# YouTube-parity audit remediation plan Branch per phase. Feature tests per fix. STOP for approval between phases. **Safety tag:** `backup/pre-audit-2026-10-21` at commit `5058eaf` on `full-screen-data`. **Stashed WIP:** `stash@{0}` — pre-audit WIP on `full-screen-data` (recover with `git stash pop` on that branch). --- ## Phase 1 — Security & data integrity Branch: `fix/phase-1-security` - [ ] Wrap `sendEmailVerificationNotification` + `NewCommentNotification` mail in try/catch; move to a queued notification channel; log failures. Document `.env` for Gmail app password + Mailgun/Postmark fallback. - [ ] `php artisan app:resend-verification {--user=}` command. - [ ] Reserved-name blocklist (`admin`, `superadmin`, `takeone`, `support`, `root`, …) via `App\Rules\ReservedIdentifier` wired into `RegisteredUserController`. - [ ] Harden login throttling to `5,1` with lockout message; log repeated failures and alert super admins. - [ ] Confirm `email_verified_at` is not mass-assignable; only the signed-URL verification route flips it. - [ ] Comment dedupe: raise 5s → 60s window, add client idempotency key header, server reject on duplicate. Disable submit button on first click. - [ ] `php artisan comments:dedupe --dry-run` cleanup command. - [ ] Owner-view exclusion in `VideoController@trackProgress`; dedupe by `device_hash` within 30 min. - [ ] Feature tests for each item. ## Phase 2 — Performance & DOM Branch: `fix/phase-2-perf` - [ ] One shared `#globalEditModal` + `#globalCardMenu` per page; populated via `GET /videos/{id}/edit-payload`. Owner-only items gated server-side. - [ ] Lazy-render reply/edit boxes (template clone on open). - [ ] Match highlights panel rendered once. - [ ] `href="javascript:void(0)"` → real `