<ul><li>Fixed security save root cause: details.php Fatal TypeError was truncating accordion render, so #29712ertpo_modsec_token hidden input never reached the DOM — custom.js saveModuleSecurity sent empty CSRF token causing Token Mismatch error on save. Fix applied in v8.9 (details.php in_array/json_decode null fix).</li><li>Fixed security.php: removed dead click handler bound to #moduleSecurityButtonx (typo) and counter logic that blocked re-saves. Confirmed custom.js line 1654 is the authoritative #moduleSecurityButton handler.</li><li>Fixed updateSecurityModule(): implode() on undefined $r["roles"] when no roles checked (jQuery omits empty arrays from POST). Fix: is_array($r["roles"] ?? null) ? $r["roles"] : [].</li><li>Fixed update.menudetails.php: $_POST["inpmenuid"] ?? 0, $_POST["inpaction"] ?? "", added $menuDetailsData = [] and $logData = [] defaults, added empty($menuDetailsData) guard, null-guarded $_SESSION["Domain_live"] and ["activeacctid"].</li><li>Fixed update.menucontent.php: $_POST["menuid"] ?? 0, $_POST["option"] ?? "", added $menuContentsData = [] default, $_SESSION["YPTemplateID"] ?? 0, ["YPSiteLinkID"] ?? "", $configdata["templateid_fk"] ?? "", $configdata["templating"] ?? 0.</li><li>All form endpoints audited: updateBanner, updateMenuCard (upload_card_menu.php) clean; updateMenuEmbed, generateEmbedCode (websites.controller.php) fixed v8.11; changeModuleSettings confirmed in modules/inc/ajax.php.</li></ul>