- index.php: replace unsafe-inline CSP with per-request nonces on all 13 inline scripts/styles - robots.txt: remove sensitive config filenames (db-config, email-config, recaptcha-config) - main.min.js: actually minified with terser (37KB -> 16KB, -38% gzipped)