Align the comment reaction picker with the word/emoji input.

Don't list new gatherings publicly by default.

Remove leftover sexuality and dating preference fields from accounts.

Split booking and evergreen tests out of the events suite.

Fold satellite test files into their parent domain files.

Fix event tests that assumed donor amounts and persisted organisations.

Share test setup helpers and default factory accounts to the organisation owner.

Require Mailgun SPF and From alignment before trusting inbound comment senders.

Only follow same-origin or BASE_URI referers when redirecting back.

404 the attendees pagelet when the event hides attendees.

Allow only real YouTube ids on thumbnail fetches.

Extract ticket restriction messages into a purchase_gate partial.

Enforce ticket access rules on purchase, not only in the UI.

Remove trivial tests and cases already covered by larger ones.

Fix ajax search XSS test after name sanitization.

Account names strip HTML on save, so set the payload after create and drop the '

Prevent buyers from earning affiliate credit on their own orders.

Enforce discount code maximum uses when creating an order.

The limit was only checked in the purchase view, so a reused discount_code_id could apply the code indefinitely.

Stop authorizing inbound comments from spoofable MIME From headers.

Block javascript: post-payment redirects to prevent stored XSS.

Escape search autocomplete labels to prevent stored XSS.

User-controlled names were interpolated into HTML and rendered with jQuery .html(); return plain text and build icons as trusted DOM nodes instead.