Bug fixes (real breakage):

Newsletter nudge — was calling /api/study-account/profile (wrong endpoint, ignored subscription). Now correctly calls /api/study-account/preferences with PATCH.
Security:

Email regex — replaced the permissive [^\s@]+@[^\s@]+ pattern with a proper RFC-compliant regex in contact.js and downloads.js
Avatar magic bytes — server now checks actual PNG/JPEG/GIF/WEBP header bytes, not just the data URL prefix
Certificate rate limit — public /api/public/certificate/:token now has a 30 req/15min limiter
Session absolute TTL — admin sessions now have a 30-day hard cap; a stolen token can no longer be kept alive indefinitely by passive reads
Account lockout — 5 failed logins locks a study account for 1 hour
CSP headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers added globally
Data integrity:

Cascade delete — deleting a study account now also removes their certificates, community posts, comments, and progress file
UX / reliability:

Escape key on modals — all 3 modal groups (study index, notes, account) now close on Escape
Display name min-length — empty spaces-only names rejected; if provided, must be ≥2 chars
Note save rate limit — 30 saves/minute per user max
Analytics fetch timeout — 5s AbortController so a hanging server doesn't block the browser indefinitely
Email validation on signup — frontend catches bad email formats before hitting the server
Cleanup:

Deduplicated download forms — StudyDownloadForm and ResourceDownloadForm now share a single DownloadForm base; both are now thin wrappers

src/colossiansStudy.tsx

@@ -521,6 +521,15 @@ export function StudyLandingPage({ content }: Props) {
     setEnrollMessage('')
   }
 
+  useEffect(() => {
+    if (studyModal === 'none') return
+    function onKeyDown(e: KeyboardEvent) {
+      if (e.key === 'Escape') closeStudyModal()
+    }
+    document.addEventListener('keydown', onKeyDown)
+    return () => document.removeEventListener('keydown', onKeyDown)
+  }, [studyModal])
+
   useEffect(() => {
     let cancelled = false
 
@@ -697,9 +706,11 @@ export function StudyLandingPage({ content }: Props) {
                   <div style={{ display: 'flex', gap: '0.75rem', flexWrap: 'wrap' }}>
                     <button type="button" className="btn-primary" style={{ fontSize: '0.85rem', padding: '0.4rem 1rem' }} onClick={async () => {
                       try {
-                        await fetch('/api/study-account/profile', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ subscribeNewsletter: true }) })
+                        await fetch('/api/study-account/preferences', { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ subscribeNewsletter: true, studyRemindersEnabled: auth.studyRemindersEnabled === true }) })
                         setAuth(prev => ({ ...prev, subscribeNewsletter: true }))
-                      } catch {}
+                      } catch {
+                        // Silently continue — preference will sync on next account load
+                      }
                       setNewsletterNudgeDone(true)
                       setShowNewsletterNudge(false)
                     }}>Yes, subscribe me</button>
@@ -928,6 +939,10 @@ export function StudySignupPage() {
       setMessage('Please enter your email and password.')
       return
     }
+    if (!/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(email.trim())) {
+      setMessage('Please enter a valid email address.')
+      return
+    }
     setBusy(true)
     setMessage('')
     try {
@@ -1523,6 +1538,15 @@ export function ColossiansStudySectionPage({ content }: Props) {
     setNotesModalOpen(false)
   }
 
+  useEffect(() => {
+    if (!notesModalOpen) return
+    function onKeyDown(e: KeyboardEvent) {
+      if (e.key === 'Escape') closeNotesModal()
+    }
+    document.addEventListener('keydown', onKeyDown)
+    return () => document.removeEventListener('keydown', onKeyDown)
+  }, [notesModalOpen])
+
   function appendSelectedTextToNotes(selectedText: string) {
     if (!selectedText.trim()) return
     setNoteText(prev => prev ? `${prev.trim()}\n\n${selectedText.trim()}` : selectedText.trim())
@@ -2500,6 +2524,15 @@ export function StudyAccountPage() {
     setEnrollMessage('')
   }
 
+  useEffect(() => {
+    if (accountModal === 'none') return
+    function onKeyDown(e: KeyboardEvent) {
+      if (e.key === 'Escape') closeAccountModal()
+    }
+    document.addEventListener('keydown', onKeyDown)
+    return () => document.removeEventListener('keydown', onKeyDown)
+  }, [accountModal])
+
   if (!auth.checked) {
     return (
       <main className="thanks-page" aria-label="Loading">