<ul><li>CRITICAL: document_modals.php line 190 — $_REQUEST["domainid"] used without null fallback causing PHP Warning on every page load. Fixed: $_REQUEST["domainid"] ?? $domainid ?? "".</li><li>HIGH: inc_documentlibrarymanager.php line 696 — operator precedence bug: $_SESSION["super_admin"] ?? false == 1 always evaluated false==1 first (yielding false), then ?? returned false. Admin tab was never visible to super_admin users. Fixed: ($_SESSION["super_admin"] ?? false) == 1 with explicit parentheses.</li><li>HIGH: insert_update.php deleteDocument action — $deleventdata["ItemLink"] accessed without null guard when get_one() returns null (non-existent ID). Caused 3 PHP Warnings and attempted unlink() on BASEPATH_ directly. Fixed: added !empty($deleventdata) guard before file_exists/unlink.</li><li>HIGH: insert_update.php getDataDocument and getDataCateg — missing die() after ob_end_clean()+echo json_encode(). Script continued executing after JSON output. Fixed: added die() after each JSON echo.</li><li>MEDIUM: insert_update.php getCategTable AJAX action — N+1 DB query inside render loop: called Sdba::table(domain_tbl_documentlibrarycategory)->get_one() per row to look up parent category name. Fixed: pre-cached all categories into $categ_lookup_ajax array before the loop (same approach as list_document_categories.php).</li><li>MEDIUM: inc_documentlibrarymanager.php allow_notificationSetting() and onload_getNotifSetting() — JSON.parse() called without try/catch; any PHP warning prepended to response would crash JS silently. Fixed: wrapped in try/catch, added .fail() AJAX error handlers.</li></ul>