diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8413f9db..150e68d9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -48,9 +48,9 @@ jobs:
           - language: go
             build-mode: autobuild
           - language: javascript-typescript
-            build-mode: autobuild
+            build-mode: none
           - language: rust
-            build-mode: autobuild
+            build-mode: none
           # No Swift project in repo — remove entry. Re-add when Swift files need analysis.
           # - language: swift
           #   build-mode: autobuild
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 48838610..95fb9de7 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -11,13 +11,16 @@ on:
     branches: ["develop"]
 
 permissions:
-  security-events: write
   contents: read
 
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      security-events: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -31,10 +34,20 @@ jobs:
             -r
             --skip-git
             ./
+            --output=osv-scanner-results.sarif
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@adfda868f108ac4222129de456ea554034a27db7 # v4
+        with:
+          sarif_file: osv-scanner-results.sarif
 
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8"
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" # v2.3.8
     with:
       scan-args: |-
         -r
diff --git a/AGENTS.md b/AGENTS.md
index c0b95cf7..131ccf7f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -99,6 +99,7 @@ cargo clippy --all-targets --all-features -- -D warnings
 ## Pre-commit Hooks (ACTUAL BEHAVIOR)
 
 <!-- fallow:setup-hooks:start -->
+
 ## Fallow local gate
 
 Before any `git commit` or `git push`, run `fallow audit --format json --quiet --explain --gate-marker agent`. If the verdict is `fail`, fix the reported findings before retrying. Treat JSON runtime errors like `{ "error": true, ... }` as non-blocking.
@@ -109,20 +110,21 @@ For non-skill agents, treat the task map below as the local onboarding source: r
 
 ## Fallow task map
 
-| When the agent is about to... | Run |
-|---|---|
-| delete an "unused" export or file | `fallow dead-code --trace <file>:<export>` |
-| delete an "unused" dependency | `fallow dead-code --trace-dependency <name>` |
-| commit or open a PR | `fallow audit --base <ref>` |
-| prioritize refactoring | `fallow health --hotspots --targets` |
-| ask who owns code | `fallow health --ownership` |
-| check untested-but-reachable code | `fallow health --coverage-gaps` |
-| consolidate duplication | `fallow dupes --trace dup:<fingerprint>` |
-| find feature flags | `fallow flags` |
-| check which architecture rules apply to a file before changing it | `fallow guard <files>` |
-| surface security candidates | `fallow security` |
-| understand a finding | `fallow explain <issue-type>` |
-| scope a monorepo | `--workspace <glob> / --changed-workspaces <ref>` (global flags, prefix any command) |
+| When the agent is about to...                                     | Run                                                                                  |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| delete an "unused" export or file                                 | `fallow dead-code --trace <file>:<export>`                                           |
+| delete an "unused" dependency                                     | `fallow dead-code --trace-dependency <name>`                                         |
+| commit or open a PR                                               | `fallow audit --base <ref>`                                                          |
+| prioritize refactoring                                            | `fallow health --hotspots --targets`                                                 |
+| ask who owns code                                                 | `fallow health --ownership`                                                          |
+| check untested-but-reachable code                                 | `fallow health --coverage-gaps`                                                      |
+| consolidate duplication                                           | `fallow dupes --trace dup:<fingerprint>`                                             |
+| find feature flags                                                | `fallow flags`                                                                       |
+| check which architecture rules apply to a file before changing it | `fallow guard <files>`                                                               |
+| surface security candidates                                       | `fallow security`                                                                    |
+| understand a finding                                              | `fallow explain <issue-type>`                                                        |
+| scope a monorepo                                                  | `--workspace <glob> / --changed-workspaces <ref>` (global flags, prefix any command) |
+
 <!-- fallow:setup-hooks:end -->
 
 - `.husky/pre-commit` (root, ACTIVE): runs `pnpm --filter drop lint-staged && pnpm --filter drop typecheck`
@@ -169,16 +171,43 @@ Coverage 1.17% lines / 2.09% funcs (server, no gates). See `docs/coverage-baseli
 
 Bugs caught during this sequence: `prioritylist.ts:34` (`a.priority == a.priority`); `database/Cargo.toml` missing `serde/derive` (53 errs); `cli/` binary-only, no `lib.rs`.
 
+## GitHub Issues & SonarCloud
+
+**Repo**: `BillyOutlast/drop` (fork). Upstream is `Drop-OSS/drop`. Always use `--repo BillyOutlast/drop` for issues/PRs.
+
+**Checking SonarCloud issues:**
+
+```bash
+gh issue list --repo BillyOutlast/drop --label sonarcloud --state open
+```
+
+**SonarCloud project key**: `BillyOutlast_drop`. Use MCP sonarqube tools to query issues directly:
+
+```text
+search_sonar_issues_in_projects(projects=["BillyOutlast_drop"], issueStatuses=["OPEN"])
+```
+
+**Issue labels**: `sonarcloud`, `critical`, `major`, `minor`, `a11y`, `security`, `vue`, `react`, `readability`, `performance`, `code-quality`, `refactoring`
+
+**Working SonarCloud issues:**
+
+1. List issues: `gh issue list --repo BillyOutlast/drop --label sonarcloud --state open`
+2. Fix issues in code, referencing the SonarCloud rule and file:line
+3. Link fixed issues in PR body with `Closes #N` syntax
+4. One PR can close multiple related issues (e.g., all `:key` binding fixes in one PR)
+
+**Creating issues**: Use `gh issue create --repo BillyOutlast/drop --label sonarcloud` for new findings.
+
 ## Deferred Work Backlog (2026-07-24)
 
-Captured at PR #22 (https://github.com/BillyOutlast/drop/pull/22) close-out. Repo issues disabled — document here instead of filing GitHub issues. **Re-evaluate when coverage >30% or as bandwidth allows.**
+Captured at PR #22 (https://github.com/BillyOutlast/drop/pull/22) close-out. **Re-evaluate when coverage >30% or as bandwidth allows.**
 
 | Item                               | Trigger                  | Why deferred                                                                                                                                                                                                                                                                                                                                                   |
 | ---------------------------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Codecov test-results reporting     | Coverage >30%            | JUnit analytics produce zero signal at 32 tests. Use `codecov-action@v5` with `report_type: test_results` (NOT `codecov/test-results-action@v1` which is DEPRECATED).                                                                                                                                                                                          |
 | `.codecov.yml` with `target: auto` | Coverage >30%            | At 1.17% baseline, ANY new uncovered code drops percentage and blocks every PR. Contradicts current "no gates" policy.                                                                                                                                                                                                                                         |
 | gitleaks-action v2→v3 migration    | Pre-Sept 2026            | v2 uses Node 20; GitHub deprecates Node 20 default in Sept 2026. Also unlocks v3's native fork-PR base-SHA resolution.                                                                                                                                                                                                                                         |
-| SonarCloud C rating fix            | Needs SonarCloud auth    | Cannot view findings via GitHub API. Likely test-only noise (90% of PR #22 is test code).                                                                                                                                                                                                                                                                      |
+| SonarCloud C rating fix            | Ongoing                  | 130 open issues tracked via GitHub labels. Use `gh issue list --repo BillyOutlast/drop --label sonarcloud` to query. Fix batches by category (a11y, vue, react, code-quality).                                                                                                                                                                                 |
 | `noUncheckedIndexedAccess` enable  | After latent-error fixup | 30+ latent TS errors in `server/api/v1/{admin/import/massversion, auth/mfa/webauthn, auth/passkey}/`, `server/internal/{auth/totp, clients/event-handler, metadata/pcgamingwiki, system-data/index, utils/prioritylist}.ts`. Each requires explicit `if (!arr[i]) return` guard.                                                                               |
 | CLI integration tests refactor     | Post lib.rs unblock      | `cli/tests/*.rs` now compile (commit 35b63960), but real coverage of `commands/upload/` and `commands/connect/` flows needs fixture data setup.                                                                                                                                                                                                                |
 | E2E user-flow data fixtures        | Post test DB infra       | 5 page-flow E2E tests were added then removed in PR #22: they return 500 in CI because the app needs DB + auth setup to render pages. The tailwindcss v4 vite plugin recursion is fixed (`E2E=true` guard in `server/nuxt.config.ts`), but the application itself can't render without services. Re-add page tests when test DB + auth fixtures are available. |
@@ -203,12 +232,14 @@ This file is a cache. Before trusting any fact, verify with a direct command:
 When users ask you to perform tasks, check if any of the available skills below can help complete the task more effectively. Skills provide specialized capabilities and domain knowledge.
 
 How to use skills:
+
 - Invoke: `npx openskills read <skill-name>` (run in your shell)
   - For multiple: `npx openskills read skill-one,skill-two`
 - The skill content will load with detailed instructions on how to complete the task
 - Base directory provided in output for resolving bundled resources (references/, scripts/, assets/)
 
 Usage notes:
+
 - Only use skills listed in <available_skills> below
 - Do not invoke a skill that is already loaded in your context
 - Each skill invocation is stateless
diff --git a/desktop/main/components/Header.vue b/desktop/main/components/Header.vue
index 7af7cd23..8b8e1223 100644
--- a/desktop/main/components/Header.vue
+++ b/desktop/main/components/Header.vue
@@ -9,6 +9,7 @@
           <ol class="inline-flex items-center gap-x-6">
             <NuxtLink
               v-for="(nav, navIdx) in navigation"
+              :key="nav.route"
               :class="[
                 'transition  uppercase font-display font-semibold text-md',
                 navIdx === currentNavigation
@@ -22,19 +23,13 @@
           </ol>
         </nav>
       </div>
-      <div
-        @mousedown="() => window.startDragging()"
-        class="flex cursor-pointer grow h-full"
-      />
+      <div @mousedown="() => window.startDragging()" class="flex cursor-pointer grow h-full" />
       <div class="inline-flex items-center">
         <ol class="inline-flex gap-3">
           <HeaderProtonSupportWidget />
           <HeaderQueueWidget :object="currentQueueObject" />
-          <li v-for="(item, itemIdx) in quickActions">
-            <HeaderWidget
-              @click="item.action"
-              :notifications="item.notifications"
-            >
+          <li v-for="(item, itemIdx) in quickActions" :key="itemIdx">
+            <HeaderWidget @click="item.action" :notifications="item.notifications">
               <component class="h-5" :is="item.icon" />
             </HeaderWidget>
           </li>
@@ -43,7 +38,7 @@
         </ol>
       </div>
     </div>
-    <WindowControl  />
+    <WindowControl />
   </div>
 </template>
 
diff --git a/desktop/main/components/HeaderUserWidget.vue b/desktop/main/components/HeaderUserWidget.vue
index d3d16424..f498e2e2 100644
--- a/desktop/main/components/HeaderUserWidget.vue
+++ b/desktop/main/components/HeaderUserWidget.vue
@@ -45,7 +45,7 @@
                 Admin Dashboard
               </a>
             </MenuItem>
-            <MenuItem v-for="(nav, navIdx) in navigation" v-slot="{ active, close }">
+            <MenuItem v-for="(nav, navIdx) in navigation" :key="navIdx" v-slot="{ active, close }">
               <button
                 type="button"
                 @click="() => navigate(close, nav)"
diff --git a/desktop/main/components/LibrarySearch.vue b/desktop/main/components/LibrarySearch.vue
index 416f7bb6..381ee137 100644
--- a/desktop/main/components/LibrarySearch.vue
+++ b/desktop/main/components/LibrarySearch.vue
@@ -54,7 +54,7 @@
         <DisclosurePanel as="dd" class="mt-2 flex flex-col gap-y-1.5">
           <NuxtLink
             v-for="item in nav.items"
-            :key="nav.id"
+            :key="item.id"
             :class="[
               'transition-all duration-300 rounded-lg flex items-center px-1 py-0.5 hover:scale-105 active:scale-95 hover:shadow-lg hover:shadow-zinc-950/50',
               currentNavigation == item.id
@@ -93,7 +93,7 @@
       </Disclosure>
     </TransitionGroup>
     <div v-if="loading" class="h-full grow flex p-8 justify-center text-zinc-100">
-      <div role="status" aria-live="polite">
+      <output aria-live="polite">
         <svg
           aria-hidden="true"
           class="w-6 h-6 text-transparent animate-spin fill-zinc-600"
@@ -111,7 +111,7 @@
           />
         </svg>
         <span class="sr-only">Loading...</span>
-      </div>
+      </output>
     </div>
   </div>
 </template>
diff --git a/desktop/main/pages/auth/code.vue b/desktop/main/pages/auth/code.vue
index 1a9b953b..90d5ab14 100644
--- a/desktop/main/pages/auth/code.vue
+++ b/desktop/main/pages/auth/code.vue
@@ -7,13 +7,13 @@
         </h1>
         <div class="mt-4">
           <p class="text-sm text-zinc-400 max-w-md mx-auto">
-            Open Drop on another one of your devices, and use your account
-            dropdown to "Authorize client", and enter the code below.
+            Open Drop on another one of your devices, and use your account dropdown to "Authorize
+            client", and enter the code below.
           </p>
           <div
             class="mt-8 flex items-center justify-center gap-x-5 text-8xl font-bold text-zinc-100"
           >
-            <span v-for="letter in code.split('')">{{ letter }}</span>
+            <span v-for="(letter, letterIdx) in code.split('')" :key="letterIdx">{{ letter }}</span>
           </div>
         </div>
         <div class="mt-10 flex items-center justify-center gap-x-6">
diff --git a/desktop/main/pages/library/[id]/index.vue b/desktop/main/pages/library/[id]/index.vue
index 8b61049e..408920bb 100644
--- a/desktop/main/pages/library/[id]/index.vue
+++ b/desktop/main/pages/library/[id]/index.vue
@@ -345,7 +345,7 @@
           </div>
         </div>
         <div v-else class="w-full flex items-center justify-center p-4">
-          <div role="status" aria-live="polite">
+          <output aria-live="polite">
             <svg
               aria-hidden="true"
               class="w-7 h-7 text-transparent animate-spin fill-white"
@@ -363,7 +363,7 @@
               />
             </svg>
             <span class="sr-only">Loading...</span>
-          </div>
+          </output>
         </div>
         <div v-if="installDirs">
           <InstallDirectorySelector :install-dirs="installDirs" v-model="installDir" />
@@ -478,7 +478,7 @@
       </div>
 
       <ol class="space-y-2">
-        <li v-for="(launchData, launchIdx) in launchOptions!">
+        <li v-for="(launchData, launchIdx) in launchOptions!" :key="launchIdx">
           <button
             type="button"
             class="transition w-full rounded-sm bg-zinc-800 inline-flex items-center text-sm py-2 px-3 gap-x-2 text-zinc-100 hover:text-zinc-300 hover:bg-zinc-700"
diff --git a/desktop/main/pages/queue.vue b/desktop/main/pages/queue.vue
index d00ac79c..201b6e96 100644
--- a/desktop/main/pages/queue.vue
+++ b/desktop/main/pages/queue.vue
@@ -9,7 +9,8 @@
       </div>
       <div class="absolute inset-0 h-full flex flex-row items-end justify-end space-x-[1px]">
         <div
-          v-for="bar in speedHistory"
+          v-for="(bar, barIdx) in speedHistory"
+          :key="barIdx"
           :style="{ height: `${(bar / speedMax) * 100}%` }"
           class="w-[3px] bg-blue-600 rounded-t-full"
         />
diff --git a/libraries/base/components/LoadingButton.vue b/libraries/base/components/LoadingButton.vue
index cc4fcd49..d9f7397f 100644
--- a/libraries/base/components/LoadingButton.vue
+++ b/libraries/base/components/LoadingButton.vue
@@ -4,7 +4,7 @@
     :class="[styles[style].base, props.disabled ? styles[style].disabled : styles[style].dft]"
     :disabled="props.disabled"
   >
-    <div v-if="props.loading" role="status" aria-live="polite">
+    <output v-if="props.loading" aria-live="polite">
       <svg
         aria-hidden="true"
         class="w-5 h-5 text-transparent animate-spin fill-white"
@@ -22,7 +22,7 @@
         />
       </svg>
       <span class="sr-only">Loading...</span>
-    </div>
+    </output>
     <slot v-else />
   </button>
 </template>
diff --git a/server/components/CodeInput.vue b/server/components/CodeInput.vue
index b31782a9..80ae4e73 100644
--- a/server/components/CodeInput.vue
+++ b/server/components/CodeInput.vue
@@ -51,7 +51,7 @@ function input(index: number) {
     codeElements.value[index + 1].focus();
   }
 
-  if (!(index - 1 < 0) && !v) {
+  if (index >= 1 && !v) {
     codeElements.value[index - 1].focus();
   }
 
diff --git a/server/components/GameEditor/Metadata.vue b/server/components/GameEditor/Metadata.vue
index af857476..e5804afe 100644
--- a/server/components/GameEditor/Metadata.vue
+++ b/server/components/GameEditor/Metadata.vue
@@ -53,7 +53,10 @@
             </div>
           </div>
           <div class="flex flex-col">
-            <label class="text-sm/6 font-medium text-zinc-100">
+            <label
+              for="ageRatingOrg"
+              class="text-sm/6 font-medium text-zinc-100"
+            >
               {{ $t("library.admin.game.ageRatings") }}
             </label>
             <div class="mt-2 space-y-2">
@@ -88,6 +91,7 @@
               </p>
               <div v-if="showAddAgeRating" class="flex items-center gap-2">
                 <select
+                  id="ageRatingOrg"
                   v-model="newAgeRatingOrg"
                   class="rounded-md bg-zinc-800 px-2 py-1 text-sm text-zinc-100 outline outline-1 -outline-offset-1 outline-zinc-700 focus:outline-blue-600"
                 >
@@ -100,8 +104,10 @@
                   </option>
                 </select>
                 <select
+                  id="ageRatingValue"
                   v-model="newAgeRatingValue"
                   :disabled="!newAgeRatingOrg"
+                  aria-label="Age rating value"
                   class="rounded-md bg-zinc-800 px-2 py-1 text-sm text-zinc-100 outline outline-1 -outline-offset-1 outline-zinc-700 focus:outline-blue-600"
                 >
                   <option
diff --git a/server/components/GameEditor/VersionConfig.vue b/server/components/GameEditor/VersionConfig.vue
index a9d4a753..3e27e535 100644
--- a/server/components/GameEditor/VersionConfig.vue
+++ b/server/components/GameEditor/VersionConfig.vue
@@ -50,6 +50,6 @@ const props = defineProps<{
 function isSetup(
   v: typeof props.config,
 ): v is AdminFetchGameType["versions"][number]["setups"][number] {
-  return Object.prototype.hasOwnProperty.call(v, "setupId");
+  return Object.hasOwn(v, "setupId");
 }
 </script>
diff --git a/server/components/Selector/MultiItem.vue b/server/components/Selector/MultiItem.vue
index 75b1df1a..7a75f6d2 100644
--- a/server/components/Selector/MultiItem.vue
+++ b/server/components/Selector/MultiItem.vue
@@ -93,7 +93,7 @@
           v-if="createLoading"
           class="absolute inset-0 bg-zinc-950 flex items-center justify-center"
         >
-          <div role="status" aria-live="polite">
+          <output aria-live="polite">
             <svg
               aria-hidden="true"
               class="size-8 text-transparent animate-spin fill-white"
@@ -111,7 +111,7 @@
               />
             </svg>
             <span class="sr-only">{{ $t("common.srLoading") }}</span>
-          </div>
+          </output>
         </div>
       </div>
     </Combobox>
diff --git a/server/pages/admin/library/index.vue b/server/pages/admin/library/index.vue
index 29508f02..a754e10a 100644
--- a/server/pages/admin/library/index.vue
+++ b/server/pages/admin/library/index.vue
@@ -460,7 +460,7 @@
         v-if="gamesLoading"
         class="absolute inset-0 bg-zinc-900/50 flex items-start p-4 justify-center"
       >
-        <div role="status" aria-live="polite">
+        <output aria-live="polite">
           <svg
             aria-hidden="true"
             class="size-8 text-transparent animate-spin fill-white"
@@ -478,7 +478,7 @@
             />
           </svg>
           <span class="sr-only">{{ $t("common.srLoading") }}</span>
-        </div>
+        </output>
       </div>
     </ul>
     <nav
diff --git a/server/rules/no-prisma-delete.ts b/server/rules/no-prisma-delete.ts
index 88fba3a5..bd700ba7 100644
--- a/server/rules/no-prisma-delete.ts
+++ b/server/rules/no-prisma-delete.ts
@@ -1,6 +1,6 @@
 import type { TSESLint } from "@typescript-eslint/utils";
 
-const blacklistedFunctions = ["delete"];
+const blacklistedFunctions = new Set(["delete"]);
 
 // Models where hard-delete is correct (join tables, auth tokens, ephemeral data)
 const allowedModels = new Set([
@@ -32,7 +32,7 @@ export default {
       CallExpression: function (node) {
         // @ts-expect-error It ain't typing properly
         const funcId = node.callee.property;
-        if (!funcId || !blacklistedFunctions.includes(funcId.name)) return;
+        if (!funcId || !blacklistedFunctions.has(funcId.name)) return;
         // @ts-expect-error It ain't typing properly
         const tableExpr = node.callee.object;
         if (!tableExpr) return;
diff --git a/server/server/internal/clients/event-handler.ts b/server/server/internal/clients/event-handler.ts
index 6390e5e7..0c77f3a1 100644
--- a/server/server/internal/clients/event-handler.ts
+++ b/server/server/internal/clients/event-handler.ts
@@ -58,6 +58,7 @@ export function defineClientEventHandler<T>(handler: EventHandlerFunction<T>) {
 
         const valid = await jose
           .jwtVerify(jwtToken, publicKey, {
+            algorithms: ["ES384"],
             clockTolerance: JWT_TIME_WIGGLE_SECONDS,
           })
           .catch((err) => {
diff --git a/server/server/internal/metadata/giantbomb.ts b/server/server/internal/metadata/giantbomb.ts
index f3488034..e76cddf7 100644
--- a/server/server/internal/metadata/giantbomb.ts
+++ b/server/server/internal/metadata/giantbomb.ts
@@ -357,8 +357,11 @@ export class GiantBombProvider implements MetadataProvider {
       }
 
       if (ageRatings.length > 0) {
+        const ratingsList = ageRatings
+          .map((r) => `${r.organization}: ${r.rating}`)
+          .join(", ");
         context?.logger.info(
-          `Found ${ageRatings.length} age ratings: ${ageRatings.map((r) => `${r.organization}: ${r.rating}`).join(", ")}`,
+          `Found ${ageRatings.length} age ratings: ${ratingsList}`,
         );
       }
     } catch (e) {
diff --git a/server/server/internal/metadata/steam.ts b/server/server/internal/metadata/steam.ts
index d6dd7776..c9dd443c 100644
--- a/server/server/internal/metadata/steam.ts
+++ b/server/server/internal/metadata/steam.ts
@@ -445,8 +445,11 @@ export class SteamProvider implements MetadataProvider {
 
     const ageRatings = this._extractAgeRatings(webAppDetails?.ratings);
     if (ageRatings.length > 0) {
+      const ratingsList = ageRatings
+        .map((r) => `${r.organization}: ${r.rating}`)
+        .join(", ");
       context?.logger.info(
-        `Found ${ageRatings.length} age ratings: ${ageRatings.map((r) => `${r.organization}: ${r.rating}`).join(", ")}`,
+        `Found ${ageRatings.length} age ratings: ${ratingsList}`,
       );
     }
 
diff --git a/sites/promo/src/components/comparison.tsx b/sites/promo/src/components/comparison.tsx
index 3a52ef63..b3e6cafe 100644
--- a/sites/promo/src/components/comparison.tsx
+++ b/sites/promo/src/components/comparison.tsx
@@ -277,8 +277,8 @@ function ProjectCards() {
       <Gradient className="absolute inset-x-2 top-48 bottom-0 rounded-4xl ring-1 ring-black/5 ring-inset" />
       <Container className="relative">
         <div className="grid grid-cols-1 gap-8 lg:grid-cols-3">
-          {projects.map((tier, tierIndex) => (
-            <ProjectCard key={tierIndex} tier={tier} />
+          {projects.map((tier) => (
+            <ProjectCard key={tier.slug} tier={tier} />
           ))}
         </div>
       </Container>
@@ -447,27 +447,36 @@ function ProjectTable({
                 {projects.map((project) => {
                   let value = project.features[section]?.[name];
 
-                  return (
-                    <td
-                      key={project.slug}
-                      data-selected={selectedProject === project ? true : undefined}
-                      className="p-4 data-selected:table-cell max-sm:hidden"
-                    >
-                      {typeof value === "function" ? (
-                        <>{value()}</>
-                      ) : value === true ? (
+                  function renderValue() {
+                    if (typeof value === "function") {
+                      return <>{value()}</>;
+                    }
+                    if (value === true) {
+                      return (
                         <>
                           <CheckIcon className="size-4 fill-green-600" />
                           <span className="sr-only">Included in {project.name}</span>
                         </>
-                      ) : value === false || value === undefined ? (
+                      );
+                    }
+                    if (value === false || value === undefined) {
+                      return (
                         <>
                           <MinusIcon className="size-4 fill-gray-400" />
                           <span className="sr-only">Not included in {project.name}</span>
                         </>
-                      ) : (
-                        <div className="text-xs text-zinc-400">{value}</div>
-                      )}
+                      );
+                    }
+                    return <div className="text-xs text-zinc-400">{value}</div>;
+                  }
+
+                  return (
+                    <td
+                      key={project.slug}
+                      data-selected={selectedProject === project ? true : undefined}
+                      className="p-4 data-selected:table-cell max-sm:hidden"
+                    >
+                      {renderValue()}
                     </td>
                   );
                 })}
diff --git a/sites/promo/src/components/news.tsx b/sites/promo/src/components/news.tsx
index a77840dc..b5f4f9b1 100644
--- a/sites/promo/src/components/news.tsx
+++ b/sites/promo/src/components/news.tsx
@@ -196,11 +196,14 @@ function Pagination({ page, category }: { readonly page: number; readonly catego
 
 export default function News() {
   const paramsPage = useSearchParams().get("page");
-  let page = paramsPage
-    ? typeof paramsPage === "string" && Number.parseInt(paramsPage) > 1
-      ? Number.parseInt(paramsPage)
-      : notFound()
-    : 1;
+  let page: number;
+  if (paramsPage === null) {
+    page = 1;
+  } else if (/^\d+$/.test(paramsPage) && Number.parseInt(paramsPage, 10) >= 1) {
+    page = Number.parseInt(paramsPage, 10);
+  } else {
+    notFound();
+  }
 
   return (
     <main className="overflow-hidden">