# Changelog — 2026-07-20

## Security

- Removed two confirmed malicious backdoors.
- Denied executable scripts in uploads and static asset directories.
- Added secure sessions, status checks, CSRF enforcement and upload MIME validation.
- Removed exposed database password from deliverable configuration.
- Disabled production debugging.

## Fixed

- All PHP syntax errors.
- Empty student routing and course pages.
- Student card column compatibility.
- Course enrollment and join-request workflows.
- Attendance rules and grade synchronization.
- Canonical grade engine and final grades.
- Teacher ownership validation across academic modules.
- Student, teacher and admin account management.
- Homework, materials, shadowing, obstacles, vocabulary and participation.
- Certificates, notifications, announcements and settings.

## Added

- `admin/system-health.php`.
- Database compatibility migration.
- Optional staging access reset.
- Arabic deployment, security and repair documentation.
