Soldering', 'description' => 'x', 'category' => 2]);
+        $tag = \App\GroupTags::create(['tag_name' => 'Tagged', 'description' => 'x']);
+
+        foreach ([
+            '/group/delete/' . $group->idgroups,
+            '/skills/delete/' . $skill->id,
+            '/tags/delete/' . $tag->id,
+        ] as $url) {
+            $this->get($url)->assertStatus(405, "GET $url should not be routable");
+        }
+
+        // ...and the objects are all still there.
+        $this->assertNotNull(Group::find($group->idgroups));
+        $this->assertNotNull(\App\Skills::find($skill->id));
+        $this->assertNotNull(\App\GroupTags::find($tag->id));
+    }
+}
diff --git a/tests/Feature/Security/StoredXssHardeningTest.php b/tests/Feature/Security/StoredXssHardeningTest.php
new file mode 100644
index 0000000000..6ebf4a316e
--- /dev/null
+++ b/tests/Feature/Security/StoredXssHardeningTest.php
@@ -0,0 +1,282 @@
+<?php
+
+namespace Tests\Feature\Security;
+
+use App\Group;
+use App\Party;
+use App\Role;
+use App\User;
+use Tests\TestCase;
+
+/**
+ * Stored-XSS hardening across the three remaining sink classes:
+ *
+ *  1. Rich-text description fields (`free_text`) rendered as raw HTML. These are
+ *     Quill-authored, so they cannot simply be escaped — they are sanitised on
+ *     write instead.
+ *  2. Blade's @lang(), which compiles to an unescaped echo, fed user-controlled
+ *     replacement values. The audit-log accordion's metadata line is the residual
+ *     half of the previously-reported audit-log XSS.
+ *  3. Flash messages rendered with {!! !!} whose translation strings interpolate
+ *     user-controlled names into HTML.
+ *
+ * Written before the fixes; these should fail on the unpatched code.
+ */
+class StoredXssHardeningTest extends TestCase
+{
+    private string $payload = '<script>alert("XSSPROBE")</script>';
+    private string $imgPayload = '<img src=x onerror=alert("XSSPROBE")>';
+
+    // -------------------------------------------------------------------------
+    // 1. Rich-text descriptions sanitised on write
+    // -------------------------------------------------------------------------
+
+    /** @test */
+    public function group_description_is_sanitised_on_save(): void
+    {
+        $this->loginAsTestUser(Role::HOST);
+        $idgroups = $this->createGroup('Sanitise Me', 'https://therestartproject.org', 'London',
+            '<p>Legitimate description.</p>' . $this->payload . $this->imgPayload);
+
+        $stored = Group::findOrFail($idgroups)->free_text;
+
+        $this->assertStringNotContainsString('<script', $stored);
+        $this->assertStringNotContainsString('onerror', $stored);
+        $this->assertStringNotContainsString('alert(', $stored);
+        // Legitimate rich text must survive — this is a Quill field, not plain text.
+        $this->assertStringContainsString('Legitimate description.', $stored);
+        $this->assertStringContainsString('<p>', $stored);
+    }
+
+    /** @test */
+    public function event_description_is_sanitised_on_save(): void
+    {
+        $this->loginAsTestUser(Role::HOST);
+        $idgroups = $this->createGroup();
+        $idevents = $this->createEvent($idgroups, 'tomorrow');
+
+        $event = Party::findOrFail($idevents);
+
+        $this->patch('/api/v2/events/' . $idevents, [
+            'start' => '2130-01-01T10:00:00+00:00',
+            'end' => '2130-01-01T12:00:00+00:00',
+            'title' => $event->venue,
+            'location' => $event->location,
+            'timezone' => $event->timezone,
+            'description' => '<p>Come along.</p>' . $this->payload,
+        ]);
+
+        $stored = Party::findOrFail($idevents)->free_text;
+
+        $this->assertStringNotContainsString('<script', $stored);
+        $this->assertStringNotContainsString('alert(', $stored);
+        $this->assertStringContainsString('Come along.', $stored);
+    }
+
+    /** @test */
+    public function group_description_is_sanitised_when_updated(): void
+    {
+        $this->loginAsTestUser(Role::HOST);
+        $idgroups = $this->createGroup();
+
+        $this->patch('/api/v2/groups/' . $idgroups, [
+            'description' => '<p>Updated.</p>' . $this->imgPayload,
+        ]);
+
+        $stored = Group::findOrFail($idgroups)->free_text;
+
+        $this->assertStringNotContainsString('onerror', $stored);
+        $this->assertStringContainsString('Updated.', $stored);
+    }
+
+    // -------------------------------------------------------------------------
+    // 2. @lang() sinks
+    // -------------------------------------------------------------------------
+
+    /**
+     * The residual half of F005. The reported line (the modified-values cell) was
+     * escaped, but the accordion header renders
+     * `@lang('group-audits.updated.metadata', $audit->getMetadata())` — and that
+     * translation string interpolates :user_name into HTML.
+     *
+     * @test
+     */
+    public function audit_log_escapes_the_name_of_the_user_who_made_the_change(): void
+    {
+        $host = User::factory()->host()->create(['name' => 'Harmless Host']);
+        $this->actingAs($host);
+
+        $group = Group::factory()->create(['approved' => true, 'website' => 'https://safe.example.com']);
+        \App\UserGroups::create([
+            'user' => $host->id,
+            'group' => $group->idgroups,
+            'status' => 1,
+            'role' => Role::HOST,
+        ]);
+
+        // Make an audited change so there is an audit row attributed to this user.
+        $group->website = 'https://changed.example.com';
+        $group->save();
+
+        // The attacker's display name is the payload. getMetadata() resolves the
+        // name at render time, so setting it after the edit is equivalent.
+        $host->name = $this->payload;
+        $host->save();
+
+        $admin = User::factory()->administrator()->create();
+        $this->actingAs($admin);
+
+        $response = $this->get('/group/edit/' . $group->idgroups);
+        $response->assertStatus(200);
+
+        $response->assertDontSee('<script>alert("XSSPROBE")', false);
+        $response->assertSee('&lt;script&gt;', false);
+    }
+
+    /** @test */
+    public function audit_log_escapes_the_request_url(): void
+    {
+        $host = User::factory()->host()->create();
+        $this->actingAs($host);
+
+        $group = Group::factory()->create(['approved' => true]);
+        \App\UserGroups::create([
+            'user' => $host->id,
+            'group' => $group->idgroups,
+            'status' => 1,
+            'role' => Role::HOST,
+        ]);
+
+        // The audit URL resolver records the full request URL, query string included.
+        $this->patch('/api/v2/groups/' . $group->idgroups . '?x=' . urlencode($this->imgPayload), [
+            'description' => '<p>A harmless edit.</p>',
+        ]);
+
+        $admin = User::factory()->administrator()->create();
+        $this->actingAs($admin);
+
+        $response = $this->get('/group/edit/' . $group->idgroups);
+        $response->assertStatus(200);
+        $response->assertDontSee('<img src=x', false);
+    }
+
+    /** @test */
+    public function profile_page_escapes_the_users_name_in_the_no_bio_message(): void
+    {
+        $attacker = User::factory()->restarter()->create([
+            'name' => $this->payload,
+            'biography' => null,
+        ]);
+        $viewer = User::factory()->administrator()->create();
+
+        $this->actingAs($viewer);
+
+        $response = $this->get('/profile/' . $attacker->id);
+        $response->assertStatus(200);
+
+        $response->assertDontSee('<script>alert("XSSPROBE")', false);
+    }
+
+    // -------------------------------------------------------------------------
+    // 3. Flash messages
+    // -------------------------------------------------------------------------
+
+    /**
+     * `groups.now_following` is 'You are now following <a href=":link">:name</a>!'
+     * and is rendered with {!! !!}, so a malicious group name executes in the
+     * browser of any user who follows that group.
+     *
+     * @test
+     */
+    public function following_a_group_escapes_the_group_name_in_the_flash_message(): void
+    {
+        $host = User::factory()->host()->create();
+        $group = Group::factory()->create([
+            'approved' => true,
+            'name' => 'Evil ' . $this->imgPayload,
+        ]);
+        \App\UserGroups::create([
+            'user' => $host->id,
+            'group' => $group->idgroups,
+            'status' => 1,
+            'role' => Role::HOST,
+        ]);
+
+        $victim = User::factory()->restarter()->create();
+        $this->actingAs($victim);
+
+        $this->get('/group/join/' . $group->idgroups);
+
+        $response = $this->followingRedirects()->get('/group/view/' . $group->idgroups);
+
+        // Escaping only rewrites < > and quotes, so assert on the raw tag opening: the
+        // literal "onerror=alert" text survives escaping and would false-pass.
+        $response->assertDontSee('<img src=x', false);
+    }
+
+    /**
+     * The sanitiser must not quietly degrade the rich text that already exists. This
+     * asserts against the constructs found in a survey of the live data: links opening
+     * in a new tab (~5,100 of them), inline styles (~7,100), Quill's alignment classes
+     * (~1,300), plus div, hr, sub/sup and the occasional table.
+     *
+     * @test
+     */
+    public function sanitiser_preserves_the_rich_text_the_live_content_actually_uses(): void
+    {
+        $this->loginAsTestUser(Role::HOST);
+
+        $rich = '<p class="ql-align-center" style="text-align: center;">Centred</p>'
+            . '<p><a href="https://therestartproject.org" target="_blank" rel="noopener">A link</a></p>'
+            . '<p><span style="font-size: 14px; color: rgb(0, 0, 0);">Styled</span></p>'
+            . '<div>A div</div><hr><p>H<sub>2</sub>O and x<sup>2</sup></p>'
+            . '<table><tbody><tr><td>Mon</td><td>10-4</td></tr></tbody></table>'
+            . '<ul><li>One</li></ul><blockquote>Quoted</blockquote><h4>A heading</h4>';
+
+        $idgroups = $this->createGroup('Rich Text Group', 'https://therestartproject.org', 'London', $rich);
+        $stored = Group::findOrFail($idgroups)->free_text;
+
+        foreach ([
+            'target="_blank"' => 'links opening in a new tab',
+            'class="ql-align-center"' => "Quill's alignment classes",
+            'font-size' => 'inline font styling',
+            '<div>' => 'divs',
+            '<hr' => 'horizontal rules',
+            '<sub>' => 'subscript',
+            '<sup>' => 'superscript',
+            '<table>' => 'tables',
+            '<blockquote>' => 'blockquotes',
+            '<h4>' => 'headings',
+        ] as $needle => $what) {
+            $this->assertStringContainsString($needle, $stored, "Sanitiser stripped $what");
+        }
+    }
+
+    /**
+     * The corresponding negative: the things that make a payload dangerous are removed
+     * even though the allowlist is wide.
+     *
+     * @test
+     */
+    public function sanitiser_removes_script_handlers_and_javascript_urls(): void
+    {
+        $this->loginAsTestUser(Role::HOST);
+
+        $nasty = '<p>Text</p><script>alert(1)</script>'
+            . '<img src=x onerror="alert(2)">'
+            . '<a href="javascript:alert(3)">Click</a>'
+            . '<iframe src="https://evil.example/"></iframe>'
+            . '<div style="background: url(javascript:alert(4))">Styled</div>'
+            . '<form action="https://evil.example/"><input name="p"></form>';
+
+        $idgroups = $this->createGroup('Nasty Group', 'https://therestartproject.org', 'London', $nasty);
+        $stored = Group::findOrFail($idgroups)->free_text;
+
+        foreach (['<script', 'onerror', 'javascript:', '<iframe', '<form', '<input'] as $needle) {
+            $this->assertStringNotContainsString($needle, $stored, "Sanitiser kept $needle");
+        }
+
+        // ...while the surrounding legitimate content survives.
+        $this->assertStringContainsString('Text', $stored);
+    }
+}
diff --git a/tests/Feature/Users/PasswordResetHardeningTest.php b/tests/Feature/Users/PasswordResetHardeningTest.php
new file mode 100644
index 0000000000..028729a5be
--- /dev/null
+++ b/tests/Feature/Users/PasswordResetHardeningTest.php
@@ -0,0 +1,189 @@
+<?php
+
+namespace Tests\Feature\Users;
+
+use App\Role;
+use App\User;
+use DB;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+/**
+ * Hardening of the custom password-recovery flow (UserController::recover/reset).
+ *
+ * The headline issue is a type-juggling flaw: `reset()` passed the request value
+ * straight to filter_var(), which returns false for an array. Laravel casts a
+ * false binding to integer 0, and MySQL compares a VARCHAR column to 0
+ * numerically — coercing every non-numeric string to 0 — so
+ * `where('recovery', 0)` matched real recovery tokens instead of nothing.
+ *
+ * Written before the fix; these should fail on the unpatched code.
+ */
+class PasswordResetHardeningTest extends TestCase
+{
+    /**
+     * Give a user a live recovery token, bypassing the controller so the test
+     * states the precondition directly.
+     */
+    private function giveLiveRecoveryToken(User $user, string $token): void
+    {
+        DB::table('users')->where('id', $user->id)->update([
+            'recovery' => $token,
+            'recovery_expires' => date('Y-m-d H:i:s', time() + 3600),
+        ]);
+    }
+
+    /** @test */
+    public function array_recovery_code_cannot_reset_another_users_password(): void
+    {
+        $this->withExceptionHandling();
+
+        $victim = User::factory()->restarter()->create([
+            'password' => Hash::make('victim-original-password'),
+        ]);
+
+        // A non-numeric token, which is what MySQL coerces to 0. Every user gets
+        // one of these at registration, so this is the normal state of the table.
+        $this->giveLiveRecoveryToken($victim, 'a3f5c1d9e7b2408f6a1c');
+
+        $originalHash = $victim->fresh()->password;
+
+        // The exploit: recovery as an array makes filter_var() return false,
+        // which becomes the integer 0 in the SQL binding.
+        $this->post('/user/reset', [
+            'recovery' => ['1'],
+            'password' => 'attacker-chosen',
+            'confirm_password' => 'attacker-chosen',
+        ]);
+
+        $this->assertEquals(
+            $originalHash,
+            $victim->fresh()->password,
+            'An array recovery code must not match any user, let alone reset their password.'
+        );
+        $this->assertFalse(Hash::check('attacker-chosen', $victim->fresh()->password));
+    }
+
+    /** @test */
+    public function array_recovery_code_does_not_disclose_a_users_email(): void
+    {
+        $this->withExceptionHandling();
+
+        $victim = User::factory()->restarter()->create();
+        $this->giveLiveRecoveryToken($victim, 'b7d2e4f6a8c0912e3b5d');
+
+        $response = $this->get('/user/reset?recovery[]=1');
+
+        $response->assertDontSee($victim->email, false);
+    }
+
+    /** @test */
+    public function recovery_code_is_single_use(): void
+    {
+        $this->withExceptionHandling();
+
+        $user = User::factory()->restarter()->create([
+            'password' => Hash::make('original'),
+        ]);
+        $token = 'c1d3e5f7a9b1234c5d6e';
+        $this->giveLiveRecoveryToken($user, $token);
+
+        // First use succeeds.
+        $this->post('/user/reset', [
+            'recovery' => $token,
+            'password' => 'first-reset',
+            'confirm_password' => 'first-reset',
+        ]);
+        $this->assertTrue(Hash::check('first-reset', $user->fresh()->password));
+
+        // The token must now be spent.
+        $this->assertNull($user->fresh()->recovery, 'recovery must be cleared after a successful reset');
+
+        $this->post('/user/reset', [
+            'recovery' => $token,
+            'password' => 'second-reset',
+            'confirm_password' => 'second-reset',
+        ]);
+
+        $this->assertTrue(
+            Hash::check('first-reset', $user->fresh()->password),
+            'A spent recovery token must not be reusable.'
+        );
+    }
+
+    /** @test */
+    public function changing_your_password_does_not_mint_a_recovery_token(): void
+    {
+        $user = User::factory()->restarter()->create([
+            'password' => Hash::make('current-password'),
+        ]);
+        DB::table('users')->where('id', $user->id)->update([
+            'recovery' => null,
+            'recovery_expires' => null,
+        ]);
+
+        $this->actingAs($user);
+
+        $this->post('/profile/edit-password', [
+            'id' => $user->id,
+            'current-password' => 'current-password',
+            'new-password' => 'brand-new-password',
+            'new-password-repeat' => 'brand-new-password',
+        ]);
+
+        $this->assertTrue(Hash::check('brand-new-password', $user->fresh()->password));
+        $this->assertNull(
+            $user->fresh()->recovery,
+            'A password change must not leave a live password-reset token behind.'
+        );
+    }
+
+    /** @test */
+    public function api_token_is_rotated_when_the_password_is_reset(): void
+    {
+        $this->withExceptionHandling();
+
+        $user = User::factory()->restarter()->create([
+            'password' => Hash::make('original'),
+        ]);
+        $user->ensureAPIToken();
+        $stolenToken = $user->fresh()->api_token;
+        $this->assertNotEmpty($stolenToken);
+
+        $token = 'd2e4f6a8b0c2345d6e7f';
+        $this->giveLiveRecoveryToken($user, $token);
+
+        $this->post('/user/reset', [
+            'recovery' => $token,
+            'password' => 'new-password',
+            'confirm_password' => 'new-password',
+        ]);
+
+        $this->assertNotEquals(
+            $stolenToken,
+            $user->fresh()->api_token,
+            'Resetting the password must invalidate an API token that may have been stolen.'
+        );
+    }
+
+    /** @test */
+    public function api_token_is_rotated_when_the_password_is_changed(): void
+    {
+        $user = User::factory()->restarter()->create([
+            'password' => Hash::make('current-password'),
+        ]);
+        $user->ensureAPIToken();
+        $stolenToken = $user->fresh()->api_token;
+
+        $this->actingAs($user);
+
+        $this->post('/profile/edit-password', [
+            'id' => $user->id,
+            'current-password' => 'current-password',
+            'new-password' => 'brand-new-password',
+            'new-password-repeat' => 'brand-new-password',
+        ]);
+
+        $this->assertNotEquals($stolenToken, $user->fresh()->api_token);
+    }
+}
diff --git a/tests/Feature/Users/SkillsTest.php b/tests/Feature/Users/SkillsTest.php
index 57283893a9..600110a9ab 100644
--- a/tests/Feature/Users/SkillsTest.php
+++ b/tests/Feature/Users/SkillsTest.php
@@ -87,11 +87,11 @@ public function testDelete(): void {
                                      'description' => 'Planning',
                                  ]);
 
-        $response = $this->get('/skills/delete/' . $skill1->id);
+        $response = $this->post('/skills/delete/' . $skill1->id);
         $response->assertRedirect('/user/forbidden');
 
         $this->loginAsTestUser(Role::ADMINISTRATOR);
-        $response = $this->get('/skills/delete/' . $skill1->id);
+        $response = $this->post('/skills/delete/' . $skill1->id);
         $response->assertSessionHas('success');
     }
 }
\ No newline at end of file
diff --git a/tests/Integration/utils.js b/tests/Integration/utils.js
index 05d0375cfd..c106a488f7 100644
--- a/tests/Integration/utils.js
+++ b/tests/Integration/utils.js
@@ -168,10 +168,16 @@ exports.createEvent = async function(page, baseURL, idgroups, past) {
   log('Setting event date', { past })
   await page.click('#event_date button')
 
+  // The cell selector below picks a day late in the displayed month, so on the current
+  // month it can land in the past - "Invite volunteers" is gated on the event being
+  // upcoming, and that test failed on 30 July for an event the picker put on 26 July.
+  // Always move a month so the chosen day is unambiguously past or future.
   if (past) {
     log('Setting past date - going back a month')
-    // Go back a month
     await page.locator('[aria-label="Previous month"]').click()
+  } else {
+    log('Setting future date - going forward a month')
+    await page.locator('[aria-label="Next month"]').click()
   }
 
   await page.click('#event_date .b-calendar-grid > .b-calendar-grid-body > .row:last-child .btn:last-child')
diff --git a/tests/__mocks__/resources/js/mixins/lang.js b/tests/__mocks__/resources/js/mixins/lang.js
index eeff341467..54e81d5d13 100644
--- a/tests/__mocks__/resources/js/mixins/lang.js
+++ b/tests/__mocks__/resources/js/mixins/lang.js
@@ -43,6 +43,20 @@ export default {
                 console.error("Missing translation " + key)
                 return key
             }
+        },
+        // Keep in step with the real mixin - components that interpolate database values
+        // into a v-html binding call this.
+        escapeHtml(value) {
+            if (value === null || value === undefined) {
+                return ''
+            }
+
+            return String(value)
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;')
+                .replace(/'/g, '&#039;')
         }
     }
 }
\ No newline at end of file