<ul><li><strong>BUG 1 — CRITICAL (custom_js.php line 489):</strong> <code>$_GET['add_to_cart']</code> accessed without <code>isset()</code> check — PHP Warning: Undefined array key emitted inline into JavaScript output on every page load. Fixed with <code>isset($_GET['add_to_cart']) ? $_GET['add_to_cart'] : ''</code>.</li><li><strong>BUG 2 — HIGH (products.php line 129):</strong> <code>$search</code> undefined variable warning leaked into the products HTML AJAX response from <code>getProductsMember()</code> — variable is not set when called from the grid load path. Fixed with <code>empty($search)</code> instead of <code>!$search</code>.</li><li><strong>BUG 3 — MEDIUM (product_intro.php line 10):</strong> <code>extract($product)</code> called on potentially null result from DB <code>get_one()</code> with no empty guard. Fixed with <code>if (!empty($product)) { extract($product); }</code>.</li><li><strong>PERF — N+1 Query (products.php):</strong> <code>paymentType()</code> function executed one DB query per product in the render loop against <code>domain_catalog_payment_type</code> (6-row lookup table). Fixed by pre-fetching the full table into a keyed array before the loop — eliminates N DB calls per page load.</li><li>All AJAX endpoints verified clean: 0 PHP warnings, 0 PHP notices, 0 fatal errors. All CRUD tests pass: product grid, category filter, search, product detail, load more.</li></ul>