<ul><li>development/development.php: Fixed CRITICAL LFI vulnerability — $_GET["page"] now validated against whitelist before include</li><li>ai/index.php: Fixed bare $_SESSION["super_admin"] access (×2) with ?? 0</li><li>ai/pages/billing.php:130 — Fixed $percentages undefined when no $_GET["id"] present</li><li>ai/pages/settings_js.php: Fixed $.parseJSON → JSON.parse; added AJAX error handler to setup_new_domain</li><li>ai/pages/projects_js.php:308 — Fixed undefined token variable → CSRFTOKEN</li><li>avideo/live_meet/inc/api.php: Fixed bare $_POST["action"] without isset()</li><li>avideo/live_meet/pages/change_server.php: Fixed unguarded $_GET["sitelinkid"]; fixed undefined $hostID; replaced deprecated $.parseJSON (×2)</li><li>avideo/live_meet/pages/index.php + meet.php: Replaced deprecated $.parseJSON (×4)</li><li>avideo/wwbn_index/inc/ (generateKeys, encryptMessage, decryptMessage, save, functions): Fixed missing / in DOCUMENT_ROOT includes; replaced @ error suppressors with ?? defaults</li><li>avideo/plugins_admin/inc/function.php: Fixed bare $r["action"] access; safe count() on plugin_id</li><li>developers/index.php: Fixed bare $_SESSION["super_admin"] (×2) with ?? 0</li><li>developers/developers.php: Replaced deprecated $.parseJSON</li></ul>