The credential file inside the public web root was returning HTTP 200 to anonymous visitors, exposing the live database password. It was pulled from the web root, rotated, and the server hardened so development-only paths can never be served publicly again — closing the flag first raised earlier in the month.
Each service card now leads to its own detail page instead of opening a modal, with the page content fully editable from the admin panel and support for managed service subsections.
Added the SEO infrastructure required for correct crawling, and replaced the deploy script with one that always takes a backup and writes a manifest before any file is written — so a deploy can always be reversed.