Bind Stripe card-setup sessions to the organisation so a leaked session_id cannot attach another org's customer.

Document targeted test runs and the -n pattern filter for agents.

Escape event JSON-LD so stored fields cannot break out of the script tag.

Put Open Collective third on the homepage payment logos on mobile.

Drop the redundant payment-method line from refund confirmations.

Email attendees a confirmation when a refund succeeds.

Drive organisation edit tabs from the URL hash instead of ?tab=.

Point fee-free crypto at Set up Crypto and keep the wallet hint on the field.

Stop looking up crypto payments on Optimism and Arbitrum.

Hide unused payment processors behind Set up links.

Give Crypto and Patreon their own boxes, and move the Stripe tax rate to Everything else.

Show Mollie and PayPal on the homepage payment methods row.

Label the Stripe payment box like the other processors.

Parse PayPal OAuth error bodies so failed purchases show why authentication failed.

Give Open Collective its own payment box and extract each processor into a partial.

Always label the Stripe button as via card, even when it's the only paid method.

Extract order/ticket payment fields into concerns; inline payment badge colours

• Move Order and Ticket payment provider fields, validations and helpers into OrderPaymentMethods and TicketPaymentMethods concerns
• Include all *PaymentMethods concerns at the top level of Order, Ticket and Organisation models
• Replace per-provider badge CSS classes with badge_background/badge_color inline styles on EventPaymentMethod

Let organisations take event payments through PayPal.

Escape user-supplied text when rendering emails so leftover markup cannot run after Mailgun substitution.

Fix confirmation links that failed after the sign-in token was rotated.

Move organisation payment fields and validation into their own concern.