Bug fixes (real breakage):

Newsletter nudge — was calling /api/study-account/profile (wrong endpoint, ignored subscription). Now correctly calls /api/study-account/preferences with PATCH.
Security:

Email regex — replaced the permissive [^\s@]+@[^\s@]+ pattern with a proper RFC-compliant regex in contact.js and downloads.js
Avatar magic bytes — server now checks actual PNG/JPEG/GIF/WEBP header bytes, not just the data URL prefix
Certificate rate limit — public /api/public/certificate/:token now has a 30 req/15min limiter
Session absolute TTL — admin sessions now have a 30-day hard cap; a stolen token can no longer be kept alive indefinitely by passive reads
Account lockout — 5 failed logins locks a study account for 1 hour
CSP headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers added globally
Data integrity:

Cascade delete — deleting a study account now also removes their certificates, community posts, comments, and progress file
UX / reliability:

Escape key on modals — all 3 modal groups (study index, notes, account) now close on Escape
Display name min-length — empty spaces-only names rejected; if provided, must be ≥2 chars
Note save rate limit — 30 saves/minute per user max
Analytics fetch timeout — 5s AbortController so a hanging server doesn't block the browser indefinitely
Email validation on signup — frontend catches bad email formats before hitting the server
Cleanup:

Deduplicated download forms — StudyDownloadForm and ResourceDownloadForm now share a single DownloadForm base; both are now thin wrappers

server/auth.js

@@ -15,6 +15,7 @@ const totpPendingSessions = new Map()
 
 const ADMIN_SESSION_COOKIE = 'vbn_admin_session'
 const ADMIN_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000
+const ADMIN_SESSION_ABSOLUTE_TTL_MS = 30 * 24 * 60 * 60 * 1000
 const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD
 const adminSessions = new Map()
 
@@ -217,7 +218,8 @@ export function consumePendingSession(token) {
 
 export function createAdminSession() {
   const token = randomUUID()
-  adminSessions.set(token, Date.now() + ADMIN_SESSION_TTL_MS)
+  const now = Date.now()
+  adminSessions.set(token, { expiresAt: now + ADMIN_SESSION_TTL_MS, absoluteExpiresAt: now + ADMIN_SESSION_ABSOLUTE_TTL_MS })
   return token
 }
 
@@ -234,13 +236,20 @@ export function isValidAdminSession(req) {
   const sessionToken = cookies[ADMIN_SESSION_COOKIE]
   if (!sessionToken) return false
 
-  const expiresAt = adminSessions.get(sessionToken)
-  if (!expiresAt || expiresAt <= Date.now()) {
+  const now = Date.now()
+  const session = adminSessions.get(sessionToken)
+  if (!session) return false
+
+  // Support legacy sessions stored as a plain number (expiresAt)
+  const expiresAt = typeof session === 'object' ? session.expiresAt : session
+  const absoluteExpiresAt = typeof session === 'object' ? session.absoluteExpiresAt : Infinity
+
+  if (expiresAt <= now || absoluteExpiresAt <= now) {
     adminSessions.delete(sessionToken)
     return false
   }
 
-  adminSessions.set(sessionToken, Date.now() + ADMIN_SESSION_TTL_MS)
+  adminSessions.set(sessionToken, { expiresAt: now + ADMIN_SESSION_TTL_MS, absoluteExpiresAt })
   return true
 }