A security-focused pass over the whole site:
- Closed several classes of request-forgery and injection issues in our media handling
- Fixed a bug where some preview images pointed at a non-existent address and never loaded
- Multi-reddit page titles now display correctly instead of showing encoded characters
Nothing was exploited — this was proactive hardening.