# Mobile layout refresh — 7 September 2026

## Mobile improvements

- Rebuilt phone page headers so titles and action buttons remain organized.
- Added a compact two-column mobile action panel to the Members page.
- Corrected automatic table cards across Members, Finance, Attendance, Reports,
  Users, Settings, Assets, Tasks, SMS, Zones, and Ministries.
- Reduced card padding and prevented long names, IDs, phone numbers, and form
  controls from overflowing narrow screens.
- Improved the mobile topbar, username truncation, menu button, language button,
  notification button, sidebar height, search fields, and pagination.
- Reordered the staff login page on phones so the login form appears first.
- Compacted the public church header, hero, buttons, statistics, and content cards.
- Desktop layout and database structure are unchanged.

# Production readiness update — 26 August 2026

## Improvements made

- Added environment-based database, URL, application and session configuration.
- Increased the default inactivity timeout to 30 minutes and made it configurable.
- Added central CSRF validation to every POST route and automatic token fields for forms.
- Added stricter HTTPS-aware session handling behind hosting proxies.
- Added HSTS on HTTPS, safer browser headers, private/no-store caching and directory listing protection.
- Hardened internal return redirects against protocol-relative and header-injection values.
- Added minimum 12-character passwords for newly created/reset accounts, username validation and duplicate checks.
- Prevented the signed-in administrator from deleting their own account.
- Added a 5 MB limit and trusted MIME detection for the pastor image upload.
- Improved mobile viewport behavior, input sizing, tap targets, pagination wrapping, modal spacing and overflow handling.
- Added production hosting instructions and an environment configuration template.

## Packaging note

Historical automatic backups and duplicate/source database exports are omitted from the production ZIP to reduce exposure and deployment mistakes. `database/latest_import.sql` remains included as the current database import. Keep the original uploaded ZIP as the untouched archive.

## Validation limitation

The review environment did not provide a PHP runtime, so PHP execution and database integration tests could not be run here. Structural/static checks and archive integrity checks were performed. Run the post-deployment smoke tests in `DEPLOYMENT.md` on the target PHP/MySQL host before entering live data.