<ul><li>CRITICAL: Fixed Unexpected token < SyntaxError in ajax_get_visitor_type_data — PHP errors were being prepended to JSON response because domain.controller.php line 14 destroys all output buffers (while ob_get_level() ob_end_clean()) before the action dispatch, so any PHP warning or fatal error from ajax_curl_native_api() went directly to output before die(json_encode()). Fixed by wrapping the native_api dispatch block in its own ob_start()/ob_end_clean() so errors from the method are buffered and discarded before the clean JSON is echoed.</li><li>CRITICAL: Fixed null pointer chain in DomainController::ajax_curl_native_api — curlAnalyzeTools() returns null when the external API fails or domain is empty. The original code then accessed null[0] (PHP Notice), then null->domain_code (PHP Warning), then assigned property on null retdata (PHP Fatal in PHP 8). Fixed with: null check on curlAnalyzeTools result before array access, null check on domain_code before file_get_contents, null check on retdata before property assignment (falls back to empty stdClass), ?? operators on date_range and action keys.</li><li>HIGH: Fixed Domain.class.php curlAnalyzeTools and ajax_curl_native_api — both methods called json_decode(curl_exec()) without guarding for curl_exec returning false on network failure. json_decode(false) returns null and propagates null through the whole analytics chain. Both methods now return null explicitly when cURL fails, allowing callers to handle gracefully.</li><li>HIGH: Added urlencode() on domain_code in file_get_contents URL in ajax_curl_native_api to prevent URL injection from API-returned values.</li></ul>