<ul><li>CRITICAL: notifications/pages/terms_and_condition.php:29 — undefined variable "token" → fixed to use csrf_token; AJAX was silently sending undefined token on every call</li><li>instances/inc/get_data.php + save_details.php + add_idomain.php + remove_idomain.php + updated_domains_table.php: Fixed all bare $_POST reads across all switch cases</li><li>instances/inc/instance.php: Fixed $_GET["i_id"] emitted into JS without isset (×2); replaced 18× deprecated $.parseJSON with JSON.parse</li><li>instances/inc/list.php: Replaced 5× deprecated $.parseJSON with JSON.parse</li><li>instances/index.php + toolbar.php: Fixed $_SESSION["super_admin"] and $_GET["page"] without guards</li><li>instances/inc/add_instance_modal.php + settings_details_*.php (×3): Fixed bare $_SESSION and $ins_item emits; removed duplicate type attributes</li><li>instances/inc/instance_modal.php: Fixed malformed closing option tag</li><li>instances/inc/updated_domains_table.php: Fixed count() on potentially null result</li><li>instances/inc/*.php: Added onerror fallback on img tags (×2)</li><li>media/index.php + notifications/index.php + info/index.php: Fixed bare $_SESSION["super_admin"] (all)</li><li>notifications/pages/accounts_notification.php: Fixed bare $_SESSION["uid"] in JS output</li><li>onboarding/pages/checklist/index.php + tour/index.php: Replaced 5× deprecated $.parseJSON with JSON.parse</li><li>onboarding/pages/checklist/items_table.php: Fixed count() on potentially null result</li><li>onboarding/pages/widgets/manage_widget.php: Fixed stray literal text; fixed json_decode null-safety for in_array()</li><li>info/inc/list.php: Fixed hardcoded https:// CDN URLs → protocol-relative; replaced ~20× $.parseJSON with JSON.parse</li></ul>