Bug fixes (real breakage):

Newsletter nudge — was calling /api/study-account/profile (wrong endpoint, ignored subscription). Now correctly calls /api/study-account/preferences with PATCH.
Security:

Email regex — replaced the permissive [^\s@]+@[^\s@]+ pattern with a proper RFC-compliant regex in contact.js and downloads.js
Avatar magic bytes — server now checks actual PNG/JPEG/GIF/WEBP header bytes, not just the data URL prefix
Certificate rate limit — public /api/public/certificate/:token now has a 30 req/15min limiter
Session absolute TTL — admin sessions now have a 30-day hard cap; a stolen token can no longer be kept alive indefinitely by passive reads
Account lockout — 5 failed logins locks a study account for 1 hour
CSP headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers added globally
Data integrity:

Cascade delete — deleting a study account now also removes their certificates, community posts, comments, and progress file
UX / reliability:

Escape key on modals — all 3 modal groups (study index, notes, account) now close on Escape
Display name min-length — empty spaces-only names rejected; if provided, must be ≥2 chars
Note save rate limit — 30 saves/minute per user max
Analytics fetch timeout — 5s AbortController so a hanging server doesn't block the browser indefinitely
Email validation on signup — frontend catches bad email formats before hitting the server
Cleanup:

Deduplicated download forms — StudyDownloadForm and ResourceDownloadForm now share a single DownloadForm base; both are now thin wrappers

server/routes/study-data.js

@@ -23,6 +23,19 @@ import {
 import { MAX_STUDY_NOTE_LENGTH, MAX_STUDY_NOTES_PER_USER, MAX_STUDY_ENROLLMENTS_PER_USER } from '../config.js'
 import { randomUUID } from 'node:crypto'
 
+const noteSaveHits = new Map() // userId -> { count, windowStart }
+const NOTE_RATE_WINDOW_MS = 60 * 1000
+const NOTE_RATE_MAX = 30
+
+function checkNoteSaveRateLimit(userId) {
+  const now = Date.now()
+  const entry = noteSaveHits.get(userId) ?? { count: 0, windowStart: now }
+  if (now - entry.windowStart > NOTE_RATE_WINDOW_MS) { entry.count = 0; entry.windowStart = now }
+  entry.count += 1
+  noteSaveHits.set(userId, entry)
+  return entry.count <= NOTE_RATE_MAX
+}
+
 export function register(app) {
   // ── Enrollment ────────────────────────────────────────────────────────────
 
@@ -112,6 +125,10 @@ export function register(app) {
       return
     }
     const user = req.studyUser
+    if (!checkNoteSaveRateLimit(user.id)) {
+      res.status(429).json({ message: 'Too many note saves. Please slow down.' })
+      return
+    }
     const noteStudySlug = getStudySlugFromNoteId(sectionId)
     if (noteStudySlug && !isStudyUserEnrolled(user, noteStudySlug)) {
       res.status(403).json({ message: 'Please enroll in this study to save notes.' })