diff --git a/api/db/migrate.ts b/api/db/migrate.ts
index 5606523d..4f8d7e9f 100644
--- a/api/db/migrate.ts
+++ b/api/db/migrate.ts
@@ -13,6 +13,7 @@ import { up as up0011SplitFaviconThumbnail } from "./migrations/0011_split_favic
 import { up as up0012FixFaviconReclassification } from "./migrations/0012_fix_favicon_reclassification.ts";
 import { up as up0013DumpUrlCanonical } from "./migrations/0013_dump_url_canonical.ts";
 import { up as up0014ChatReadState } from "./migrations/0014_chat_read_state.ts";
+import { up as up0015TokenRevocation } from "./migrations/0015_token_revocation.ts";
 
 interface Migration {
   name: string;
@@ -40,6 +41,7 @@ const MIGRATIONS: Migration[] = [
   },
   { name: "0013_dump_url_canonical", up: up0013DumpUrlCanonical },
   { name: "0014_chat_read_state", up: up0014ChatReadState },
+  { name: "0015_token_revocation", up: up0015TokenRevocation },
 ];
 
 export function runMigrations(db: DatabaseSync): void {
diff --git a/api/db/migrations/0015_token_revocation.ts b/api/db/migrations/0015_token_revocation.ts
new file mode 100644
index 00000000..a2e0f0ed
--- /dev/null
+++ b/api/db/migrations/0015_token_revocation.ts
@@ -0,0 +1,17 @@
+import type { DatabaseSync } from "node:sqlite";
+
+// Changing or resetting a password must end every session opened before it.
+// Tokens are stateless JWTs, so each user carries a cut-off instead:
+// `users.tokens_valid_after` (ISO), and a token issued before it is refused.
+// NULL — the state every existing user starts in — means no cut-off.
+//
+// Idempotent: also runs against fresh databases created from schema.sql, where
+// the column already exists.
+export function up(db: DatabaseSync): void {
+  const cols = db.prepare(`PRAGMA table_info(users);`).all() as {
+    name: string;
+  }[];
+  if (!cols.some((c) => c.name === "tokens_valid_after")) {
+    db.exec(`ALTER TABLE users ADD COLUMN tokens_valid_after TEXT;`);
+  }
+}
diff --git a/api/db/schema.sql b/api/db/schema.sql
index 6e4d74d5..49983982 100644
--- a/api/db/schema.sql
+++ b/api/db/schema.sql
@@ -31,7 +31,8 @@ CREATE TABLE users (
   description   TEXT,
   invited_by    TEXT REFERENCES users(id),
   email         TEXT NOT NULL,
-  chat_read_at  TEXT
+  chat_read_at  TEXT,
+  tokens_valid_after TEXT
 );
 
 CREATE TABLE votes (
diff --git a/api/lib/auth.ts b/api/lib/auth.ts
index 95f0871e..b4a46a4a 100644
--- a/api/lib/auth.ts
+++ b/api/lib/auth.ts
@@ -1,6 +1,67 @@
 import type { Context } from "@oak/oak";
-import { verifyJWT } from "./jwt.ts";
-import { APIErrorCode, APIException } from "../model/interfaces.ts";
+import { verifyJWT, verifyMediaToken } from "./jwt.ts";
+import {
+  APIErrorCode,
+  APIException,
+  type AuthPayload,
+  type Role,
+} from "../model/interfaces.ts";
+import { db } from "../model/db.ts";
+
+/**
+ * Checks a signature-verified token against the live user row: the user must
+ * still exist, and the token must not predate their last password change
+ * (`users.tokens_valid_after`). Returns the live role, or null to refuse.
+ *
+ * `iat` has one-second resolution, so a token issued in the same second as the
+ * change survives it; one issued after it (the fresh one the change hands back)
+ * always does.
+ */
+function checkTokenOwner(
+  userId: string,
+  iat: number | undefined,
+): { role: Role } | null {
+  const row = db.prepare(
+    `SELECT role, tokens_valid_after FROM users WHERE id = ?;`,
+  ).get(userId) as
+    | { role: Role; tokens_valid_after: string | null }
+    | undefined;
+  if (!row) return null;
+  if (row.tokens_valid_after) {
+    const cutoff = Math.floor(
+      new Date(row.tokens_valid_after).getTime() / 1000,
+    );
+    if ((iat ?? 0) < cutoff) return null;
+  }
+  return { role: row.role };
+}
+
+/**
+ * Verifies a session token end to end: signature, expiry, a user that still
+ * exists and no password change since it was issued. The role comes from the
+ * DB, not the token, since tokens last 7 days and roles change under them.
+ */
+export async function authenticate(
+  token: string,
+): Promise<AuthPayload | null> {
+  const payload = await verifyJWT(token);
+  if (!payload) return null;
+  const live = checkTokenOwner(payload.userId, payload.iat);
+  if (!live) return null;
+  return { ...payload, role: live.role };
+}
+
+/**
+ * Resolves the `?token=` on a media URL to the viewer's user id. Takes a media
+ * token, or a session token from a client that predates them.
+ */
+export async function authenticateMedia(token: string): Promise<string | null> {
+  const media = await verifyMediaToken(token);
+  if (media) {
+    return checkTokenOwner(media.userId, media.iat) ? media.userId : null;
+  }
+  return (await authenticate(token))?.userId ?? null;
+}
 
 /**
  * Extracts the userId from an optional Bearer token.
@@ -8,10 +69,10 @@ import { APIErrorCode, APIException } from "../model/interfaces.ts";
  * Distinguishes *missing* credentials from *invalid* ones:
  * - No `Authorization: Bearer …` header (or a placeholder value such as the
  *   `Bearer undefined` that the client emits when logged out) → anonymous (null).
- * - A real token that fails verification (expired / bad signature) → throws 401,
- *   so a stale client session surfaces as an auth error it can react to, instead
- *   of being silently downgraded to anonymous (which yields a misleading 404 on
- *   private resources).
+ * - A real token that fails verification (expired / bad signature / revoked) →
+ *   throws 401, so a stale client session surfaces as an auth error it can react
+ *   to, instead of being silently downgraded to anonymous (which yields a
+ *   misleading 404 on private resources).
  */
 export async function parseOptionalAuth(ctx: Context): Promise<string | null> {
   const authHeader = ctx.request.headers.get("Authorization");
@@ -20,7 +81,7 @@ export async function parseOptionalAuth(ctx: Context): Promise<string | null> {
   const token = authHeader.substring(7).trim();
   if (!token || token === "undefined" || token === "null") return null;
 
-  const payload = await verifyJWT(token);
+  const payload = await authenticate(token);
   if (!payload) {
     throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Invalid token");
   }
diff --git a/api/lib/jwt.ts b/api/lib/jwt.ts
index 4235617b..1408b707 100644
--- a/api/lib/jwt.ts
+++ b/api/lib/jwt.ts
@@ -1,4 +1,5 @@
-import { randomBytes, scrypt } from "node:crypto";
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { Buffer } from "node:buffer";
 import { jwtVerify, SignJWT } from "@panva/jose";
 
 import {
@@ -47,10 +48,40 @@ export async function createJWT(
 ): Promise<string> {
   return await new SignJWT(payload)
     .setProtectedHeader({ alg: "HS256" })
+    // `iat` is what a password change revokes against (users.tokens_valid_after).
+    .setIssuedAt()
     .setExpirationTime("7d")
     .sign(JWT_KEY);
 }
 
+// ── Media tokens ──────────────────────────────────────────────────────────────
+
+// Media elements can't send an Authorization header, so a private dump's file
+// and thumbnail URLs carry a token in the query string, where it lands in
+// access logs and browser history. That token is this one: it only reads media,
+// so a leaked URL exposes the owner's private files, not their account.
+export async function createMediaToken(userId: string): Promise<string> {
+  return await new SignJWT({ purpose: "media", userId })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime("7d")
+    .sign(JWT_KEY);
+}
+
+export async function verifyMediaToken(
+  token: string,
+): Promise<{ userId: string; iat?: number } | null> {
+  try {
+    const { payload } = await jwtVerify(token, JWT_KEY);
+    if (payload.purpose !== "media" || typeof payload.userId !== "string") {
+      return null;
+    }
+    return { userId: payload.userId, iat: payload.iat };
+  } catch {
+    return null;
+  }
+}
+
 export async function verifyJWT(token: string): Promise<AuthPayload | null> {
   try {
     const { payload } = await jwtVerify(token, JWT_KEY);
@@ -86,7 +117,13 @@ export function verifyPassword(
   return new Promise((resolve, reject) => {
     scrypt(password, salt, 64, (err, derivedKey) => {
       if (err) reject(err);
-      else resolve(hash === derivedKey.toString("hex"));
+      else {
+        const expected = Buffer.from(hash ?? "", "hex");
+        resolve(
+          expected.length === derivedKey.length &&
+            timingSafeEqual(expected, derivedKey),
+        );
+      }
     });
   });
 }
diff --git a/api/lib/public-address.ts b/api/lib/public-address.ts
new file mode 100644
index 00000000..768c912d
--- /dev/null
+++ b/api/lib/public-address.ts
@@ -0,0 +1,137 @@
+/**
+ * Guards for server-side fetches of user-supplied URLs (link previews, the
+ * image proxy, Bandcamp resolution): the server must not become a way to reach
+ * addresses only it can see — loopback, the LAN, container networks, or the
+ * cloud metadata endpoint at 169.254.169.254.
+ */
+
+function parseIPv4(s: string): number[] | null {
+  const parts = s.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = parts.map((p) => /^\d{1,3}$/.test(p) ? Number(p) : NaN);
+  return bytes.every((b) => b >= 0 && b <= 255) ? bytes : null;
+}
+
+function isPrivateIPv4([a, b]: number[]): boolean {
+  return a === 0 || // "this" network
+    a === 10 ||
+    a === 127 ||
+    (a === 100 && b >= 64 && b <= 127) || // carrier-grade NAT
+    (a === 169 && b === 254) || // link-local, cloud metadata
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 0) || // IETF protocol assignments (192.0.0.0/24 …)
+    (a === 192 && b === 168) ||
+    (a === 198 && (b === 18 || b === 19)) || // benchmarking
+    a >= 224; // multicast, reserved, broadcast
+}
+
+/** 16 bytes, or null when `s` isn't an IPv6 address. */
+function parseIPv6(s: string): number[] | null {
+  let addr = s.toLowerCase().replace(/%.*$/, ""); // drop a zone id
+  // An embedded dotted quad (::ffff:10.0.0.1) becomes the last two groups.
+  const lastColon = addr.lastIndexOf(":");
+  if (lastColon === -1) return null;
+  const tail = addr.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    const v4 = parseIPv4(tail);
+    if (!v4) return null;
+    addr = `${addr.slice(0, lastColon + 1)}${
+      ((v4[0] << 8) | v4[1]).toString(16)
+    }:${((v4[2] << 8) | v4[3]).toString(16)}`;
+  }
+  const halves = addr.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = 8 - head.length - rest.length;
+  if (halves.length === 1 ? fill !== 0 : fill < 1) return null;
+  const groups = [...head, ...Array(halves.length === 2 ? fill : 0).fill("0"), ...rest];
+  if (!groups.every((g) => /^[0-9a-f]{1,4}$/.test(g))) return null;
+  return groups.flatMap((g) => {
+    const n = parseInt(g, 16);
+    return [n >> 8, n & 0xff];
+  });
+}
+
+function isPrivateIPv6(b: number[]): boolean {
+  const zeroPrefix = (n: number) => b.slice(0, n).every((x) => x === 0);
+  // IPv4 carried inside IPv6 is judged as the IPv4 address it carries.
+  if (zeroPrefix(10) && b[10] === 0xff && b[11] === 0xff) { // ::ffff:a.b.c.d
+    return isPrivateIPv4(b.slice(12));
+  }
+  if (zeroPrefix(12)) { // ::, ::1 and the deprecated ::a.b.c.d
+    return true;
+  }
+  if ( // 64:ff9b::/96 NAT64
+    b[0] === 0 && b[1] === 0x64 && b[2] === 0xff && b[3] === 0x9b &&
+    b.slice(4, 12).every((x) => x === 0)
+  ) return isPrivateIPv4(b.slice(12));
+  if (b[0] === 0x20 && b[1] === 0x02) { // 2002::/16 6to4
+    return isPrivateIPv4(b.slice(2, 6));
+  }
+  return (b[0] & 0xfe) === 0xfc || // fc00::/7 unique local
+    (b[0] === 0xfe && (b[1] & 0xc0) === 0x80) || // fe80::/10 link-local
+    (b[0] === 0xfe && (b[1] & 0xc0) === 0xc0) || // fec0::/10 site-local
+    b[0] === 0xff; // multicast
+}
+
+/** True for an IP literal outside the public internet. Non-IPs are false. */
+export function isPrivateAddress(ip: string): boolean {
+  const v4 = parseIPv4(ip);
+  if (v4) return isPrivateIPv4(v4);
+  const v6 = parseIPv6(ip);
+  return v6 ? isPrivateIPv6(v6) : false;
+}
+
+function isIpLiteral(host: string): boolean {
+  return parseIPv4(host) !== null || parseIPv6(host) !== null;
+}
+
+/** `URL.hostname` keeps the brackets around an IPv6 literal. */
+function bareHostname(url: URL): string {
+  return url.hostname.replace(/^\[(.*)\]$/, "$1");
+}
+
+/**
+ * The synchronous part of the check: a hostname that is a private IP literal,
+ * or a name that is local by definition. Names still need resolving (see
+ * resolvePublicAddress) — this only rejects what is obvious without DNS.
+ */
+export function isPrivateHostname(url: URL): boolean {
+  const host = bareHostname(url).toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  return isPrivateAddress(host);
+}
+
+/**
+ * Resolves `url`'s host and returns one of its addresses, or throws if the
+ * host is private or any address it resolves to is (a name with both a public
+ * and a private record is refused outright, since the fetch may pick either).
+ *
+ * The fetch itself resolves again, so a DNS server answering differently the
+ * second time (rebinding) isn't fully excluded; the curl fallback pins the
+ * address this returns.
+ */
+export async function resolvePublicAddress(url: URL): Promise<string> {
+  if (isPrivateHostname(url)) {
+    throw new Error(`Refusing to fetch private address ${url.hostname}`);
+  }
+  const host = bareHostname(url);
+  if (isIpLiteral(host)) return host;
+
+  const results = await Promise.allSettled([
+    Deno.resolveDns(host, "A"),
+    Deno.resolveDns(host, "AAAA"),
+  ]);
+  const addresses = results.flatMap((r) =>
+    r.status === "fulfilled" ? r.value : []
+  );
+  if (addresses.length === 0) {
+    throw new Error(`Could not resolve ${host}`);
+  }
+  const blocked = addresses.find(isPrivateAddress);
+  if (blocked) {
+    throw new Error(`Refusing to fetch ${host}: resolves to ${blocked}`);
+  }
+  return addresses[0];
+}
diff --git a/api/lib/rate-limit.ts b/api/lib/rate-limit.ts
new file mode 100644
index 00000000..baccbf38
--- /dev/null
+++ b/api/lib/rate-limit.ts
@@ -0,0 +1,39 @@
+// Token buckets keyed by the caller's choice (e.g. `${kind}:${userId}`) — per
+// user rather than per socket or request, so more tabs or parallel requests
+// don't buy more throughput.
+interface Bucket {
+  tokens: number;
+  at: number;
+}
+const buckets = new Map<string, Bucket>();
+
+export interface RateLimit {
+  /** Burst size. */
+  capacity: number;
+  /** Tokens regained per second. */
+  refill: number;
+}
+
+/** Takes one token for `key`; false when the bucket is empty. */
+export function takeToken(key: string, limit: RateLimit): boolean {
+  const now = Date.now();
+  const bucket = buckets.get(key) ?? { tokens: limit.capacity, at: now };
+  bucket.tokens = Math.min(
+    limit.capacity,
+    bucket.tokens + ((now - bucket.at) / 1000) * limit.refill,
+  );
+  bucket.at = now;
+  buckets.set(key, bucket);
+  if (bucket.tokens < 1) return false;
+  bucket.tokens -= 1;
+  return true;
+}
+
+// Idle buckets have refilled by now for every limit in use; drop them so the
+// map tracks only keys that have been active lately.
+setInterval(() => {
+  const cutoff = Date.now() - 60 * 60_000;
+  for (const [key, bucket] of buckets) {
+    if (bucket.at < cutoff) buckets.delete(key);
+  }
+}, 60_000);
diff --git a/api/lib/self-url.ts b/api/lib/self-url.ts
new file mode 100644
index 00000000..be823b27
--- /dev/null
+++ b/api/lib/self-url.ts
@@ -0,0 +1,23 @@
+import { FRONTEND_URL, PUBLIC_URL } from "../config.ts";
+
+const SELF_HOSTS = new Set(
+  [PUBLIC_URL, FRONTEND_URL].flatMap((u) => {
+    try {
+      return [new URL(u).host.toLowerCase()];
+    } catch {
+      return [];
+    }
+  }),
+);
+
+const SELF_PATH_RE = /^\/(dumps|users|playlists)\/[^/]+$/;
+
+/**
+ * A link to one of this site's own dump, user or playlist pages. Matched on the
+ * host as well as the path: `/users/bob` on some other site is someone else's
+ * page, not ours.
+ */
+export function isSelfUrl(url: URL): boolean {
+  return SELF_HOSTS.has(url.host.toLowerCase()) &&
+    SELF_PATH_RE.test(url.pathname);
+}
diff --git a/api/lib/upload.ts b/api/lib/upload.ts
index af6bf11d..f802a7fb 100644
--- a/api/lib/upload.ts
+++ b/api/lib/upload.ts
@@ -65,6 +65,7 @@ export async function serveUploadedFile(
   filePath: string,
   mime: string,
   cacheMaxAge = 3600,
+  isPrivate = false,
 ): Promise<boolean> {
   let data: Uint8Array;
   try {
@@ -75,7 +76,11 @@ export async function serveUploadedFile(
   }
   ctx.response.headers.set("Content-Type", mime);
   ctx.response.headers.set("Content-Disposition", "inline");
-  ctx.response.headers.set("Cache-Control", `public, max-age=${cacheMaxAge}`);
+  ctx.response.headers.set("X-Content-Type-Options", "nosniff");
+  ctx.response.headers.set(
+    "Cache-Control",
+    `${isPrivate ? "private" : "public"}, max-age=${cacheMaxAge}`,
+  );
   ctx.response.headers.set("Cross-Origin-Resource-Policy", "cross-origin");
   ctx.response.body = data;
   return true;
diff --git a/api/middleware/auth.ts b/api/middleware/auth.ts
index e809e85a..3bfc8877 100644
--- a/api/middleware/auth.ts
+++ b/api/middleware/auth.ts
@@ -4,13 +4,12 @@ import {
   type RouterContext,
   type State,
 } from "@oak/oak";
-import { verifyJWT } from "../lib/jwt.ts";
+import { authenticate } from "../lib/auth.ts";
 import {
   APIErrorCode,
   APIException,
   type AuthPayload,
 } from "../model/interfaces.ts";
-import { getUserById } from "../services/user-service.ts";
 import { can, type Permission } from "../lib/permissions.ts";
 
 export interface AuthState extends State {
@@ -40,23 +39,15 @@ export async function authMiddleware<R extends string>(
   }
 
   const token = authHeader.substring(7);
-  const payload = await verifyJWT(token);
+  // Also checks the user still exists and hasn't changed their password since
+  // the token was issued, and takes the live role from the DB.
+  const payload = await authenticate(token);
 
   if (!payload) {
     throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "Invalid token");
   }
 
-  let user;
-  try {
-    user = getUserById(payload.userId);
-  } catch {
-    throw new APIException(APIErrorCode.UNAUTHORIZED, 401, "User not found");
-  }
-
-  // Trust the live role from the DB, not the role baked into the JWT at login.
-  // Tokens last 7 days, so a role change (e.g. promotion to admin or a demotion)
-  // would otherwise not take effect until the user re-logs in.
-  ctx.state.user = { ...payload, role: user.role };
+  ctx.state.user = payload;
 
   await next();
 }
diff --git a/api/model/interfaces.ts b/api/model/interfaces.ts
index 0deea7ef..302bc7c4 100644
--- a/api/model/interfaces.ts
+++ b/api/model/interfaces.ts
@@ -220,11 +220,14 @@ export interface AuthPayload {
   username: string;
   role: Role;
   exp: number;
+  iat?: number;
 }
 
 export function isAuthPayload(obj: unknown): obj is AuthPayload {
   return !!obj &&
     typeof obj === "object" &&
+    // Purpose-scoped tokens (password reset, media) are never session tokens.
+    !("purpose" in obj) &&
     "userId" in obj && typeof obj.userId === "string" &&
     "username" in obj && typeof obj.username === "string" &&
     "role" in obj && isRole(obj.role) &&
diff --git a/api/routes/dumps.ts b/api/routes/dumps.ts
index 5b8dbc05..cc6514ff 100644
--- a/api/routes/dumps.ts
+++ b/api/routes/dumps.ts
@@ -37,6 +37,10 @@ import { getPlaylistsForDump } from "../services/playlist-service.ts";
 
 const router = new Router({ prefix: "/api/dumps" });
 
+// Every route here takes a slug or an id; the services below them key on the
+// id, so mutations always pass `dump.id` from the resolved dump, never the raw
+// parameter.
+
 // Categories arrive on the multipart create path as a JSON-encoded string field.
 function parseCategoryIds(value: FormDataEntryValue | null): string[] {
   if (typeof value !== "string" || !value) return [];
@@ -193,7 +197,7 @@ router.put("/:dumpId/file", authMiddleware, async (ctx) => {
   }
 
   const updatedDump = await replaceFileDump(
-    dumpId,
+    dump.id,
     file,
     typeof comment === "string" && comment ? comment : undefined,
     typeof title === "string" && title ? title : undefined,
@@ -228,7 +232,7 @@ router.put("/:dumpId", authMiddleware, async (ctx) => {
     );
   }
 
-  const updatedDump = await updateDump(dumpId, body);
+  const updatedDump = await updateDump(dump.id, body);
   const responseBody: APIResponse<Dump> = { success: true, data: updatedDump };
   ctx.response.body = responseBody;
 });
@@ -306,7 +310,7 @@ router.post("/:dumpId/refresh-metadata", authMiddleware, async (ctx) => {
     );
   }
 
-  const updatedDump = await refreshDumpMetadata(dumpId);
+  const updatedDump = await refreshDumpMetadata(dump.id);
   const responseBody: APIResponse<Dump> = { success: true, data: updatedDump };
   ctx.response.body = responseBody;
 });
@@ -324,7 +328,7 @@ router.delete("/:dumpId", authMiddleware, async (ctx) => {
     );
   }
 
-  await deleteDump(dumpId);
+  await deleteDump(dump.id);
 
   const responseBody: APIResponse<null> = { success: true, data: null };
   ctx.response.body = responseBody;
diff --git a/api/routes/files.ts b/api/routes/files.ts
index c8a30128..4f6e4a29 100644
--- a/api/routes/files.ts
+++ b/api/routes/files.ts
@@ -2,7 +2,7 @@ import { Router } from "@oak/oak";
 import { APIErrorCode, APIException } from "../model/interfaces.ts";
 import { getDump } from "../services/dump-service.ts";
 import { DUMPS_DIR } from "../lib/upload.ts";
-import { verifyJWT } from "../lib/jwt.ts";
+import { authenticateMedia } from "../lib/auth.ts";
 
 const router = new Router({ prefix: "/api/files" });
 
@@ -14,15 +14,31 @@ const router = new Router({ prefix: "/api/files" });
  * ASCII-only `filename="…"` fallback plus an RFC 5987 `filename*` with the
  * full UTF-8 name for modern browsers.
  */
-function contentDisposition(name: string): string {
+function contentDisposition(
+  type: "inline" | "attachment",
+  name: string,
+): string {
   const asciiFallback = name
     .replace(/["\\]/g, "_")
     .replace(/[^\x20-\x7e]/g, "_");
-  return `inline; filename="${asciiFallback}"; filename*=UTF-8''${
+  return `${type}; filename="${asciiFallback}"; filename*=UTF-8''${
     encodeURIComponent(name)
   }`;
 }
 
+// The MIME type of an upload is whatever the uploader's browser claimed, and
+// these responses come from the app's own origin — where the session token
+// lives. Only types a browser renders without running the file's own code are
+// served inline; anything else (text/html, image/svg+xml, XML, …) downloads.
+// <img>, <audio> and fetch() ignore Content-Disposition, so previews that embed
+// or read the file still work.
+const INLINE_MIME_RE =
+  /^(image\/(png|jpeg|gif|webp|avif|bmp)|audio\/[\w.+-]+|video\/[\w.+-]+|application\/pdf|text\/plain)$/;
+
+function isInlineSafe(mime: string): boolean {
+  return INLINE_MIME_RE.test(mime.split(";")[0].trim().toLowerCase());
+}
+
 router.get("/:dumpId", async (ctx) => {
   const { dumpId } = ctx.params;
 
@@ -35,8 +51,8 @@ router.get("/:dumpId", async (ctx) => {
   // arrives as a query param (same as the WebSocket route). Needed to authorize
   // access to private dumps the requester owns.
   const token = ctx.request.url.searchParams.get("token");
-  const payload = token ? await verifyJWT(token) : null;
-  const dump = getDump(dumpId, payload?.userId);
+  const viewerId = token ? await authenticateMedia(token) : null;
+  const dump = getDump(dumpId, viewerId ?? undefined);
 
   if (dump.kind !== "file" || !dump.fileMime || !dump.fileName) {
     throw new APIException(
@@ -56,11 +72,27 @@ router.get("/:dumpId", async (ctx) => {
   }
 
   const total = data.byteLength;
+  const inline = isInlineSafe(dump.fileMime);
   ctx.response.headers.set("Content-Type", dump.fileMime);
   ctx.response.headers.set(
     "Content-Disposition",
-    contentDisposition(dump.fileName),
+    contentDisposition(inline ? "inline" : "attachment", dump.fileName),
   );
+  ctx.response.headers.set("X-Content-Type-Options", "nosniff");
+  // Belt and braces for a file opened directly: no scripts, no plugins, no
+  // same-origin access. Chrome won't render a PDF in a sandboxed document, and
+  // its viewer never runs a PDF's scripts anyway, so PDFs go without.
+  if (dump.fileMime !== "application/pdf") {
+    ctx.response.headers.set(
+      "Content-Security-Policy",
+      "sandbox; default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'",
+    );
+  }
+  // The URL may carry a media token; don't pass it on to wherever the file
+  // links.
+  ctx.response.headers.set("Referrer-Policy", "no-referrer");
+  // A private dump's bytes must not sit in a shared cache.
+  if (dump.isPrivate) ctx.response.headers.set("Cache-Control", "private");
   ctx.response.headers.set("Accept-Ranges", "bytes");
 
   const rangeHeader = ctx.request.headers.get("Range");
diff --git a/api/routes/preview.ts b/api/routes/preview.ts
index 48ed5b21..46a584b8 100644
--- a/api/routes/preview.ts
+++ b/api/routes/preview.ts
@@ -5,10 +5,24 @@ import {
   tryFetchRichContent,
 } from "../services/rich-content-service.ts";
 import { APIErrorCode } from "../model/interfaces.ts";
+import { authMiddleware } from "../middleware/auth.ts";
 
 const previewRouter = new Router();
 
-previewRouter.get("/api/preview", async (ctx) => {
+const PROXYABLE_IMAGE_TYPES = new Set([
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "image/avif",
+  "image/bmp",
+  "image/x-icon",
+  "image/vnd.microsoft.icon",
+]);
+
+// Signed-in only: it's the create form's preview, and an open one lets anyone
+// use the server to fetch pages for them.
+previewRouter.get("/api/preview", authMiddleware, async (ctx) => {
   const url = ctx.request.url.searchParams.get("url") ?? "";
   if (!isValidHttpUrl(url)) {
     ctx.response.status = 400;
@@ -42,8 +56,13 @@ previewRouter.get("/api/proxy-image", async (ctx) => {
 
   try {
     const res = await fetchWithTimeout(url, 8000);
-    const contentType = res.headers.get("content-type") ?? "";
-    if (!contentType.startsWith("image/")) {
+    // Raster formats only. The bytes go out under this site's origin, so an
+    // SVG (which can carry script) or anything else a browser might execute
+    // would run with the app's origin if opened directly.
+    const contentType = (res.headers.get("content-type") ?? "")
+      .split(";")[0].trim().toLowerCase();
+    if (!PROXYABLE_IMAGE_TYPES.has(contentType)) {
+      await res.body?.cancel();
       ctx.response.status = 400;
       return;
     }
@@ -51,6 +70,7 @@ previewRouter.get("/api/proxy-image", async (ctx) => {
     const MAX_SIZE = 5 * 1024 * 1024; // 5 MB
     const contentLength = Number(res.headers.get("content-length") ?? "0");
     if (contentLength > MAX_SIZE) {
+      await res.body?.cancel();
       ctx.response.status = 400;
       return;
     }
@@ -62,6 +82,11 @@ previewRouter.get("/api/proxy-image", async (ctx) => {
     }
 
     ctx.response.headers.set("Content-Type", contentType);
+    ctx.response.headers.set("X-Content-Type-Options", "nosniff");
+    ctx.response.headers.set(
+      "Content-Security-Policy",
+      "sandbox; default-src 'none'",
+    );
     ctx.response.headers.set("Cache-Control", "public, max-age=86400");
     ctx.response.body = bytes;
   } catch {
diff --git a/api/routes/thumbnails.ts b/api/routes/thumbnails.ts
index c40be33d..40e4d774 100644
--- a/api/routes/thumbnails.ts
+++ b/api/routes/thumbnails.ts
@@ -3,7 +3,7 @@ import { APIErrorCode, APIException } from "../model/interfaces.ts";
 import { getDump, getDumpThumbnailInfo } from "../services/dump-service.ts";
 import { serveUploadedFile } from "../lib/upload.ts";
 import { DUMPS_DIR, THUMBNAILS_DIR } from "../config.ts";
-import { verifyJWT } from "../lib/jwt.ts";
+import { authenticateMedia } from "../lib/auth.ts";
 
 const router = new Router({ prefix: "/api/thumbnails" });
 
@@ -28,6 +28,14 @@ async function generateThumbnail(
   await Deno.mkdir(THUMBNAILS_DIR, { recursive: true });
   const cmd = new Deno.Command("ffmpeg", {
     args: [
+      // The upload's type is only what the uploader claimed, and ffmpeg probes
+      // the real format from the bytes — a "video" could be an HLS or concat
+      // playlist pointing ffmpeg at local files or internal URLs. Read nothing
+      // but the file itself, and only as an actual video container.
+      "-protocol_whitelist",
+      "file",
+      "-format_whitelist",
+      "mov,mp4,m4a,3gp,3g2,mj2,matroska,webm,avi,flv,mpegts,mpeg,ogg,asf,h264,hevc",
       "-ss",
       "00:00:01",
       "-i",
@@ -58,8 +66,14 @@ router.get("/:dumpId", async (ctx) => {
   // Token via query param (media elements can't send headers) — authorizes the
   // owner's private dumps and gates the custom-thumbnail branch below too.
   const token = ctx.request.url.searchParams.get("token");
-  const payload = token ? await verifyJWT(token) : null;
-  const dump = getDump(dumpId, payload?.userId);
+  const viewerId = token ? await authenticateMedia(token) : null;
+  const dump = getDump(dumpId, viewerId ?? undefined);
+  // The URL may carry a media token; keep it out of anyone else's logs.
+  ctx.response.headers.set("Referrer-Policy", "no-referrer");
+  // A private dump's thumbnail must not sit in a shared cache.
+  const cacheControl = dump.isPrivate
+    ? "private, max-age=31536000, immutable"
+    : "public, max-age=31536000, immutable";
 
   const customThumb = getDumpThumbnailInfo(dumpId);
   if (customThumb) {
@@ -67,6 +81,8 @@ router.get("/:dumpId", async (ctx) => {
       ctx,
       `${THUMBNAILS_DIR}/${customThumb.id}-custom`,
       customThumb.mime,
+      3600,
+      dump.isPrivate,
     );
     if (served) return;
   }
@@ -85,10 +101,7 @@ router.get("/:dumpId", async (ctx) => {
   try {
     const data = await Deno.readFile(thumbPath);
     ctx.response.headers.set("Content-Type", "image/jpeg");
-    ctx.response.headers.set(
-      "Cache-Control",
-      "public, max-age=31536000, immutable",
-    );
+    ctx.response.headers.set("Cache-Control", cacheControl);
     ctx.response.body = data;
     return;
   } catch {
@@ -116,10 +129,7 @@ router.get("/:dumpId", async (ctx) => {
 
   const data = await Deno.readFile(thumbPath);
   ctx.response.headers.set("Content-Type", "image/jpeg");
-  ctx.response.headers.set(
-    "Cache-Control",
-    "public, max-age=31536000, immutable",
-  );
+  ctx.response.headers.set("Cache-Control", cacheControl);
   ctx.response.body = data;
 });
 
diff --git a/api/routes/users.ts b/api/routes/users.ts
index 82e84a1f..be360ebc 100644
--- a/api/routes/users.ts
+++ b/api/routes/users.ts
@@ -7,10 +7,12 @@ import {
   isRole,
   isUpdateUserRequest,
   type PaginatedData,
+  type User,
   validateRegisterUserRequest,
 } from "../model/interfaces.ts";
 
-import { createJWT, verifyPassword } from "../lib/jwt.ts";
+import { createJWT, createMediaToken, verifyPassword } from "../lib/jwt.ts";
+import { type RateLimit, takeToken } from "../lib/rate-limit.ts";
 import {
   type AuthContext,
   authMiddleware,
@@ -26,7 +28,7 @@ import {
   searchUsers,
   updateUser,
 } from "../services/user-service.ts";
-import { redeemInvite, validateInvite } from "../services/invite-service.ts";
+import { claimInvite, releaseInvite } from "../services/invite-service.ts";
 import {
   requestPasswordReset,
   resetPassword,
@@ -53,6 +55,22 @@ import {
 // Users router
 const router = new Router({ prefix: "/api/users" });
 
+// A burst of 10 attempts, then one every 30s.
+const LOGIN_LIMIT: RateLimit = { capacity: 10, refill: 1 / 30 };
+
+// The session token, plus the media-only token that goes in file and
+// thumbnail URLs (see createMediaToken).
+async function issueTokens(user: User) {
+  return {
+    token: await createJWT({
+      userId: user.id,
+      username: user.username,
+      role: user.role,
+    }),
+    mediaToken: await createMediaToken(user.id),
+  };
+}
+
 // Register a new user (requires a valid invite token)
 router.post("/register", async (ctx) => {
   const body = await ctx.request.body.json();
@@ -62,16 +80,16 @@ router.post("/register", async (ctx) => {
     throw new APIException(APIErrorCode.VALIDATION_ERROR, 400, registerError);
   }
 
-  // Validate invite — throws 404/409 if bad
-  const inviterId = validateInvite(body.inviteToken);
+  // Claim the invite up front (throws 404/409 if bad) and hand it back if the
+  // account can't be created, so one invite can't open two accounts.
+  const inviterId = claimInvite(body.inviteToken);
 
-  const user = await createUser(body, inviterId);
-
-  // Mark invite as used only after the user row is committed
+  let user;
   try {
-    redeemInvite(body.inviteToken);
+    user = await createUser(body, inviterId);
   } catch (err) {
-    console.error("[register] redeemInvite failed (user created):", err);
+    releaseInvite(body.inviteToken);
+    throw err;
   }
 
   // Send welcome email (fire-and-forget)
@@ -88,63 +106,62 @@ router.post("/register", async (ctx) => {
     }).catch((err) => console.error("[register] welcome email failed:", err));
   }
 
-  const authToken = await createJWT({
-    userId: user.id,
-    username: user.username,
-    role: user.role,
-  });
-
   const { passwordHash: _, ...publicUser } = user;
   ctx.response.status = 201;
   ctx.response.body = {
     success: true,
-    data: { token: authToken, user: publicUser },
+    data: { ...await issueTokens(user), user: publicUser },
   };
 });
 
 // Login
 router.post("/login", async (ctx) => {
-  try {
-    const body = await ctx.request.body.json();
+  const body = await ctx.request.body.json();
 
-    if (!isLoginUserRequest(body)) {
-      throw new APIException(
-        APIErrorCode.VALIDATION_ERROR,
-        400,
-        "Invalid request",
-      );
-    }
-
-    const user = getUserByUsername(body.username);
-    const valid = await verifyPassword(body.password, user.passwordHash);
-
-    if (!valid) {
-      throw new APIException(
-        APIErrorCode.VALIDATION_ERROR,
-        401,
-        "Invalid username or password",
-      );
-    }
-
-    const token = await createJWT({
-      userId: user.id,
-      username: user.username,
-      role: user.role,
-    });
-
-    const { passwordHash: _, ...publicUser } = user;
-    ctx.response.body = {
-      success: true,
-      data: {
-        token,
-        user: publicUser,
-      },
-    };
-  } catch (err) {
-    console.error(err);
-
-    throw new APIException(APIErrorCode.SERVER_ERROR, 500, "Failed to login");
+  if (!isLoginUserRequest(body)) {
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      400,
+      "Invalid request",
+    );
   }
+
+  // Per account, so guessing one user's password is slow however many
+  // connections it comes from.
+  if (!takeToken(`login:${body.username.toLowerCase()}`, LOGIN_LIMIT)) {
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      429,
+      "Too many login attempts — try again in a minute",
+    );
+  }
+
+  let user;
+  try {
+    user = getUserByUsername(body.username);
+  } catch {
+    // Same answer as a wrong password: don't confirm which usernames exist.
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      401,
+      "Invalid username or password",
+    );
+  }
+
+  const valid = await verifyPassword(body.password, user.passwordHash);
+  if (!valid) {
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      401,
+      "Invalid username or password",
+    );
+  }
+
+  const { passwordHash: _, ...publicUser } = user;
+  ctx.response.body = {
+    success: true,
+    data: { ...await issueTokens(user), user: publicUser },
+  };
 });
 
 // Get current user profile
@@ -177,6 +194,14 @@ router.get("/me", authMiddleware, (ctx: AuthContext) => {
   }
 });
 
+// A media token for a session that predates them (see createMediaToken).
+router.get("/me/media-token", authMiddleware, async (ctx: AuthContext) => {
+  ctx.response.body = {
+    success: true,
+    data: { mediaToken: await createMediaToken(ctx.state.user.userId) },
+  };
+});
+
 // Request a password reset email (unauthenticated; always returns 200)
 router.post("/request-password-reset", async (ctx) => {
   const body = await ctx.request.body.json();
@@ -241,8 +266,12 @@ router.post("/me/change-password", authMiddleware, async (ctx: AuthContext) => {
     );
   }
 
-  await updateUser(ctx.state.user.userId, { password: newPassword });
-  ctx.response.body = { success: true };
+  // Changing the password revokes every token issued before it, this
+  // session's included, so hand back fresh ones for the client to keep.
+  const updated = await updateUser(ctx.state.user.userId, {
+    password: newPassword,
+  });
+  ctx.response.body = { success: true, data: await issueTokens(updated) };
 });
 
 // Update current user profile (description, etc.)
@@ -255,10 +284,14 @@ router.patch("/me", authMiddleware, async (ctx: AuthContext) => {
       "Invalid request",
     );
   }
-  // Self-service profile updates must never set the role. Role assignment is
-  // done out-of-band (DB/seed); stripping it here prevents self-promotion.
-  const { role: _role, ...safeBody } = body;
-  const updated = await updateUser(ctx.state.user.userId, safeBody);
+  // Only the profile fields. The role is assigned by an admin, the password
+  // changes through /me/change-password (which asks for the current one), and
+  // the username is fixed — a token alone must not be able to change any of
+  // them.
+  const updated = await updateUser(ctx.state.user.userId, {
+    description: body.description,
+    email: body.email,
+  });
   const { passwordHash: _, email: _email, ...publicUser } = updated;
   broadcastUserUpdated(publicUser);
   ctx.response.body = { success: true, data: publicUser };
diff --git a/api/routes/ws.ts b/api/routes/ws.ts
index 14b4435d..1951f058 100644
--- a/api/routes/ws.ts
+++ b/api/routes/ws.ts
@@ -1,6 +1,6 @@
 import { Router } from "@oak/oak";
 import { ALLOWED_ORIGINS } from "../config.ts";
-import { verifyJWT } from "../lib/jwt.ts";
+import { authenticate } from "../lib/auth.ts";
 import {
   broadcastChatMessage,
   broadcastChatMessageDeleted,
@@ -44,6 +44,7 @@ import { getUserById } from "../services/user-service.ts";
 import {
   APIException,
   type ClientToServerMessage,
+  type User,
 } from "../model/interfaces.ts";
 
 const router = new Router();
@@ -64,19 +65,24 @@ router.get("/ws", async (ctx) => {
     return;
   }
 
+  // authenticate() refuses a token whose user is gone or which predates a
+  // password change, and reads the live role from the DB. Such a socket is
+  // simply anonymous; the client's next API call gets the 401.
   const token = ctx.request.url.searchParams.get("token");
-  const authPayload = token ? await verifyJWT(token) : null;
+  const authPayload = token ? await authenticate(token) : null;
+  let user: User | undefined;
+  try {
+    user = authPayload ? getUserById(authPayload.userId) : undefined;
+  } catch {
+    user = undefined;
+  }
 
   const socket = ctx.upgrade();
 
-  // Read the live user so the role reflects the DB, not the (possibly stale)
-  // role embedded in the 7-day JWT.
-  const user = authPayload ? getUserById(authPayload.userId) : undefined;
-
   const client: WsClient = {
     socket,
-    userId: authPayload?.userId,
-    username: authPayload?.username,
+    userId: user?.id,
+    username: user?.username,
     role: user?.role,
     avatarMime: user?.avatarMime,
   };
@@ -87,16 +93,10 @@ router.get("/ws", async (ctx) => {
     broadcastPresence();
 
     try {
-      const myVotes = authPayload ? getUserVotes(authPayload.userId) : [];
-      const myCommentLikes = authPayload
-        ? getUserCommentLikes(authPayload.userId)
-        : [];
-      const unreadNotificationCount = authPayload
-        ? getUnreadCount(authPayload.userId)
-        : 0;
-      const chatRead = authPayload
-        ? getChatReadState(authPayload.userId)
-        : undefined;
+      const myVotes = user ? getUserVotes(user.id) : [];
+      const myCommentLikes = user ? getUserCommentLikes(user.id) : [];
+      const unreadNotificationCount = user ? getUnreadCount(user.id) : 0;
+      const chatRead = user ? getChatReadState(user.id) : undefined;
       socket.send(JSON.stringify({
         type: "welcome",
         users: getOnlineUsers(),
@@ -112,56 +112,12 @@ router.get("/ws", async (ctx) => {
   });
 
   socket.addEventListener("message", (event) => {
-    let msg: ClientToServerMessage;
+    // An exception escaping a WebSocket listener is uncaught in Deno and ends
+    // the process, so nothing a client sends may throw out of here.
     try {
-      msg = JSON.parse(event.data as string);
-    } catch {
-      return;
-    }
-
-    switch (msg.type) {
-      case "ping":
-        socket.send(JSON.stringify({ type: "pong" }));
-        break;
-      case "pong":
-        handleClientPong(client);
-        break;
-      case "vote_cast":
-        handleVote(client, msg.dumpId, "cast");
-        break;
-      case "vote_remove":
-        handleVote(client, msg.dumpId, "remove");
-        break;
-      case "comment_like_cast":
-        handleCommentLike(client, msg.commentId, "cast");
-        break;
-      case "comment_like_remove":
-        handleCommentLike(client, msg.commentId, "remove");
-        break;
-      case "chat_send":
-        handleChatSend(client, msg.body, msg.replyToId, msg.nonce);
-        break;
-      case "chat_typing":
-        // Typing is cosmetic: past the limit it's just dropped.
-        if (
-          client.userId &&
-          takeToken(`typing:${client.userId}`, TYPING_LIMIT)
-        ) {
-          setClientTyping(client, msg.typing === true);
-        }
-        break;
-      case "chat_focus":
-        client.chatOpen = msg.open === true;
-        break;
-      case "chat_edit":
-        handleChatEdit(client, msg.id, msg.body);
-        break;
-      case "chat_delete":
-        handleChatDelete(client, msg.id);
-        break;
-      case "chat_read":
-        handleChatRead(client, msg.at);
-        break;
+      handleMessage(client, event.data);
+    } catch (err) {
+      console.error("[ws] message handler failed:", err);
     }
   });
 
@@ -173,70 +129,150 @@ router.get("/ws", async (ctx) => {
   });
 });
 
+function handleMessage(client: WsClient, data: unknown): void {
+  if (typeof data !== "string") return;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(data);
+  } catch {
+    return;
+  }
+  // Anything but an object with a string `type` (`null`, a number, an array)
+  // is ignored rather than read from.
+  if (
+    typeof parsed !== "object" || parsed === null ||
+    typeof (parsed as { type?: unknown }).type !== "string"
+  ) return;
+  const msg = parsed as ClientToServerMessage;
+  const { socket } = client;
+
+  switch (msg.type) {
+    case "ping":
+      send(socket, { type: "pong" });
+      break;
+    case "pong":
+      handleClientPong(client);
+      break;
+    case "vote_cast":
+      handleVote(client, msg.dumpId, "cast");
+      break;
+    case "vote_remove":
+      handleVote(client, msg.dumpId, "remove");
+      break;
+    case "comment_like_cast":
+      handleCommentLike(client, msg.commentId, "cast");
+      break;
+    case "comment_like_remove":
+      handleCommentLike(client, msg.commentId, "remove");
+      break;
+    case "chat_send":
+      handleChatSend(client, msg.body, msg.replyToId, msg.nonce);
+      break;
+    case "chat_typing":
+      // Typing is cosmetic: past the limit it's just dropped.
+      if (
+        client.userId &&
+        takeToken(`typing:${client.userId}`, TYPING_LIMIT)
+      ) {
+        setClientTyping(client, msg.typing === true);
+      }
+      break;
+    case "chat_focus":
+      client.chatOpen = msg.open === true;
+      break;
+    case "chat_edit":
+      handleChatEdit(client, msg.id, msg.body);
+      break;
+    case "chat_delete":
+      handleChatDelete(client, msg.id);
+      break;
+    case "chat_read":
+      handleChatRead(client, msg.at);
+      break;
+  }
+}
+
+// Sends only while the socket is open: `send` on a closing socket throws.
+function send(socket: WebSocket, data: Record<string, unknown>): void {
+  if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(data));
+}
+
 function handleVote(
   client: WsClient,
-  dumpId: string,
+  dumpId: unknown,
   action: "cast" | "remove",
 ): void {
   const { socket } = client;
 
   if (!client.userId) {
-    socket.send(
-      JSON.stringify({ type: "error", message: "Authentication required" }),
-    );
+    send(socket, { type: "error", message: "Authentication required" });
     return;
   }
+  if (typeof dumpId !== "string") return;
 
   try {
-    const newCount = action === "cast"
+    const { voteCount, isPrivate } = action === "cast"
       ? castVote(dumpId, client.userId)
       : removeVote(dumpId, client.userId);
 
-    socket.send(JSON.stringify({
+    send(socket, {
       type: "vote_ack",
       dumpId,
       action,
       success: true,
-      voteCount: newCount,
-    }));
+      voteCount,
+    });
 
-    broadcastVoteUpdate(dumpId, newCount, client.userId, action);
+    // Only a private dump's owner can vote on it, so they're its whole
+    // audience.
+    broadcastVoteUpdate(
+      dumpId,
+      voteCount,
+      client.userId,
+      action,
+      isPrivate ? client.userId : undefined,
+    );
   } catch (err) {
     const message = err instanceof APIException ? err.message : "Vote failed";
-    socket.send(JSON.stringify({ type: "error", message, dumpId, action }));
+    send(socket, { type: "error", message, dumpId, action });
   }
 }
 
 function handleCommentLike(
   client: WsClient,
-  commentId: string,
+  commentId: unknown,
   action: "cast" | "remove",
 ): void {
   const { socket } = client;
 
   if (!client.userId) {
-    socket.send(
-      JSON.stringify({ type: "error", message: "Authentication required" }),
-    );
+    send(socket, { type: "error", message: "Authentication required" });
     return;
   }
+  if (typeof commentId !== "string") return;
 
   try {
-    const newCount = action === "cast"
+    const { likeCount, isPrivate } = action === "cast"
       ? castCommentLike(commentId, client.userId)
       : removeCommentLike(commentId, client.userId);
 
-    socket.send(JSON.stringify({
+    send(socket, {
       type: "comment_like_ack",
       commentId,
       action,
-      likeCount: newCount,
-    }));
+      likeCount,
+    });
 
-    broadcastCommentLikeUpdate(commentId, newCount, client.userId, action);
+    broadcastCommentLikeUpdate(
+      commentId,
+      likeCount,
+      client.userId,
+      action,
+      isPrivate ? client.userId : undefined,
+    );
   } catch (err) {
     const message = err instanceof APIException ? err.message : "Like failed";
-    socket.send(JSON.stringify({ type: "error", message, commentId, action }));
+    send(socket, { type: "error", message, commentId, action });
   }
 }
 
@@ -253,10 +289,7 @@ function sendChatError(
   message: string,
   nonce?: string,
 ): void {
-  if (client.socket.readyState !== WebSocket.OPEN) return;
-  client.socket.send(
-    JSON.stringify({ type: "error", scope: "chat", message, nonce }),
-  );
+  send(client.socket, { type: "error", scope: "chat", message, nonce });
 }
 
 // Validates the common preconditions of a chat write: signed in and under the
diff --git a/api/services/chat-service.ts b/api/services/chat-service.ts
index 7030efb9..d8adf166 100644
--- a/api/services/chat-service.ts
+++ b/api/services/chat-service.ts
@@ -252,8 +252,11 @@ export function markChatRead(userId: string, at: string): ChatReadState {
   const newest = db.prepare(
     `SELECT MAX(created_at) AS newest FROM chat_messages;`,
   ).get() as { newest: string | null };
+  // No messages yet: there's nothing to have read, and no newest message to
+  // cap a bogus far-future marker at — which could never be moved back.
+  if (!newest.newest) return getChatReadState(userId);
   const iso = parsed.toISOString();
-  const target = newest.newest && iso > newest.newest ? newest.newest : iso;
+  const target = iso > newest.newest ? newest.newest : iso;
   db.prepare(
     `UPDATE users SET chat_read_at = ?
      WHERE id = ? AND (chat_read_at IS NULL OR chat_read_at < ?);`,
diff --git a/api/services/comment-like-service.ts b/api/services/comment-like-service.ts
index 27a211c3..700e1410 100644
--- a/api/services/comment-like-service.ts
+++ b/api/services/comment-like-service.ts
@@ -2,7 +2,29 @@ import { APIErrorCode, APIException, type User } from "../model/interfaces.ts";
 import { db, isUserRow, userRowToApi } from "../model/db.ts";
 import { notifyCommentOwnerLike } from "./notification-service.ts";
 
-export function castCommentLike(commentId: string, userId: string): number {
+export interface LikeResult {
+  likeCount: number;
+  /** Likes on a private dump's comments go to the dump's owner only. */
+  isPrivate: boolean;
+}
+
+// Visibility of the comment's dump, or a 404 when the user can't see it.
+function commentVisibility(commentId: string, userId: string): boolean {
+  const row = db.prepare(
+    `SELECT d.is_private, d.user_id FROM comments c JOIN dumps d ON d.id = c.dump_id
+     WHERE c.id = ?;`,
+  ).get(commentId) as { is_private: number; user_id: string } | undefined;
+  if (!row || (row.is_private && row.user_id !== userId)) {
+    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
+  }
+  return Boolean(row.is_private);
+}
+
+export function castCommentLike(
+  commentId: string,
+  userId: string,
+): LikeResult {
+  const isPrivate = commentVisibility(commentId, userId);
   let likeCount: number;
   try {
     db.exec("BEGIN;");
@@ -34,10 +56,20 @@ export function castCommentLike(commentId: string, userId: string): number {
   try {
     notifyCommentOwnerLike(userId, commentId);
   } catch { /* ignore */ }
-  return likeCount;
+  return { likeCount, isPrivate };
 }
 
-export function removeCommentLike(commentId: string, userId: string): number {
+// No visibility check: taking back a like is harmless, and it's the user's own
+// row.
+export function removeCommentLike(
+  commentId: string,
+  userId: string,
+): LikeResult {
+  const dumpRow = db.prepare(
+    `SELECT d.is_private FROM comments c JOIN dumps d ON d.id = c.dump_id
+     WHERE c.id = ?;`,
+  ).get(commentId) as { is_private: number } | undefined;
+  const isPrivate = Boolean(dumpRow?.is_private);
   try {
     db.exec("BEGIN;");
     const result = db.prepare(
@@ -54,7 +86,7 @@ export function removeCommentLike(commentId: string, userId: string): number {
       `SELECT like_count FROM comments WHERE id = ?;`,
     ).get(commentId) as { like_count: number } | undefined;
     db.exec("COMMIT;");
-    return row?.like_count ?? 0;
+    return { likeCount: row?.like_count ?? 0, isPrivate };
   } catch (err) {
     if (err instanceof APIException) throw err;
     db.exec("ROLLBACK;");
diff --git a/api/services/dump-service.ts b/api/services/dump-service.ts
index 7a403523..15e560ce 100644
--- a/api/services/dump-service.ts
+++ b/api/services/dump-service.ts
@@ -36,6 +36,7 @@ import {
   DUMP_MAX_FILE_SIZE_BYTES,
   DUMPS_DIR,
   THUMBNAILS_DIR,
+  VALIDATION,
 } from "../config.ts";
 import { linkAttachments } from "./attachment-service.ts";
 import { relinkBacklinks } from "./backlink-service.ts";
@@ -46,6 +47,25 @@ function isAllowedMime(mime: string): boolean {
     DUMP_ALLOWED_MIME_TYPES.has(mime);
 }
 
+// The JSON routes validate these in isCreateUrlDumpRequest/isUpdateDumpRequest;
+// the multipart ones (file create and replace) arrive here unchecked.
+function assertFileDumpText(title?: string, comment?: string): void {
+  if (title && title.trim().length > VALIDATION.DUMP_TITLE_MAX) {
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      400,
+      `Title must be at most ${VALIDATION.DUMP_TITLE_MAX} characters`,
+    );
+  }
+  if (comment && comment.length > VALIDATION.DUMP_COMMENT_MAX) {
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      400,
+      `Comment must be at most ${VALIDATION.DUMP_COMMENT_MAX} characters`,
+    );
+  }
+}
+
 function titleFromUrl(url: string): string {
   try {
     return new URL(url).hostname.replace(/^www\./, "");
@@ -127,6 +147,7 @@ export async function createFileDump(
   title?: string,
   categoryIds: string[] = [],
 ): Promise<Dump> {
+  assertFileDumpText(title, comment);
   if (!isAllowedMime(file.type)) {
     throw new APIException(
       APIErrorCode.BAD_REQUEST,
@@ -489,6 +510,7 @@ export async function replaceFileDump(
   title?: string,
   categoryIds?: string[],
 ): Promise<Dump> {
+  assertFileDumpText(title, comment);
   if (!isAllowedMime(file.type)) {
     throw new APIException(
       APIErrorCode.BAD_REQUEST,
diff --git a/api/services/invite-service.ts b/api/services/invite-service.ts
index fc3813c0..e246ad7d 100644
--- a/api/services/invite-service.ts
+++ b/api/services/invite-service.ts
@@ -60,10 +60,26 @@ export function validateInvite(token: string): string {
 }
 
 /**
- * Marks the token as used. Call this only after the user has been created.
+ * Validates the token and marks it used in one step, returning the inviterId.
+ * Claim before the (async) account creation, not after: checking first and
+ * marking later lets parallel registrations all pass the check on one invite.
  */
-export function redeemInvite(token: string): void {
-  db.prepare(
-    `UPDATE invites SET used_at = ? WHERE token = ?;`,
+export function claimInvite(token: string): string {
+  const inviterId = validateInvite(token);
+  const result = db.prepare(
+    `UPDATE invites SET used_at = ? WHERE token = ? AND used_at IS NULL;`,
   ).run(new Date().toISOString(), token);
+  if (result.changes === 0) {
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      409,
+      "Invite already used",
+    );
+  }
+  return inviterId;
+}
+
+/** Hands a claimed invite back when the account it was claimed for failed. */
+export function releaseInvite(token: string): void {
+  db.prepare(`UPDATE invites SET used_at = NULL WHERE token = ?;`).run(token);
 }
diff --git a/api/services/password-reset-service.ts b/api/services/password-reset-service.ts
index 89b5dfa4..c6c86157 100644
--- a/api/services/password-reset-service.ts
+++ b/api/services/password-reset-service.ts
@@ -13,6 +13,7 @@ import {
   VALIDATION,
 } from "../config.ts";
 import { marked } from "marked";
+import { type RateLimit, takeToken } from "../lib/rate-limit.ts";
 
 const RESET_TOKEN_TTL_HOURS = 1;
 
@@ -21,7 +22,12 @@ const RESET_TOKEN_TTL_HOURS = 1;
  * sends the reset link. Always resolves without throwing so callers can return
  * 200 unconditionally (no user enumeration).
  */
+// Per address: enough to retry a lost email, not enough to flood an inbox.
+const RESET_REQUEST_LIMIT: RateLimit = { capacity: 3, refill: 1 / 600 };
+
 export async function requestPasswordReset(email: string): Promise<void> {
+  if (!takeToken(`reset:${email.toLowerCase()}`, RESET_REQUEST_LIMIT)) return;
+
   const user = getUserByEmail(email);
   if (!user) return;
 
@@ -93,7 +99,12 @@ export async function resetPassword(
     );
   }
 
-  if (row.used_at !== null) {
+  // Consume the link before the (async) password hash: checking used_at and
+  // marking it later would let parallel submissions all pass the check.
+  const claimed = db.prepare(
+    `UPDATE password_reset_tokens SET used_at = ? WHERE token = ? AND used_at IS NULL;`,
+  ).run(new Date().toISOString(), token);
+  if (claimed.changes === 0) {
     throw new APIException(
       APIErrorCode.VALIDATION_ERROR,
       409,
@@ -101,9 +112,11 @@ export async function resetPassword(
     );
   }
 
-  await updateUser(payload.userId, { password: newPassword });
-
-  db.prepare(
-    `UPDATE password_reset_tokens SET used_at = ? WHERE token = ?;`,
-  ).run(new Date().toISOString(), token);
+  try {
+    await updateUser(payload.userId, { password: newPassword });
+  } catch (err) {
+    db.prepare(`UPDATE password_reset_tokens SET used_at = NULL WHERE token = ?;`)
+      .run(token);
+    throw err;
+  }
 }
diff --git a/api/services/playlist-service.ts b/api/services/playlist-service.ts
index daf9cd1c..18bb905f 100644
--- a/api/services/playlist-service.ts
+++ b/api/services/playlist-service.ts
@@ -206,7 +206,7 @@ export function updatePlaylist(
     );
     linkAttachments(newDescription, playlist.id);
   }
-  broadcastPlaylistUpdated(updated);
+  broadcastPlaylistUpdated(updated, playlist.isPublic);
   return updated;
 }
 
@@ -240,7 +240,7 @@ export function setPlaylistImage(
     playlist.id,
   );
   const updated = getPlaylistById(playlist.id);
-  broadcastPlaylistUpdated(updated);
+  broadcastPlaylistUpdated(updated, playlist.isPublic);
   return updated;
 }
 
@@ -256,6 +256,17 @@ export function addDumpToPlaylist(
     throw new APIException(APIErrorCode.UNAUTHORIZED, 403, "Forbidden");
   }
 
+  // Only a dump the requester can see — someone else's private dump would
+  // otherwise land in the playlist and its title in followers' notifications.
+  const dump = db.prepare(
+    `SELECT title, is_private, user_id FROM dumps WHERE id = ?;`,
+  ).get(dumpId) as
+    | { title: string; is_private: number; user_id: string }
+    | undefined;
+  if (!dump || (dump.is_private && dump.user_id !== requestingUserId)) {
+    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+  }
+
   const minRow = db.prepare(
     `SELECT MIN(position) as min_pos FROM playlist_dumps WHERE playlist_id = ?;`,
   ).get(playlist.id) as { min_pos: number | null } | undefined;
@@ -283,18 +294,14 @@ export function addDumpToPlaylist(
   const dumpIds = getCurrentDumpIds(playlist.id);
   broadcastPlaylistDumpsUpdated(playlist, dumpIds);
 
-  if (playlist.isPublic) {
-    const dumpRow = db.prepare(`SELECT title FROM dumps WHERE id = ?;`).get(
+  // Followers can't open a private dump, even the owner's own.
+  if (playlist.isPublic && !dump.is_private) {
+    notifyPlaylistFollowersNewDump(
+      playlist.id,
+      playlist.title,
       dumpId,
-    ) as { title: string } | undefined;
-    if (dumpRow) {
-      notifyPlaylistFollowersNewDump(
-        playlist.id,
-        playlist.title,
-        dumpId,
-        dumpRow.title,
-      );
-    }
+      dump.title,
+    );
   }
 }
 
diff --git a/api/services/providers/self.ts b/api/services/providers/self.ts
index c5e0b142..fbb11b93 100644
--- a/api/services/providers/self.ts
+++ b/api/services/providers/self.ts
@@ -4,6 +4,7 @@ import { getDump } from "../dump-service.ts";
 import { getUserByUsername } from "../user-service.ts";
 import { getPlaylistById } from "../playlist-service.ts";
 import { PUBLIC_URL, THEME_COLOR } from "../../config.ts";
+import { isSelfUrl } from "../../lib/self-url.ts";
 
 const DUMP_RE = /^\/dumps\/([^/]+)$/;
 const USER_RE = /^\/users\/([^/]+)$/;
@@ -22,10 +23,7 @@ export const selfProvider: RichContentProvider = {
 
   matches(url: string): boolean {
     try {
-      const { pathname } = new URL(url);
-      return DUMP_RE.test(pathname) ||
-        USER_RE.test(pathname) ||
-        PLAYLIST_RE.test(pathname);
+      return isSelfUrl(new URL(url));
     } catch {
       return false;
     }
diff --git a/api/services/rich-content-service.ts b/api/services/rich-content-service.ts
index 287432ea..847280ce 100644
--- a/api/services/rich-content-service.ts
+++ b/api/services/rich-content-service.ts
@@ -4,6 +4,11 @@ import { bandcampProvider } from "./providers/bandcamp.ts";
 import { soundcloudProvider } from "./providers/soundcloud.ts";
 import { selfProvider } from "./providers/self.ts";
 import { genericProvider } from "./providers/generic.ts";
+import {
+  isPrivateHostname,
+  resolvePublicAddress,
+} from "../lib/public-address.ts";
+import { isSelfUrl } from "../lib/self-url.ts";
 
 export interface RichContentProvider {
   name: string;
@@ -34,23 +39,35 @@ const FETCH_HEADERS = {
   "Accept-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7",
 };
 
+const MAX_REDIRECTS = 5;
+
 /**
  * Fetch `url` via a `curl --insecure` subprocess and return a minimal Response.
  * Used as a last resort when Deno's rustls rejects the server's TLS certificate
  * due to an unsupported algorithm (e.g. UnsupportedSignatureAlgorithm).
  * Returns null if curl is unavailable or exits non-zero.
+ *
+ * `address` pins the connection to the IP already checked by
+ * resolvePublicAddress, and curl doesn't follow redirects itself: a 3xx comes
+ * back with its Location so fetchWithTimeout can check the next hop too.
  */
 async function fetchViaCurl(
-  url: string,
+  url: URL,
+  address: string,
   timeoutMs: number,
 ): Promise<Response | null> {
   const tmpPath = await Deno.makeTempFile();
+  const port = url.port || (url.protocol === "https:" ? "443" : "80");
+  const pinned = address.includes(":") ? `[${address}]` : address;
   try {
     const { code, stdout } = await new Deno.Command("curl", {
       args: [
         "--silent",
         "--insecure",
-        "--location",
+        "--proto",
+        "=http,https",
+        "--resolve",
+        `${url.hostname.replace(/^\[(.*)\]$/, "$1")}:${port}:${pinned}`,
         "--max-time",
         String(Math.ceil(timeoutMs / 1000)),
         "--user-agent",
@@ -62,8 +79,8 @@ async function fetchViaCurl(
         "--output",
         tmpPath,
         "--write-out",
-        "%{content_type}",
-        url,
+        "%{http_code}\n%{redirect_url}\n%{content_type}",
+        url.href,
       ],
       stdout: "piped",
       stderr: "null",
@@ -71,8 +88,18 @@ async function fetchViaCurl(
 
     if (code !== 0) return null;
 
-    const contentType = new TextDecoder().decode(stdout).trim();
+    const [status, location, contentType = ""] = new TextDecoder()
+      .decode(stdout).split("\n").map((l) => l.trim());
+    const statusCode = Number(status);
+    if (!(statusCode >= 200 && statusCode <= 599)) return null;
+    const headers = new Headers();
+    if (location) headers.set("location", location);
+    if (contentType) headers.set("content-type", contentType);
+
     const bytes = await Deno.readFile(tmpPath);
+    if (!contentType.startsWith("text/")) {
+      return new Response(bytes, { status: statusCode, headers });
+    }
     // Decode using the charset declared in the Content-Type header so that
     // pages served in ISO-8859-1, windows-1252, etc. are read correctly.
     const charset = /charset=([\w-]+)/i.exec(contentType)?.[1] ?? "utf-8";
@@ -82,7 +109,8 @@ async function fetchViaCurl(
     } catch {
       bodyText = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
     }
-    return new Response(bodyText, { headers: { "content-type": "text/html" } });
+    headers.set("content-type", contentType.replace(/;.*$/, "; charset=utf-8"));
+    return new Response(bodyText, { status: statusCode, headers });
   } catch {
     return null;
   } finally {
@@ -90,25 +118,20 @@ async function fetchViaCurl(
   }
 }
 
-export async function fetchWithTimeout(
-  url: string,
-  timeoutMs = 5000,
+/** One request, no redirects followed. */
+async function fetchOnce(
+  url: URL,
+  address: string,
+  timeoutMs: number,
 ): Promise<Response> {
-  async function attempt(): Promise<Response> {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-      return await fetch(url, {
-        signal: controller.signal,
-        headers: FETCH_HEADERS,
-      });
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    return await attempt();
+    return await fetch(url, {
+      signal: controller.signal,
+      headers: FETCH_HEADERS,
+      redirect: "manual",
+    });
   } catch (err) {
     if (!(err instanceof TypeError && err.message.includes("certificate"))) {
       throw err;
@@ -118,10 +141,37 @@ export async function fetchWithTimeout(
     // or an unsupported signature algorithm) and offers no way to override
     // verification programmatically. Fall back to a `curl --insecure`
     // subprocess, which uses its own TLS stack.
-    const curlRes = await fetchViaCurl(url, timeoutMs);
+    const curlRes = await fetchViaCurl(url, address, timeoutMs);
     if (curlRes) return curlRes;
 
     throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Fetch a user-supplied URL. Every hop — the URL itself and each redirect —
+ * must resolve to a public address (see resolvePublicAddress), so a link or a
+ * redirect can't point the server at its own network.
+ */
+export async function fetchWithTimeout(
+  url: string,
+  timeoutMs = 5000,
+): Promise<Response> {
+  let current = new URL(url);
+  for (let hop = 0;; hop++) {
+    if (current.protocol !== "http:" && current.protocol !== "https:") {
+      throw new TypeError(`Unsupported protocol ${current.protocol}`);
+    }
+    const address = await resolvePublicAddress(current);
+    const res = await fetchOnce(current, address, timeoutMs);
+    const location = res.headers.get("location");
+    if (res.status < 300 || res.status >= 400 || !location) return res;
+
+    await res.body?.cancel();
+    if (hop >= MAX_REDIRECTS) throw new TypeError("Too many redirects");
+    current = new URL(location, current);
   }
 }
 
@@ -529,24 +579,14 @@ export function extractLinkHref(
   return undefined;
 }
 
-function isPrivateHost(hostname: string): boolean {
-  // Block loopback and RFC-1918 ranges. Note: DNS rebinding is not fully mitigated.
-  if (hostname === "localhost" || hostname === "::1") return true;
-  return /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(hostname);
-}
-
-const SELF_PATH_RE = /^\/(dumps|users|playlists)\/[^/]+$/;
-
 export function isValidHttpUrl(raw: string): boolean {
   try {
     const u = new URL(raw);
     if (u.protocol !== "http:" && u.protocol !== "https:") return false;
-    // Allow private hosts for self-referential gerbeur URLs — they are
-    // resolved directly from the DB by selfProvider, no outbound HTTP needed.
-    if (isPrivateHost(u.hostname) && !SELF_PATH_RE.test(u.pathname)) {
-      return false;
-    }
-    return true;
+    // This site's own pages are fine even on a private host (e.g. localhost in
+    // development): selfProvider reads them from the DB, no HTTP involved.
+    // Every actual fetch is checked again, after DNS, in fetchWithTimeout.
+    return !isPrivateHostname(u) || isSelfUrl(u);
   } catch {
     return false;
   }
diff --git a/api/services/user-service.ts b/api/services/user-service.ts
index 40addc4c..00a157b9 100644
--- a/api/services/user-service.ts
+++ b/api/services/user-service.ts
@@ -6,7 +6,7 @@ import {
   type User,
 } from "../model/interfaces.ts";
 import { db, isUserRow, userApiToRow, userRowToApi } from "../model/db.ts";
-import { disconnectUser } from "./ws-service.ts";
+import { closeUserSockets, disconnectUser } from "./ws-service.ts";
 
 import { hashPassword } from "../lib/jwt.ts";
 import { linkAttachments } from "./attachment-service.ts";
@@ -36,20 +36,35 @@ export async function createUser(
     );
   }
 
+  assertEmailAvailable(request.email);
+
   const passwordHash = await hashPassword(request.password);
 
-  db.prepare(
-    `INSERT INTO users (id, username, password_hash, role, created_at, invited_by, email)
-      VALUES (?, ?, ?, ?, ?, ?, ?);`,
-  ).run(
-    userId,
-    request.username,
-    passwordHash,
-    "user",
-    createdAt.toISOString(),
-    inviterId,
-    request.email,
-  );
+  try {
+    db.prepare(
+      `INSERT INTO users (id, username, password_hash, role, created_at, invited_by, email)
+        VALUES (?, ?, ?, ?, ?, ?, ?);`,
+    ).run(
+      userId,
+      request.username,
+      passwordHash,
+      "user",
+      createdAt.toISOString(),
+      inviterId,
+      request.email,
+    );
+  } catch (err) {
+    // The check above ran before the hash yielded, so a parallel registration
+    // can still take the name first; the UNIQUE constraint is the real guard.
+    if (err instanceof Error && err.message.includes("UNIQUE")) {
+      throw new APIException(
+        APIErrorCode.VALIDATION_ERROR,
+        400,
+        "Username already exists",
+      );
+    }
+    throw err;
+  }
 
   return {
     id: userId,
@@ -85,6 +100,23 @@ export function getUserByUsername(username: string): User {
   return userRowToApi(userRow);
 }
 
+/**
+ * Password resets are looked up by email, so an address can belong to one
+ * account only — otherwise which account a reset link resets is up to row order.
+ */
+function assertEmailAvailable(email: string, exceptUserId?: string): void {
+  const row = db.prepare(
+    `SELECT id FROM users WHERE lower(email) = lower(?) AND id != ?;`,
+  ).get(email, exceptUserId ?? "");
+  if (row) {
+    throw new APIException(
+      APIErrorCode.VALIDATION_ERROR,
+      409,
+      "Email already in use",
+    );
+  }
+}
+
 export function getUserByEmail(email: string): User | null {
   const userRow = db.prepare(
     `${USER_SELECT} WHERE u.email = ?`,
@@ -141,6 +173,9 @@ export async function updateUser(
   const user = getUserById(userId);
 
   const { password, description, email, ...requestFields } = request;
+  if (email !== undefined && email !== user.email) {
+    assertEmailAvailable(email, userId);
+  }
 
   const now = new Date();
   const updatedUser: User = {
@@ -170,6 +205,15 @@ export async function updateUser(
     throw new APIException(APIErrorCode.NOT_FOUND, 404, "User not found");
   }
 
+  // A new password ends every session opened with the old one.
+  if (password) {
+    db.prepare(`UPDATE users SET tokens_valid_after = ? WHERE id = ?;`).run(
+      now.toISOString(),
+      userId,
+    );
+    closeUserSockets(userId, "Password changed");
+  }
+
   if (updatedUser.description) {
     linkAttachments(updatedUser.description, userId);
   }
diff --git a/api/services/vote-service.ts b/api/services/vote-service.ts
index dcaa7568..9fe10cb3 100644
--- a/api/services/vote-service.ts
+++ b/api/services/vote-service.ts
@@ -2,7 +2,26 @@ import { APIErrorCode, APIException, type User } from "../model/interfaces.ts";
 import { db, isUserRow, userRowToApi } from "../model/db.ts";
 import { notifyDumpOwnerUpvote } from "./notification-service.ts";
 
-export function castVote(dumpId: string, userId: string): number {
+export interface VoteResult {
+  voteCount: number;
+  /** Private dumps' vote counts go to their owner only. */
+  isPrivate: boolean;
+}
+
+// Visibility of the dump, or a 404 when the user can't see it — voting must not
+// confirm that a private dump exists.
+function visibleDump(dumpId: string, userId: string): { isPrivate: boolean } {
+  const row = db.prepare(
+    `SELECT is_private, user_id FROM dumps WHERE id = ?;`,
+  ).get(dumpId) as { is_private: number; user_id: string } | undefined;
+  if (!row || (row.is_private && row.user_id !== userId)) {
+    throw new APIException(APIErrorCode.NOT_FOUND, 404, "Dump not found");
+  }
+  return { isPrivate: Boolean(row.is_private) };
+}
+
+export function castVote(dumpId: string, userId: string): VoteResult {
+  const { isPrivate } = visibleDump(dumpId, userId);
   let voteCount: number;
   try {
     db.exec("BEGIN;");
@@ -34,10 +53,16 @@ export function castVote(dumpId: string, userId: string): number {
   try {
     notifyDumpOwnerUpvote(userId, dumpId);
   } catch { /* ignore */ }
-  return voteCount;
+  return { voteCount, isPrivate };
 }
 
-export function removeVote(dumpId: string, userId: string): number {
+// No visibility check: taking back a vote on a dump that has since gone
+// private is harmless, and it's the voter's own row.
+export function removeVote(dumpId: string, userId: string): VoteResult {
+  const row = db.prepare(`SELECT is_private FROM dumps WHERE id = ?;`).get(
+    dumpId,
+  ) as { is_private: number } | undefined;
+  const isPrivate = Boolean(row?.is_private);
   try {
     db.exec("BEGIN;");
     const result = db.prepare(
@@ -50,11 +75,11 @@ export function removeVote(dumpId: string, userId: string): number {
     db.prepare(
       `UPDATE dumps SET vote_count = vote_count - 1 WHERE id = ?;`,
     ).run(dumpId);
-    const row = db.prepare(
+    const count = db.prepare(
       `SELECT vote_count FROM dumps WHERE id = ?;`,
     ).get(dumpId) as { vote_count: number } | undefined;
     db.exec("COMMIT;");
-    return row?.vote_count ?? 0;
+    return { voteCount: count?.vote_count ?? 0, isPrivate };
   } catch (err) {
     if (err instanceof APIException) throw err;
     db.exec("ROLLBACK;");
diff --git a/api/services/ws-service.ts b/api/services/ws-service.ts
index 53d4ab29..c45a11e0 100644
--- a/api/services/ws-service.ts
+++ b/api/services/ws-service.ts
@@ -83,6 +83,18 @@ export function disconnectUser(userId: string): void {
   }
 }
 
+/**
+ * Drops the user's sockets without logging anyone out: each reconnects with
+ * whatever token it holds, and /ws turns a revoked one into a force_logout.
+ * Used on a password change, where the tab that made the change has already
+ * swapped in a fresh token and must stay signed in.
+ */
+export function closeUserSockets(userId: string, reason: string): void {
+  for (const client of clients) {
+    if (client.userId === userId) client.socket.close(1000, reason);
+  }
+}
+
 export function broadcastPresence(): void {
   const users = getOnlineUsers();
   for (const client of clients) {
@@ -108,13 +120,16 @@ export function broadcastDumpDeleted(dumpId: string): void {
   }
 }
 
+// `onlyUserId`: a private dump's count goes to that user's sockets alone.
 export function broadcastVoteUpdate(
   dumpId: string,
   voteCount: number,
   voterId: string,
   action: "cast" | "remove",
+  onlyUserId?: string,
 ): void {
   for (const client of clients) {
+    if (onlyUserId && client.userId !== onlyUserId) continue;
     send(client.socket, {
       type: "votes_update",
       dumpId,
@@ -125,13 +140,16 @@ export function broadcastVoteUpdate(
   }
 }
 
+// `onlyUserId`: a like on a private dump's comment goes to that user alone.
 export function broadcastCommentLikeUpdate(
   commentId: string,
   likeCount: number,
   likerId: string,
   action: "cast" | "remove",
+  onlyUserId?: string,
 ): void {
   for (const client of clients) {
+    if (onlyUserId && client.userId !== onlyUserId) continue;
     send(client.socket, {
       type: "comment_likes_update",
       commentId,
@@ -157,12 +175,17 @@ export function broadcastPlaylistCreated(playlist: Playlist): void {
   sendToPlaylistAudience(playlist, { type: "playlist_created", playlist });
 }
 
-export function broadcastPlaylistUpdated(playlist: Playlist): void {
-  // Broadcast to ALL clients so non-owners can react to visibility changes
-  // (e.g. remove a now-private playlist from their feed).
-  for (const client of clients) {
-    send(client.socket, { type: "playlist_updated", playlist });
-  }
+// `wasPublic`: the visibility before this change. A playlist that just went
+// private still goes to everyone, so non-owners can drop it from their views;
+// one that was and stays private goes to its owner alone.
+export function broadcastPlaylistUpdated(
+  playlist: Playlist,
+  wasPublic: boolean,
+): void {
+  sendToPlaylistAudience(
+    { isPublic: playlist.isPublic || wasPublic, userId: playlist.userId },
+    { type: "playlist_updated", playlist },
+  );
 }
 
 export function broadcastPlaylistDeleted(
@@ -305,44 +328,7 @@ export function isUserChatOpen(userId: string): boolean {
   return false;
 }
 
-// Token buckets keyed by `${kind}:${userId}` — per user rather than per socket,
-// so opening more tabs doesn't buy more throughput.
-interface Bucket {
-  tokens: number;
-  at: number;
-}
-const buckets = new Map<string, Bucket>();
-
-export interface RateLimit {
-  /** Burst size. */
-  capacity: number;
-  /** Tokens regained per second. */
-  refill: number;
-}
-
-/** Takes one token for `key`; false when the bucket is empty. */
-export function takeToken(key: string, limit: RateLimit): boolean {
-  const now = Date.now();
-  const bucket = buckets.get(key) ?? { tokens: limit.capacity, at: now };
-  bucket.tokens = Math.min(
-    limit.capacity,
-    bucket.tokens + ((now - bucket.at) / 1000) * limit.refill,
-  );
-  bucket.at = now;
-  buckets.set(key, bucket);
-  if (bucket.tokens < 1) return false;
-  bucket.tokens -= 1;
-  return true;
-}
-
-// Full buckets carry no information; drop them so the map tracks only users
-// who've been active lately.
-setInterval(() => {
-  const cutoff = Date.now() - 5 * 60_000;
-  for (const [key, bucket] of buckets) {
-    if (bucket.at < cutoff) buckets.delete(key);
-  }
-}, 60_000);
+export { type RateLimit, takeToken } from "../lib/rate-limit.ts";
 
 export function handleClientPong(client: WsClient): void {
   client.pongReceived = true;
diff --git a/src/components/ChangePasswordModal.tsx b/src/components/ChangePasswordModal.tsx
index d22bc749..7e734bf6 100644
--- a/src/components/ChangePasswordModal.tsx
+++ b/src/components/ChangePasswordModal.tsx
@@ -3,6 +3,7 @@ import { t } from "@lingui/core/macro";
 import { Trans } from "@lingui/react/macro";
 import { API_URL, VALIDATION } from "../config/api.ts";
 import { useAuth } from "../hooks/useAuth.ts";
+import { deserializeAuthResponse } from "../model.ts";
 import { Modal } from "./Modal.tsx";
 import {
   expectOk,
@@ -25,7 +26,7 @@ interface Values {
 }
 
 export function ChangePasswordModal({ onClose }: ChangePasswordModalProps) {
-  const { authFetch } = useAuth();
+  const { authFetch, login } = useAuth();
   const [done, setDone] = useState(false);
   const form = useApiForm<Values>({
     mode: "onChange",
@@ -33,13 +34,19 @@ export function ChangePasswordModal({ onClose }: ChangePasswordModalProps) {
   });
 
   const onSubmit = form.submit(async ({ currentPassword, newPassword }) => {
-    await expectOk(
+    // The change signs out every session opened with the old password, this
+    // one included, so keep the fresh tokens it hands back.
+    const tokens = await expectOk<{ token: string; mediaToken: string }>(
       await authFetch(`${API_URL}/api/users/me/change-password`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ currentPassword, newPassword }),
       }),
     );
+    const storedRaw = localStorage.getItem("authResponse");
+    if (storedRaw) {
+      login({ ...deserializeAuthResponse(JSON.parse(storedRaw)), ...tokens });
+    }
     setDone(true);
   });
 
diff --git a/src/components/DumpCard.tsx b/src/components/DumpCard.tsx
index 71c555ba..1df299aa 100644
--- a/src/components/DumpCard.tsx
+++ b/src/components/DumpCard.tsx
@@ -30,7 +30,7 @@ export function DumpCard(
     DumpCardProps,
 ) {
   const { cardProps, handledAsNewTab } = useDumpCardLink(dump);
-  const { token } = useAuth();
+  const { mediaToken } = useAuth();
   const { byId } = useCategories();
   const dumpCategories = (dump.categoryIds ?? [])
     .map((id) => byId.get(id))
@@ -59,7 +59,7 @@ export function DumpCard(
                   compact
                   dumpHref={dumpUrl(dump)}
                   thumbnailOverrideUrl={dump.thumbnailMime
-                    ? dumpThumbnailUrl(dump, token)
+                    ? dumpThumbnailUrl(dump, mediaToken)
                     : undefined}
                 />
               )
diff --git a/src/components/DumpCreateModal.tsx b/src/components/DumpCreateModal.tsx
index 87c25ab5..1e39ee31 100644
--- a/src/components/DumpCreateModal.tsx
+++ b/src/components/DumpCreateModal.tsx
@@ -389,7 +389,7 @@ export function DumpCreateModal(
     debounceRef.current = setTimeout(() => {
       const encoded = encodeURIComponent(canonicalUrl);
 
-      fetch(`${API_URL}/api/preview?url=${encoded}`)
+      authFetch(`${API_URL}/api/preview?url=${encoded}`)
         .then((res) => res.json())
         .then((body) => {
           const data = body.success
diff --git a/src/components/FilePreview.tsx b/src/components/FilePreview.tsx
index 132ffbd8..da02671c 100644
--- a/src/components/FilePreview.tsx
+++ b/src/components/FilePreview.tsx
@@ -52,7 +52,7 @@ function filePlayerItem(
 function AudioFilePreview(
   { fileUrl, mime, dump }: { fileUrl: string; mime: string; dump: Dump },
 ) {
-  const { token } = useAuth();
+  const { mediaToken: token } = useAuth();
   const { current, playing, currentTime, duration, play, togglePlay, seekTo } =
     useContext(PlayerContext);
   const [peaks, setPeaks] = useState<Float32Array | null>(null);
@@ -174,7 +174,7 @@ export default function FilePreview(
   { dump, compact = false, global: useGlobal = false }: FilePreviewProps,
 ) {
   const { current, playing, play, togglePlay } = useContext(PlayerContext);
-  const { token } = useAuth();
+  const { mediaToken: token } = useAuth();
   const fileUrl = dumpFileUrl(dump, token);
   const mime = dump.fileMime ?? "";
   const isPlaying = current?.kind === "file" && current.fileUrl === fileUrl;
diff --git a/src/components/JournalCard.tsx b/src/components/JournalCard.tsx
index 01c635f2..f4b264dd 100644
--- a/src/components/JournalCard.tsx
+++ b/src/components/JournalCard.tsx
@@ -34,7 +34,7 @@ export function JournalCard(
     JournalCardProps,
 ) {
   const { go, cardProps, handledAsNewTab } = useDumpCardLink(dump);
-  const { token } = useAuth();
+  const { mediaToken } = useAuth();
   const { playRichContent } = usePlayRichContent();
   const unread = !isOwner && isRecent(dump.createdAt) &&
     !isDumpVisited(dump.id);
@@ -49,12 +49,12 @@ export function JournalCard(
   // Mirrors FilePreview (the hot/new feeds) so a video shows its generated
   // still here too, rather than degrading to a text card with a 🎬.
   const thumbnailUrl = dump.thumbnailMime
-    ? dumpThumbnailUrl(dump, token)
+    ? dumpThumbnailUrl(dump, mediaToken)
     : dump.kind === "file"
     ? (dump.fileMime?.startsWith("image/")
-      ? dumpFileUrl(dump, token)
+      ? dumpFileUrl(dump, mediaToken)
       : dump.fileMime?.startsWith("video/")
-      ? dumpThumbnailUrl(dump, token)
+      ? dumpThumbnailUrl(dump, mediaToken)
       : null)
     : (dump.richContent?.thumbnailUrl ?? null);
 
diff --git a/src/contexts/AuthProvider.tsx b/src/contexts/AuthProvider.tsx
index 0e6aa0f3..b8b7fd0f 100644
--- a/src/contexts/AuthProvider.tsx
+++ b/src/contexts/AuthProvider.tsx
@@ -99,6 +99,33 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     };
   }, [token]);
 
+  // Sessions from before media tokens existed have none, and would keep putting
+  // the full session token in file and thumbnail URLs; fetch one once.
+  const needsMediaToken = !!token && !authResponse?.mediaToken;
+  useEffect(() => {
+    if (!token || !needsMediaToken) return;
+    let cancelled = false;
+    fetch(`${API_URL}/api/users/me/media-token`, {
+      headers: { Authorization: `Bearer ${token}` },
+      cache: "no-store",
+    })
+      .then((res) => res.ok ? res.json() : null)
+      .then((json) => {
+        const mediaToken = json?.data?.mediaToken;
+        if (cancelled || typeof mediaToken !== "string") return;
+        setAuthResponse((prev) => {
+          if (!prev || prev.token !== token) return prev;
+          const updated = { ...prev, mediaToken };
+          localStorage.setItem("authResponse", JSON.stringify(updated));
+          return updated;
+        });
+      })
+      .catch(() => {/* keep using the session token until next load */});
+    return () => {
+      cancelled = true;
+    };
+  }, [token, needsMediaToken]);
+
   const value: AuthContextValue = { authResponse, setAuthResponse };
 
   return (
diff --git a/src/hooks/useAuth.ts b/src/hooks/useAuth.ts
index 5e4d7fa7..50a6a604 100644
--- a/src/hooks/useAuth.ts
+++ b/src/hooks/useAuth.ts
@@ -116,6 +116,10 @@ export const useAuth = () => {
   return {
     user: authResponse?.user ?? null,
     token: authResponse?.token ?? null,
+    // For file and thumbnail URLs, where the token is visible in the query
+    // string. Sessions from before media tokens fall back to the session token
+    // until AuthProvider fetches one.
+    mediaToken: authResponse?.mediaToken ?? authResponse?.token ?? null,
     login,
     logout,
     authFetch,
@@ -124,12 +128,13 @@ export const useAuth = () => {
 };
 
 export const useRequiredAuth = () => {
-  const { user, token, login, logout, authFetch, authUpload } = useAuth();
+  const { user, token, mediaToken, login, logout, authFetch, authUpload } =
+    useAuth();
 
   if (!user) {
     throw new Error(
       "Invariant: useRequiredAuth called outside a protected route",
     );
   }
-  return { user, token, login, logout, authFetch, authUpload };
+  return { user, token, mediaToken, login, logout, authFetch, authUpload };
 };
diff --git a/src/model.ts b/src/model.ts
index 198d6435..cdfa3d00 100644
--- a/src/model.ts
+++ b/src/model.ts
@@ -208,6 +208,8 @@ export function deserializeInviteTreeEntry(
 
 export interface AuthResponse {
   token: string;
+  /** Read-only token for media URLs (`?token=`); absent on older sessions. */
+  mediaToken?: string;
   user: User;
 }
 
diff --git a/src/pages/Dump.tsx b/src/pages/Dump.tsx
index f4bc8f5f..3b830166 100644
--- a/src/pages/Dump.tsx
+++ b/src/pages/Dump.tsx
@@ -80,7 +80,7 @@ export function Dump() {
   const [titleSaving, setTitleSaving] = useState(false);
   const [titleError, setTitleError] = useState<string | null>(null);
 
-  const { user, token, authFetch } = useAuth();
+  const { user, token, mediaToken, authFetch } = useAuth();
   const { byId } = useCategories();
   const {
     voteCounts,
@@ -497,7 +497,7 @@ export function Dump() {
                 richContent={dump.richContent}
                 dumpHref={dumpUrl(dump)}
                 thumbnailOverrideUrl={dump.thumbnailMime
-                  ? dumpThumbnailUrl(dump, token)
+                  ? dumpThumbnailUrl(dump, mediaToken)
                   : undefined}
               />
             )
diff --git a/src/pages/DumpEdit.tsx b/src/pages/DumpEdit.tsx
index 5bd887dd..780d1ca8 100644
--- a/src/pages/DumpEdit.tsx
+++ b/src/pages/DumpEdit.tsx
@@ -39,7 +39,7 @@ type DumpEditState =
 export function DumpEdit() {
   const { selectedDump } = useParams();
   const navigate = useNavigate();
-  const { authFetch, token } = useRequiredAuth();
+  const { authFetch, token, mediaToken } = useRequiredAuth();
 
   const [state, setState] = useState<DumpEditState>({ status: "loading" });
 
@@ -195,12 +195,12 @@ export function DumpEdit() {
   const { dump } = state;
 
   const currentThumbnailSrc = dump.thumbnailMime
-    ? dumpThumbnailUrl(dump, token)
+    ? dumpThumbnailUrl(dump, mediaToken)
     : dump.kind === "file"
     ? (dump.fileMime?.startsWith("image/")
-      ? dumpFileUrl(dump, token)
+      ? dumpFileUrl(dump, mediaToken)
       : dump.fileMime?.startsWith("video/")
-      ? dumpThumbnailUrl(dump, token)
+      ? dumpThumbnailUrl(dump, mediaToken)
       : null)
     : dump.richContent?.thumbnailUrl ?? null;