fix-log.html had the platform admin token hardcoded in plain text directly in its client-side <script> block -- visible to anyone who viewed the page's source, regardless of auth. This existed before my v3 rebuild (I noticed but didn't flag or fix it at the time -- should have) and I made it worse by writing the NEW rotated token into the same exposed spot when fixing the earlier break. USR369 called this out directly: the entire purpose of the rotation is to stop tokens sitting in plaintext 'everywhere'. Fixed properly this time: removed the hardcoded token from the file entirely, replaced with sessionStorage.getItem('cai_platform_token') with a window.prompt() fallback on first use per browser tab -- token now lives only in that browser's session storage, never in the file's static content on the server, cleared when the tab closes. This is very likely NOT an isolated issue -- any other browser-facing tool page built the same way (db-admin.html, panel.html, dashboard.html, cmd-popup.js/ml-popup.js, and any system-built app like Gym Logger/DoughCalc/Tech's inventory viewer that fetches file-reader.php/file_write_web.php directly from client JS) plausibly has the identical hardcoded-token pattern. Not audited this session -- flagging as a real, likely-widespread follow-up rather than claiming this one fix covers the actual exposure surface.