diff --git a/public/assets/locale/ar.json b/public/assets/locale/ar.json
index 3506a2551..76712cc89 100644
--- a/public/assets/locale/ar.json
+++ b/public/assets/locale/ar.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "مشفر",
         "SETTINGS_MERGED": "تم الدمج",
         "SETTINGS_MASKED": "تم إخفاؤه",
+        "SETTINGS_MASKED_ERROR": "استبدل جميع القيم المخفية قبل حفظ الإعدادات المشفرة",
         "SETTINGS_INHERITED": "إعداد موروث من [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "إعداد محلي من {{ type }}",
         "SETTINGS_SAVE_ERROR": "فشل حفظ الإعدادات. الخطأ {{ error }}",
diff --git a/public/assets/locale/en-AU.json b/public/assets/locale/en-AU.json
index c42e61879..479f8f444 100644
--- a/public/assets/locale/en-AU.json
+++ b/public/assets/locale/en-AU.json
@@ -136,6 +136,7 @@
         "SETTINGS_ENCRYPTED": "Encrypted",
         "SETTINGS_MERGED": "Merged",
         "SETTINGS_MASKED": "MASKED",
+        "SETTINGS_MASKED_ERROR": "Replace all masked values before you save encrypted settings",
         "SETTINGS_INHERITED": "Setting inherited from [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Local setting from {{ type }}",
         "SETTINGS_SAVE_ERROR": "Failed to save settings. Error {{ error }}",
diff --git a/public/assets/locale/en-GB.json b/public/assets/locale/en-GB.json
index 8f6d9c4f1..7d4b66638 100644
--- a/public/assets/locale/en-GB.json
+++ b/public/assets/locale/en-GB.json
@@ -121,6 +121,7 @@
         "SETTINGS_ENCRYPTED": "Encrypted",
         "SETTINGS_MERGED": "Merged",
         "SETTINGS_MASKED": "MASKED",
+        "SETTINGS_MASKED_ERROR": "Replace all masked values before you save encrypted settings",
         "SETTINGS_INHERITED": "Setting inherited from [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Local setting from {{ type }}",
         "SETTINGS_SAVE_ERROR": "Failed to save settings. Error {{ error }}",
diff --git a/public/assets/locale/en-US.json b/public/assets/locale/en-US.json
index 0269f9b0b..838c470e1 100644
--- a/public/assets/locale/en-US.json
+++ b/public/assets/locale/en-US.json
@@ -118,6 +118,7 @@
         "SETTINGS_ENCRYPTED": "Encrypted",
         "SETTINGS_MERGED": "Merged",
         "SETTINGS_MASKED": "MASKED",
+        "SETTINGS_MASKED_ERROR": "Replace all masked values before you save encrypted settings",
         "SETTINGS_INHERITED": "Setting inherited from [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Local setting from {{ type }}",
         "SETTINGS_SAVE_ERROR": "Failed to save settings. Error {{ error }}",
diff --git a/public/assets/locale/es.json b/public/assets/locale/es.json
index b49a6a9c5..58d2cfbd6 100644
--- a/public/assets/locale/es.json
+++ b/public/assets/locale/es.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "Encriptado",
         "SETTINGS_MERGED": "Combinado",
         "SETTINGS_MASKED": "OCULTO",
+        "SETTINGS_MASKED_ERROR": "Reemplace todos los valores ocultos antes de guardar la configuración cifrada",
         "SETTINGS_INHERITED": "Configuración heredada de [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Configuración local de {{ type }}",
         "SETTINGS_SAVE_ERROR": "No se pudo guardar las configuraciones. Error {{ error }}",
diff --git a/public/assets/locale/fr.json b/public/assets/locale/fr.json
index a2b5d22d2..70884d172 100644
--- a/public/assets/locale/fr.json
+++ b/public/assets/locale/fr.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "Chiffré",
         "SETTINGS_MERGED": "Fusionné",
         "SETTINGS_MASKED": "MASQUÉ",
+        "SETTINGS_MASKED_ERROR": "Remplacez toutes les valeurs masquées avant d'enregistrer les paramètres chiffrés",
         "SETTINGS_INHERITED": "Paramètre hérité de [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Paramètre local depuis {{ type }}",
         "SETTINGS_SAVE_ERROR": "Échec de l'enregistrement des paramètres. Erreur {{ error }}",
diff --git a/public/assets/locale/jp.json b/public/assets/locale/jp.json
index 22dc438ce..b700ba625 100644
--- a/public/assets/locale/jp.json
+++ b/public/assets/locale/jp.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "暗号化済み",
         "SETTINGS_MERGED": "マージ済み",
         "SETTINGS_MASKED": "マスク済み",
+        "SETTINGS_MASKED_ERROR": "暗号化された設定を保存する前に、マスクされた値をすべて置き換えてください",
         "SETTINGS_INHERITED": "この設定は[{{ parent }}]({{ path }})({{ type }})から継承されています",
         "SETTINGS_LOCAL": "{{ type }}のローカル設定",
         "SETTINGS_SAVE_ERROR": "設定の保存に失敗しました。エラー：{{ error }}",
diff --git a/src/app/admin/build-list.component.ts b/src/app/admin/build-list.component.ts
index da1942124..0d311b8cb 100644
--- a/src/app/admin/build-list.component.ts
+++ b/src/app/admin/build-list.component.ts
@@ -5,6 +5,7 @@ import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { del, get } from '@placeos/ts-client';
 import { toQueryString } from '../common/api';
+import { escapeHtml } from '../common/general';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
 import { openConfirmModal } from '../overlays/confirm-modal.component';
@@ -159,8 +160,8 @@ export class PlaceBuildListComponent implements OnInit {
             {
                 title: i18n('ADMIN.BUILD_LIST_REMOVE'),
                 content: i18n('ADMIN.BUILD_LIST_REMOVE_MSG', {
-                    driver: i.driver,
-                    repo: i.repo,
+                    driver: escapeHtml(i.driver),
+                    repo: escapeHtml(i.repo),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/admin/edge.component.ts b/src/app/admin/edge.component.ts
index 404b1f78a..f0dabe5ae 100644
--- a/src/app/admin/edge.component.ts
+++ b/src/app/admin/edge.component.ts
@@ -11,7 +11,7 @@ import {
     removeEdge,
     retrieveEdgeToken,
 } from '@placeos/ts-client';
-import { copyToClipboard } from '../common/general';
+import { copyToClipboard, escapeHtml } from '../common/general';
 import {
     notifyError,
     notifyInfo,
@@ -228,7 +228,7 @@ export class PlaceEdgeComponent implements OnInit {
         const details = await openConfirmModal(
             {
                 title: 'Remove edge?',
-                content: `Remove <strong>${i.name}</strong>?<br>You or your users may lose access to some data.`,
+                content: `Remove <strong>${escapeHtml(i.name)}</strong>?<br>You or your users may lose access to some data.`,
                 icon: { type: 'icon', content: 'delete' },
             },
             this._dialog,
diff --git a/src/app/admin/extensions.component.ts b/src/app/admin/extensions.component.ts
index e4868ef7f..97d5b0124 100644
--- a/src/app/admin/extensions.component.ts
+++ b/src/app/admin/extensions.component.ts
@@ -7,6 +7,7 @@ import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { PlaceDomain, updateDomain } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { notifyError } from '../common/notifications';
 import { waitForEvent } from '../common/signals';
 import { ApplicationIcon, DialogEvent } from '../common/types';
@@ -15,7 +16,6 @@ import {
     ConfirmModalData,
 } from '../overlays/confirm-modal.component';
 import { IconComponent } from '../ui/icon.component';
-import { SafePipe } from '../ui/pipes/safe.pipe';
 import { SimpleTableComponent } from '../ui/simple-table.component';
 import { TranslatePipe } from '../ui/translate.pipe';
 import { AdminDataService } from './admin-data.service';
@@ -132,10 +132,7 @@ export interface BackofficeExtension {
                     </div>
                 </ng-template>
                 <ng-template #url_template let-row="row">
-                    <a
-                        class="truncate p-4 underline"
-                        [href]="row.url | safe: 'url'"
-                    >
+                    <a class="truncate p-4 underline" [href]="row.url">
                         {{ row.url }}
                     </a>
                 </ng-template>
@@ -188,7 +185,6 @@ export interface BackofficeExtension {
         MatFormFieldModule,
         MatSelectModule,
         FormsModule,
-        SafePipe,
     ],
 })
 export class PlaceExtensionsComponent implements OnInit {
@@ -256,7 +252,7 @@ export class PlaceExtensionsComponent implements OnInit {
             {
                 data: {
                     title: 'Remove extension',
-                    content: `Are you sure you want to remove the extension "${item.name}" from ${item.type}?`,
+                    content: `Are you sure you want to remove the extension "${escapeHtml(item.name)}" from ${escapeHtml(item.type)}?`,
                     icon: { content: 'delete' },
                 },
             },
diff --git a/src/app/admin/resource-imports.component.ts b/src/app/admin/resource-imports.component.ts
index 45f7a8010..2c13cff86 100644
--- a/src/app/admin/resource-imports.component.ts
+++ b/src/app/admin/resource-imports.component.ts
@@ -8,6 +8,7 @@ import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { RouterModule } from '@angular/router';
 import { addSystem, query, querySystemsWithEmails } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { i18n } from '../common/locale.service';
 import { notifySuccess, notifyWarn } from '../common/notifications';
 import { openConfirmModal } from '../overlays/confirm-modal.component';
@@ -215,7 +216,7 @@ export class ResourceImportsComponent implements OnInit {
                     count: missing.length,
                 })}</p>
                 <ul class="list-disc ml-4 text-left px-8 text-sm">${missing
-                    .map((_) => `<li>${_.display_name}</li>`)
+                    .map((_) => `<li>${escapeHtml(_.display_name)}</li>`)
                     .join('')}</ul>
                 `,
                 icon: { type: 'icon', content: 'publish' },
diff --git a/src/app/admin/signage-ai/signage-ai.component.ts b/src/app/admin/signage-ai/signage-ai.component.ts
index 17e67f6bf..2669df37e 100644
--- a/src/app/admin/signage-ai/signage-ai.component.ts
+++ b/src/app/admin/signage-ai/signage-ai.component.ts
@@ -3,6 +3,7 @@ import { MatRippleModule } from '@angular/material/core';
 import { MatDialog } from '@angular/material/dialog';
 import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatTooltipModule } from '@angular/material/tooltip';
+import { escapeHtml } from '../../common/general';
 import { i18n } from '../../common/locale.service';
 import { notifyError, notifySuccess } from '../../common/notifications';
 import { openConfirmModal } from '../../overlays/confirm-modal.component';
@@ -284,7 +285,7 @@ export class SignageAIComponent implements OnInit {
             {
                 title: i18n('ADMIN.AI_PROVIDER_TEST_TITLE'),
                 content: i18n('ADMIN.AI_PROVIDER_TEST_MSG', {
-                    name: item.name,
+                    name: escapeHtml(item.name),
                 }),
                 icon: { content: 'bolt' },
             },
@@ -314,7 +315,7 @@ export class SignageAIComponent implements OnInit {
             {
                 title: i18n('ADMIN.AI_PROVIDER_REMOVE_TITLE'),
                 content: i18n('ADMIN.AI_PROVIDER_REMOVE_MSG', {
-                    name: item.name,
+                    name: escapeHtml(item.name),
                 }),
                 icon: { content: 'delete_forever' },
             },
diff --git a/src/app/admin/signage-plugins/signage-plugin-embed.component.ts b/src/app/admin/signage-plugins/signage-plugin-embed.component.ts
index fbbb8839b..b96b85cd9 100644
--- a/src/app/admin/signage-plugins/signage-plugin-embed.component.ts
+++ b/src/app/admin/signage-plugins/signage-plugin-embed.component.ts
@@ -18,14 +18,18 @@ import { SafePipe } from '../../ui/pipes/safe.pipe';
 
 export const SIGNAGE_PLUGIN_API_VERSION = 'signage-plugin/v1';
 
-/** Resolve a plugin URI the same way as the iframe element. */
+/**
+ * Resolve a plugin URI the same way as the iframe element.
+ * Returns `null` for invalid URIs and for schemes other than http(s).
+ */
 export function resolveSignagePluginUrl(
     uri: string,
     base_uri: string,
 ): URL | null {
     if (!uri) return null;
     try {
-        return new URL(uri, base_uri);
+        const url = new URL(uri, base_uri);
+        return ['http:', 'https:'].includes(url.protocol) ? url : null;
     } catch {
         return null;
     }
@@ -87,7 +91,7 @@ export type PluginErrorPayload = {
         @if (plugin_url(); as plugin_url) {
             <iframe
                 #plugin_el
-                sandbox="allow-scripts allow-same-origin"
+                sandbox="allow-scripts"
                 referrerpolicy="no-referrer"
                 [src]="plugin_url.href | safe: 'resource'"
             >
@@ -118,10 +122,6 @@ export class SignagePluginEmbedComponent
     public readonly plugin_url = computed(() =>
         resolveSignagePluginUrl(this.plugin()?.uri, this._document.baseURI),
     );
-    public readonly plugin_origin = computed(
-        () => this.plugin_url()?.origin || '',
-    );
-
     private _handle_messages = (e) => this._handleMessage(e);
 
     public ngOnInit() {
@@ -137,9 +137,10 @@ export class SignagePluginEmbedComponent
         type: SignageHostMessageType,
         payload: PluginConfigPayload | null = null,
     ) {
-        this._plugin_el()?.nativeElement?.contentWindow.postMessage(
+        // The sandboxed frame has an opaque origin, so no origin can be named
+        this._plugin_el()?.nativeElement?.contentWindow?.postMessage(
             { api: SIGNAGE_PLUGIN_API_VERSION, type, payload },
-            this.plugin_origin(),
+            '*',
         );
     }
 
@@ -151,10 +152,10 @@ export class SignagePluginEmbedComponent
         window.addEventListener('message', this._handle_messages);
     }
 
-    private _handleMessage(event) {
-        if (event.origin !== this.plugin_origin()) return;
-        if (event.source !== this._plugin_el()?.nativeElement?.contentWindow)
-            return;
+    private _handleMessage(event: MessageEvent) {
+        // Origin is `'null'` for sandboxed frames, so match the window
+        const frame_window = this._plugin_el()?.nativeElement?.contentWindow;
+        if (!frame_window || event.source !== frame_window) return;
 
         const msg = event.data;
         if (
diff --git a/src/app/admin/staff-api.component.ts b/src/app/admin/staff-api.component.ts
index 544275828..ea96c8952 100644
--- a/src/app/admin/staff-api.component.ts
+++ b/src/app/admin/staff-api.component.ts
@@ -9,6 +9,7 @@ import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { del, get, PlaceDomain } from '@placeos/ts-client';
 import { addDays, getUnixTime, startOfDay } from 'date-fns';
+import { escapeHtml } from '../common/general';
 import { notifyError, notifySuccess } from '../common/notifications';
 import { HashMap } from '../common/types';
 import { openConfirmModal } from '../overlays/confirm-modal.component';
@@ -247,7 +248,7 @@ export class PlaceStaffAPIComponent implements OnInit {
         const details = await openConfirmModal(
             {
                 title: 'Remove tenant?',
-                content: `Remove <strong>${tenant.name}</strong> from this domain?<br>
+                content: `Remove <strong>${escapeHtml(tenant.name)}</strong> from this domain?<br>
                 <p style="text-align: left; width: 100%;">This will remove all related:</p><br>
                 <ul style="list-style: disc;text-align: left;padding-left: 2rem">
                 <li>bookings (such as desk bookings)</li>
diff --git a/src/app/admin/storage/storage.component.ts b/src/app/admin/storage/storage.component.ts
index 19efc24ec..3ddcdb22f 100644
--- a/src/app/admin/storage/storage.component.ts
+++ b/src/app/admin/storage/storage.component.ts
@@ -6,6 +6,7 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
+import { escapeHtml } from '../../common/general';
 import { i18n } from '../../common/locale.service';
 import { openConfirmModal } from '../../overlays/confirm-modal.component';
 import { IconComponent } from '../../ui/icon.component';
@@ -220,8 +221,8 @@ export class StorageComponent implements OnInit {
             {
                 title: i18n('ADMIN.STORAGE_REMOVE_TITLE'),
                 content: i18n('ADMIN.STORAGE_REMOVE_MSG', {
-                    type: item.storage_type,
-                    name: item.bucket_name,
+                    type: escapeHtml(item.storage_type),
+                    name: escapeHtml(item.bucket_name),
                 }),
                 icon: { content: 'delete_forever' },
             },
diff --git a/src/app/admin/upload-library.component.ts b/src/app/admin/upload-library.component.ts
index 43f6984fe..36cf4bc4a 100644
--- a/src/app/admin/upload-library.component.ts
+++ b/src/app/admin/upload-library.component.ts
@@ -19,6 +19,7 @@ import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { apiKey, cleanObject, query, remove, token } from '@placeos/ts-client';
 import { AsyncHandler } from '../common/async-handler.class';
+import { escapeHtml } from '../common/general';
 import { i18n } from '../common/locale.service';
 import {
     notifyError,
@@ -531,7 +532,7 @@ export class UploadLibraryComponent extends AsyncHandler implements OnInit {
             {
                 title: i18n('ADMIN.UPLOADS_LIB_REMOVE'),
                 content: i18n('ADMIN.UPLOADS_LIB_REMOVE_MSG', {
-                    filename: upload.file_name,
+                    filename: escapeHtml(upload.file_name),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/app.ts b/src/app/app.ts
index 4c0d411c6..15ad09416 100644
--- a/src/app/app.ts
+++ b/src/app/app.ts
@@ -7,7 +7,6 @@ import {
     invalidateToken,
     isMock,
     isOnline,
-    setAPI_Key,
     token,
 } from '@placeos/ts-client';
 
@@ -169,9 +168,6 @@ export class AppComponent extends AsyncHandler implements OnInit {
                 this._locale?.setLocale(locale);
                 localStorage.setItem('BACKOFFICE.locale', locale);
             }
-            if (params.has('x-api-key')) {
-                setAPI_Key(params.get('x-api-key'));
-            }
         });
         setNotifyOutlet(this._snackbar);
         setTranslationService(this._locale);
diff --git a/src/app/common/api.ts b/src/app/common/api.ts
index cbe94aa69..df948213d 100644
--- a/src/app/common/api.ts
+++ b/src/app/common/api.ts
@@ -27,6 +27,34 @@ export function toQueryString(map: HashMap<unknown>) {
     return str;
 }
 
+/**
+ * Check an extension embed URL before it is loaded in an iframe.
+ * Returns the resolved URL if it is http(s) and matches one of the
+ * configured extension URLs for the item, else `null`.
+ * @param embed URL from the `embed` query param
+ * @param allowed_urls Extension URLs from `extensionsForItem`
+ * @param base Base for relative URLs
+ */
+export function allowedEmbedUrl(
+    embed: string,
+    allowed_urls: string[],
+    base = location.origin,
+): string | null {
+    const resolve = (value: string) => {
+        try {
+            const url = new URL(value, base);
+            return ['http:', 'https:'].includes(url.protocol) ? url.href : null;
+        } catch {
+            return null;
+        }
+    };
+    const url = embed ? resolve(embed) : null;
+    if (!url) return null;
+    return allowed_urls.some((allowed) => resolve(allowed) === url)
+        ? url
+        : null;
+}
+
 /**
  * Calculate the index of the module
  * @param module_list List of modules in the parent system
diff --git a/src/app/common/general.ts b/src/app/common/general.ts
index dba803ee7..da6330d6a 100644
--- a/src/app/common/general.ts
+++ b/src/app/common/general.ts
@@ -105,6 +105,23 @@ export function unique<T = string>(array: T[], key = '') {
     );
 }
 
+const HTML_ENTITIES: Record<string, string> = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+};
+
+/**
+ * Escape a value for use in an HTML string, e.g. a user controlled name
+ * inside confirm modal content or editor HTML
+ * @param value Value to escape
+ */
+export function escapeHtml(value: unknown): string {
+    return `${value ?? ''}`.replace(/[&<>"']/g, (char) => HTML_ENTITIES[char]);
+}
+
 /**
  * Generate a random number
  * @param ceil Biggest value to generate not inclusive
diff --git a/src/app/common/hotkeys.service.ts b/src/app/common/hotkeys.service.ts
index 5c5984037..82fc3b3de 100644
--- a/src/app/common/hotkeys.service.ts
+++ b/src/app/common/hotkeys.service.ts
@@ -1,4 +1,9 @@
-import { Service, WritableSignal, signal } from '@angular/core';
+import { Service, WritableSignal, inject, signal } from '@angular/core';
+import {
+    MatDialog,
+    MatDialogRef,
+    MatDialogState,
+} from '@angular/material/dialog';
 
 import { unique } from '../common/general';
 import { SubscriptionLike } from '../common/signals';
@@ -13,8 +18,12 @@ const INVALID_STANDALONE_KEYS: string[] = [
     'os',
 ];
 
+/** Modifier keys whose held state is read from the key event flags */
+const MODIFIER_KEYS: string[] = ['control', 'shift', 'alt', 'meta'];
+
 @Service()
 export class HotkeysService {
+    private _dialog = inject(MatDialog);
     /** Map of signals which store press states of keys */
     private keydown_states: HashMap<WritableSignal<number>> = {};
     /** Map of listeners for key state signals */
@@ -23,10 +32,12 @@ export class HotkeysService {
     private combo_end: string[] = [];
     /** List of registered hotkey combinations */
     private registered_combos: string[][] = [];
-    /** Counter for the number of keydown events. Used for checking order of key presses */
+    /** Counter for the number of keydown events */
     private counter = 0;
     /** Last key code to be pressed */
     private last_down: string;
+    /** Modifiers (including shift) held during the last keydown event */
+    private held_modifiers: string[] = [];
 
     constructor() {
         window.addEventListener('keydown', (event: KeyboardEvent) => {
@@ -37,6 +48,18 @@ export class HotkeysService {
                 return;
             }
             const code = this.mapKey((event.code || '').toLowerCase());
+            this.held_modifiers = this.heldModifiers(event);
+            // Leave e.g. Ctrl+C to the browser if no combination uses Control
+            if (
+                !INVALID_STANDALONE_KEYS.includes(code) &&
+                !this.registered_combos.some(
+                    (combo) =>
+                        combo[combo.length - 1] === code &&
+                        this.allowsModifiers(combo),
+                )
+            ) {
+                return;
+            }
             if (this.last_down !== code) {
                 this.setKeyState(code, ++this.counter);
                 if (this.combo_end.indexOf(code) >= 0) {
@@ -58,7 +81,10 @@ export class HotkeysService {
     }
 
     /**
-     * Listen to the given key combination
+     * Listen to the given key combination.
+     * Modifiers may be pressed in any order, but the last key must be pressed last.
+     * The listener belongs to the dialog that is on top when it is registered
+     * (or to the page when no dialog is open) and only fires while that layer is on top.
      * @param combo Array of key codes to listen to or a hotkey string e.g. `Alt+Shift+KeyK`
      * @param next Callback for combination presses
      */
@@ -75,29 +101,15 @@ export class HotkeysService {
             const last_key = combination[combination.length - 1];
             this.setKeyState(last_key, null);
             this.updateCombinationEndList();
+            const owner = this.topDialog();
             const listener = (count: number) => {
-                if (count) {
-                    const presses: number[] = [];
-                    if (combination.length > 0) {
-                        // Check that keys are pressed
-                        for (const key of combination) {
-                            const state = this.keydown_states[key];
-                            presses.push(state ? state() || -1 : -1);
-                        }
-                        // Check that keys are pressed in the correct order
-                        for (let i = 0; i < combination.length - 1; i++) {
-                            if (presses[i] > presses[i + 1]) {
-                                return;
-                            }
-                        }
-                    }
-                    const total = presses.reduce(
-                        (a, v) => a + (v > 0 ? 1 : -1),
-                        0,
-                    );
-                    if (total >= combination.length) {
-                        next();
-                    }
+                if (
+                    count &&
+                    this.allowsModifiers(combination) &&
+                    this.isActiveLayer(owner) &&
+                    combination.every((key) => this.isPressed(key))
+                ) {
+                    next();
                 }
             };
             this.keydown_listeners[last_key].push(listener);
@@ -128,7 +140,7 @@ export class HotkeysService {
         }
 
         // Check for contenteditable elements
-        if (active.getAttribute('contenteditable') === 'true') {
+        if ((active as HTMLElement).isContentEditable) {
             return true;
         }
 
@@ -148,13 +160,60 @@ export class HotkeysService {
         if (
             code.indexOf('alt') >= 0 ||
             code.indexOf('shift') >= 0 ||
-            code.indexOf('control') >= 0
+            code.indexOf('control') >= 0 ||
+            code.indexOf('meta') >= 0
         ) {
             return code.replace('left', '').replace('right', '');
         }
         return code;
     }
 
+    /** List the modifiers held during a key event */
+    private heldModifiers(event: KeyboardEvent): string[] {
+        const held: string[] = [];
+        if (event.ctrlKey) held.push('control');
+        if (event.shiftKey) held.push('shift');
+        if (event.altKey) held.push('alt');
+        if (event.metaKey) held.push('meta');
+        return held;
+    }
+
+    /**
+     * Whether the combination includes every modifier currently held.
+     * Shift is ignored so that it does not block single key hotkeys.
+     */
+    private allowsModifiers(combo: string[]): boolean {
+        return this.held_modifiers.every(
+            (key) => key === 'shift' || combo.includes(key),
+        );
+    }
+
+    /** Whether the key is held. Modifiers use the event flags, so order does not matter */
+    private isPressed(key: string): boolean {
+        if (MODIFIER_KEYS.includes(key)) {
+            return this.held_modifiers.includes(key);
+        }
+        return (this.keydown_states[key]?.() || 0) > 0;
+    }
+
+    /** Top-most dialog that is open and not closing, or null if there is none */
+    private topDialog(): MatDialogRef<unknown> | null {
+        const open = this._dialog.openDialogs.filter(
+            (ref) => ref.getState() === MatDialogState.OPEN,
+        );
+        return open[open.length - 1] || null;
+    }
+
+    /**
+     * Whether a listener registered while `owner` was on top may fire now.
+     * A listener from a dialog that has since closed is treated as page level.
+     */
+    private isActiveLayer(owner: MatDialogRef<unknown> | null): boolean {
+        const layer =
+            owner && this._dialog.openDialogs.includes(owner) ? owner : null;
+        return this.topDialog() === layer;
+    }
+
     /**
      * Update the list of the last keys in combinations to allow for prevent default actions on pre-existing hotkeys
      */
diff --git a/src/app/common/item.service.ts b/src/app/common/item.service.ts
index 2f76f70c3..f03b0c24c 100644
--- a/src/app/common/item.service.ts
+++ b/src/app/common/item.service.ts
@@ -34,7 +34,7 @@ import {
     CascadeResource,
     runCascade,
 } from './cascade-delete';
-import { log } from './general';
+import { escapeHtml, log } from './general';
 import { i18n } from './locale.service';
 import { notifyError, notifySuccess } from './notifications';
 import { waitForEvent, waitForSignalValue } from './signals';
@@ -342,12 +342,13 @@ export class ActiveItemService extends AsyncHandler {
                             ? 'USERS.FORCE_DELETE_MSG'
                             : `${actions.name}.DELETE_MSG`,
                         {
-                            name:
+                            name: escapeHtml(
                                 (
                                     item as PlaceResource & {
                                         display_name?: string;
                                     }
                                 ).display_name || item.name,
+                            ),
                         },
                     ),
                     extra: actions.delete_extra
diff --git a/src/app/common/validation.ts b/src/app/common/validation.ts
index 83f10aae2..0e17cb0da 100644
--- a/src/app/common/validation.ts
+++ b/src/app/common/validation.ts
@@ -12,11 +12,20 @@ export const validateIpAddress = (ctrl) =>
             : { pattern: true }
         : null;
 
+/** URI schemes that can run script when used as a link */
+const UNSAFE_URI_SCHEMES = ['javascript', 'vbscript', 'data'];
+
+/**
+ * Validates a driver or module URI. The value must use the explicit
+ * `scheme://rest` form (e.g. `https://host:443/path`, `wss://host`).
+ * Bare `host:port` values are rejected, as are script schemes.
+ */
 export const validateURI = (ctrl) => {
     if (!ctrl.value) {
         return null;
     } else {
-        return /\w+:(\/?\/?)[^\s]+?/gim.test(ctrl.value)
+        const match = /^([a-z][a-z0-9+.-]*):\/\/\S+$/i.exec(ctrl.value);
+        return match && !UNSAFE_URI_SCHEMES.includes(match[1].toLowerCase())
             ? null
             : { pattern: true };
     }
diff --git a/src/app/domains/domain-state.service.ts b/src/app/domains/domain-state.service.ts
index 6da59ddbf..9ab0eebd6 100644
--- a/src/app/domains/domain-state.service.ts
+++ b/src/app/domains/domain-state.service.ts
@@ -31,6 +31,7 @@ import {
     updateDomain,
 } from '@placeos/ts-client';
 import { filter, map } from 'rxjs';
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -258,7 +259,7 @@ export class DomainStateService {
         const details = await openConfirmModal(
             {
                 title: `Delete application`,
-                content: `<p>Are you sure you want delete the application ${item.name}?</p><p>Configuration will be <strong>immediately</strong> updated</p>`,
+                content: `<p>Are you sure you want delete the application ${escapeHtml(item.name)}?</p><p>Configuration will be <strong>immediately</strong> updated</p>`,
                 icon: { type: 'icon', content: 'delete' },
             },
             this._dialog,
diff --git a/src/app/drivers/driver-about.component.ts b/src/app/drivers/driver-about.component.ts
index a21b563ba..95f74a0c1 100644
--- a/src/app/drivers/driver-about.component.ts
+++ b/src/app/drivers/driver-about.component.ts
@@ -11,7 +11,6 @@ import { SettingsFormComponent } from '../ui/forms/settings-form.component';
 import { IconComponent } from '../ui/icon.component';
 import { DateFromPipe } from '../ui/pipes/date-from.pipe';
 import { MarkdownPipe } from '../ui/pipes/markdown.pipe';
-import { SafePipe } from '../ui/pipes/safe.pipe';
 import { TranslatePipe } from '../ui/translate.pipe';
 import { DriverStateService } from './driver-state.service';
 
@@ -34,7 +33,7 @@ import { DriverStateService } from './driver-state.service';
                             <div class="overflow-hidden underline select-all">
                                 <a
                                     class="mono block w-full truncate text-sm"
-                                    [href]="item().default_uri | safe: 'url'"
+                                    [href]="item().default_uri"
                                     target="_blank"
                                     >{{ item().default_uri }}</a
                                 >
@@ -222,7 +221,6 @@ import { DriverStateService } from './driver-state.service';
         DateFromPipe,
         MarkdownPipe,
         RouterModule,
-        SafePipe,
         MatProgressSpinnerModule,
         AsyncPipe,
         DatePipe,
diff --git a/src/app/drivers/driver-form.component.ts b/src/app/drivers/driver-form.component.ts
index d92c38680..53e2f1075 100644
--- a/src/app/drivers/driver-form.component.ts
+++ b/src/app/drivers/driver-form.component.ts
@@ -177,15 +177,21 @@ import {
                             [formField]="form.description"
                         ></textarea>
                     </mat-form-field>
-                    <label for="default-uri">{{
-                        'DRIVERS.DEFAULT_URI' | translate
-                    }}</label>
+                    <label
+                        for="default-uri"
+                        [class.error]="fieldInvalid('default_uri')"
+                    >
+                        {{ 'DRIVERS.DEFAULT_URI' | translate }}
+                    </label>
                     <mat-form-field appearance="outline">
                         <input
                             matInput
                             [placeholder]="'DRIVERS.DEFAULT_URI' | translate"
                             [formField]="form.default_uri"
                         />
+                        <mat-error>
+                            {{ 'MODULES.URI_REQUIRED' | translate }}
+                        </mat-error>
                     </mat-form-field>
                     <div class="flex items-center space-x-4">
                         <div class="flex flex-1 flex-col">
diff --git a/src/app/groups/group-state.service.ts b/src/app/groups/group-state.service.ts
index 4d56f49fc..6b28ca0e5 100644
--- a/src/app/groups/group-state.service.ts
+++ b/src/app/groups/group-state.service.ts
@@ -17,6 +17,7 @@ import {
     updateGroupUser,
     updateGroupZone,
 } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -250,7 +251,7 @@ export class GroupStateService {
             {
                 title: i18n('GROUPS.USER_REMOVE'),
                 content: i18n('GROUPS.USER_REMOVE_MSG', {
-                    name: item.user?.name || item.user_id,
+                    name: escapeHtml(item.user?.name || item.user_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
@@ -312,7 +313,7 @@ export class GroupStateService {
             {
                 title: i18n('GROUPS.ZONE_REMOVE'),
                 content: i18n('GROUPS.ZONE_REMOVE_MSG', {
-                    name: item.zone?.name || item.zone_id,
+                    name: escapeHtml(item.zone?.name || item.zone_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/modules/modules.utilities.ts b/src/app/modules/modules.utilities.ts
index d9cbae122..a83a9394f 100644
--- a/src/app/modules/modules.utilities.ts
+++ b/src/app/modules/modules.utilities.ts
@@ -86,11 +86,17 @@ export const applyModuleFormSchema: SchemaFn<ModuleFormModel> = (path) => {
             ? { kind: 'pattern', message: 'Invalid IP address' }
             : undefined,
     );
-    validate(path.uri, ({ value }) =>
-        validateURI({ value: value() })
+    // The URI field is only shown for service/websocket modules, so a hidden
+    // value (e.g. inherited from a device driver) must not block saving
+    validate(path.uri, ({ value, valueOf }) => {
+        const role = valueOf(path.role);
+        const uses_uri =
+            role === PlaceDriverRole.Service ||
+            role === PlaceDriverRole.Websocket;
+        return uses_uri && validateURI({ value: value() })
             ? { kind: 'pattern', message: 'Invalid URI' }
-            : undefined,
-    );
+            : undefined;
+    });
     required(path.uri, {
         when({ valueOf }) {
             const role = valueOf(path.role);
diff --git a/src/app/repositories/repositories.utilities.ts b/src/app/repositories/repositories.utilities.ts
index 97a8ea95a..eccd57c07 100644
--- a/src/app/repositories/repositories.utilities.ts
+++ b/src/app/repositories/repositories.utilities.ts
@@ -54,3 +54,20 @@ export const applyRepositoryFormSchema: SchemaFn<RepositoryFormModel> = (
     });
     required(path.uri);
 };
+
+/**
+ * Remove the username and password from a repository URI, so it is safe to
+ * show and to use as a link. URIs that do not parse (e.g. `git@host:repo`)
+ * only have any `//user:pass@` part removed.
+ */
+export function maskUriCredentials(uri: string): string {
+    if (!uri) return '';
+    try {
+        const url = new URL(uri);
+        url.username = '';
+        url.password = '';
+        return url.href;
+    } catch {
+        return uri.replace(/\/\/[^/\s]*@/, '//');
+    }
+}
diff --git a/src/app/repositories/repository-about.component.ts b/src/app/repositories/repository-about.component.ts
index 915fb05d1..fa721f93c 100644
--- a/src/app/repositories/repository-about.component.ts
+++ b/src/app/repositories/repository-about.component.ts
@@ -7,9 +7,9 @@ import { PlaceRepositoryType } from '@placeos/ts-client';
 import { IconComponent } from '../ui/icon.component';
 import { DateFromPipe } from '../ui/pipes/date-from.pipe';
 import { MarkdownPipe } from '../ui/pipes/markdown.pipe';
-import { SafePipe } from '../ui/pipes/safe.pipe';
 import { TranslatePipe } from '../ui/translate.pipe';
 import { RepositoriesStateService } from './repositories-state.service';
+import { maskUriCredentials } from './repositories.utilities';
 
 @Component({
     selector: 'repository-about',
@@ -108,7 +108,7 @@ import { RepositoriesStateService } from './repositories-state.service';
                     <div class="overflow-hidden underline select-all">
                         <a
                             class="block w-full truncate"
-                            [href]="item().uri | safe: 'url'"
+                            [href]="repo_uri()"
                             target="_blank"
                             >{{ repo_uri() || 'No URI set' }}</a
                         >
@@ -217,7 +217,6 @@ import { RepositoriesStateService } from './repositories-state.service';
         MatProgressSpinnerModule,
         MatRippleModule,
         MatTooltipModule,
-        SafePipe,
         DateFromPipe,
         AsyncPipe,
         DatePipe,
@@ -238,8 +237,9 @@ export class RepositoryAboutComponent {
             ? `${location.origin}/${this.item()?.folder_name}/`
             : `${location.hash}`,
     );
+    /** Repository URI without credentials, used for both the text and link */
     public readonly repo_uri = computed(() =>
-        this.item()?.uri.replace(/\/[a-zA-Z0-9\-.:]*@/, '/...@'),
+        maskUriCredentials(this.item()?.uri),
     );
     public readonly is_interface = computed(
         () => this.item()?.type === PlaceRepositoryType.Interface,
diff --git a/src/app/systems/system-state.service.ts b/src/app/systems/system-state.service.ts
index 441156b57..e61720c39 100644
--- a/src/app/systems/system-state.service.ts
+++ b/src/app/systems/system-state.service.ts
@@ -31,7 +31,7 @@ import {
 import { calculateModuleIndex } from '../common/api';
 import { AsyncHandler } from '../common/async-handler.class';
 import { PlaceDebugService } from '../common/debug.service';
-import { unique } from '../common/general';
+import { escapeHtml, unique } from '../common/general';
 import {
     isSubsystemUser,
     querySupportSystems as querySystems,
@@ -488,7 +488,7 @@ export class SystemStateService extends AsyncHandler {
     public async removeTrigger(trigger: PlaceTrigger) {
         const details = await this.confirm({
             title: `Remove trigger`,
-            content: `<p>Are you sure you want remove trigger "${trigger.name}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
+            content: `<p>Are you sure you want remove trigger "${escapeHtml(trigger.name)}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
             icon: { type: 'icon', content: 'delete' },
         });
         if (details.reason !== 'done') return;
@@ -714,7 +714,7 @@ export class SystemStateService extends AsyncHandler {
     public async removeZone(zone: PlaceZone) {
         const details = await this.confirm({
             title: 'Remove zone?',
-            content: `<p>Are you sure you want remove zone "${zone.name}" from the system?</p>Configuration will be updated immediately.`,
+            content: `<p>Are you sure you want remove zone "${escapeHtml(zone.name)}" from the system?</p>Configuration will be updated immediately.`,
             icon: { type: 'icon', content: 'delete' },
         });
         if (details.reason !== 'done') return;
diff --git a/src/app/triggers/trigger-state.service.ts b/src/app/triggers/trigger-state.service.ts
index a9935a51a..d60a93336 100644
--- a/src/app/triggers/trigger-state.service.ts
+++ b/src/app/triggers/trigger-state.service.ts
@@ -13,6 +13,7 @@ import {
     updateTrigger,
 } from '@placeos/ts-client';
 
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -285,7 +286,7 @@ export class TriggerStateService {
                 title: i18n('TRIGGERS.REMOVE_INSTANCE_TITLE', { type }),
                 content: i18n('TRIGGERS.REMOVE_INSTANCE_MSG', {
                     type,
-                    name: instance.name,
+                    name: escapeHtml(instance.name),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/ui/custom-fields/item-search-field.component.ts b/src/app/ui/custom-fields/item-search-field.component.ts
index df9aade45..d8b0290e7 100644
--- a/src/app/ui/custom-fields/item-search-field.component.ts
+++ b/src/app/ui/custom-fields/item-search-field.component.ts
@@ -28,6 +28,7 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
 import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
 import { AsyncHandler } from '../../common/async-handler.class';
+import { escapeHtml } from '../../common/general';
 import { HashMap } from '../../common/types';
 import { IconComponent } from '../icon.component';
 import { SanitizePipe } from '../pipes/sanitise.pipe';
@@ -386,6 +387,7 @@ export class ItemSearchFieldComponent<T extends SearchItem>
         this._onTouch?.(this.active_item());
     }
 
+    /** Build the option label HTML for each item. Item values are escaped */
     private _updateNameMap() {
         const map = {};
         const list = this.items || [];
@@ -397,14 +399,15 @@ export class ItemSearchFieldComponent<T extends SearchItem>
                         : item.role === PlaceDriverRole.Logic
                           ? item.control_system_id
                           : item.ip;
-                map[item.id] = `${
-                    item.name || '<Unnamed>'
-                } <span class="small">${detail}<span>`;
+                map[item.id] = `${escapeHtml(
+                    item.name || '<Unnamed>',
+                )} <span class="small">${escapeHtml(detail)}</span>`;
             } else {
-                map[item.id] =
+                map[item.id] = escapeHtml(
                     (item as unknown as { custom_name?: string }).custom_name ||
-                    item.name ||
-                    '<Unnamed>';
+                        item.name ||
+                        '<Unnamed>',
+                );
             }
         }
         this.item_name.set(map);
diff --git a/src/app/ui/custom-fields/rich-text-input.component.ts b/src/app/ui/custom-fields/rich-text-input.component.ts
index 552b8d117..021a6ed3c 100644
--- a/src/app/ui/custom-fields/rich-text-input.component.ts
+++ b/src/app/ui/custom-fields/rich-text-input.component.ts
@@ -15,6 +15,7 @@ import { apiKey, token } from '@placeos/ts-client';
 import SunEditor from 'suneditor';
 import { font, fontSize, formatBlock, link, list } from 'suneditor/src/plugins';
 import { AsyncHandler } from '../../common/async-handler.class';
+import { escapeHtml } from '../../common/general';
 import { uploadFile } from '../../common/uploads';
 
 @Component({
@@ -77,6 +78,12 @@ export class RichTextInputComponent
         this.timeout('init', () => this._initialiseEditor());
     }
 
+    public override ngOnDestroy() {
+        this._editor?.destroy();
+        delete this._editor;
+        super.ngOnDestroy();
+    }
+
     /**
      * Update the form field value
      * @param new_value New value to set on the form field
@@ -97,7 +104,7 @@ export class RichTextInputComponent
             if (this._editor) {
                 this._setAuth();
                 setTimeout(() => {
-                    this._editor.setContents(value);
+                    this._editor?.setContents(value);
                 }, 100);
             } else this.timeout('write', () => this.writeValue(value));
         });
@@ -122,6 +129,7 @@ export class RichTextInputComponent
         }
         if (this._editor) {
             this.unsub('changes');
+            this._editor.destroy();
             _editor_el.innerHTML = '';
             delete this._editor;
         }
@@ -193,8 +201,8 @@ export class RichTextInputComponent
                 const link = `/api/engine/v2/uploads/${encodeURIComponent(upload.id)}/url`;
                 this._setAuth();
                 setTimeout(() => {
-                    this._editor.insertHTML(
-                        `<img src="${link}" alt="${file.name}" />`,
+                    this._editor?.insertHTML(
+                        `<img src="${link}" alt="${escapeHtml(file.name)}" />`,
                     );
                 }, 100);
             });
@@ -217,12 +225,12 @@ export class RichTextInputComponent
                 this._setAuth();
                 setTimeout(() => {
                     if (is_image) {
-                        this._editor.insertHTML(
-                            `<img src="${link}" alt="${file.name}" />`,
+                        this._editor?.insertHTML(
+                            `<img src="${link}" alt="${escapeHtml(file.name)}" />`,
                         );
                     } else {
-                        this._editor.insertHTML(
-                            `<a href="${link}" target="_blank">${file.name}</a>`,
+                        this._editor?.insertHTML(
+                            `<a href="${link}" target="_blank">${escapeHtml(file.name)}</a>`,
                         );
                     }
                 }, 100);
diff --git a/src/app/ui/extension-outlet.component.ts b/src/app/ui/extension-outlet.component.ts
index 66bae2dae..ab4f4f525 100644
--- a/src/app/ui/extension-outlet.component.ts
+++ b/src/app/ui/extension-outlet.component.ts
@@ -17,6 +17,7 @@ import {
     token,
     updateMetadata,
 } from '@placeos/ts-client';
+import { allowedEmbedUrl, extensionsForItem } from '../common/api';
 import { AsyncHandler } from '../common/async-handler.class';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
@@ -68,12 +69,28 @@ export class ExtensionOutletComponent extends AsyncHandler {
               : null;
     });
 
+    /** Last embed param that passed the extension URL check */
+    private _verified_embed = '';
+
     public readonly url = signal('');
     public readonly app_loaded = signal(false);
+    private readonly _frame_origin = computed(() =>
+        this.url() ? new URL(this.url()).origin : '',
+    );
 
-    public readonly onMessage = (m) => {
-        if (typeof m.data !== 'string') return;
-        this.handleMessage(JSON.parse(m.data));
+    /** Handle messages sent by the embedded extension frame only */
+    public readonly onMessage = (event: MessageEvent) => {
+        const frame_window = this._frame_el()?.nativeElement?.contentWindow;
+        if (!frame_window || event.source !== frame_window) return;
+        if (event.origin !== this._frame_origin()) return;
+        if (typeof event.data !== 'string') return;
+        let message: FrameMessage;
+        try {
+            message = JSON.parse(event.data);
+        } catch {
+            return;
+        }
+        this.handleMessage(message);
     };
 
     private readonly _frame_el =
@@ -91,11 +108,23 @@ export class ExtensionOutletComponent extends AsyncHandler {
             if (embed === undefined) {
                 return;
             }
-            if (embed) {
-                this.url.set(embed);
-            } else {
+            if (!embed) {
                 this._location.back();
+                return;
             }
+            const item = this._service.item();
+            if (!this._online() || !item || embed === this._verified_embed) {
+                return;
+            }
+            // Only load URLs from the extensions configured for this item
+            const url = allowedEmbedUrl(
+                embed,
+                extensionsForItem(item, this._service.type).map(
+                    (ext) => ext.query.embed,
+                ),
+            );
+            this._verified_embed = url ? embed : '';
+            this.url.set(url || '');
         });
         effect((onCleanup) => {
             window.addEventListener('message', this.onMessage);
@@ -106,34 +135,28 @@ export class ExtensionOutletComponent extends AsyncHandler {
     }
 
     private async handleMessage(message: FrameMessage) {
-        if (!this._frame_el()?.nativeElement) {
-            return this.timeout('not_ready', () => this.handleMessage(message));
+        const item = this._service.active_item;
+        if (message?.type !== 'backoffice' || !item) return;
+        if (message.action === 'update') {
+            // Handle update to item model
+            this.updateItem(item, message);
+        } else if (message.action === 'metadata' && message.name) {
+            // Handle updating metadata
+            this.updateMetadata(item, message);
+        } else if (message.action === 'load' && message.name) {
+            // Handle loading metadata
+            this.loadMetadata(item, message, message.parent);
+        } else if (message.action === 'resource' && message.name) {
+            // Handle loading a resource
+            const url = await this.loadResource(item, message);
+            this._postMessage({
+                id: message.id,
+                type: 'backoffice',
+                status: 'success',
+                content: url,
+                action: 'result',
+            });
         }
-        this.timeout(`on_message:${message.action}`, async () => {
-            const item = this._service.active_item;
-            if (message.type === 'backoffice' && item) {
-                if (message.action === 'update') {
-                    // Handle update to item model
-                    this.updateItem(item, message);
-                } else if (message.action === 'metadata' && message.name) {
-                    // Handle updating metadata
-                    this.updateMetadata(item, message);
-                } else if (message.action === 'load' && message.name) {
-                    // Handle updating metadata
-                    this.loadMetadata(item, message, message.parent);
-                } else if (message.action === 'resource' && message.name) {
-                    // Handle updating metadata
-                    const url = await this.loadResource(item, message);
-                    this._postMessage({
-                        id: message.id,
-                        type: 'backoffice',
-                        status: 'success',
-                        content: url,
-                        action: 'result',
-                    });
-                }
-            }
-        });
     }
 
     private async updateItem(item: PlaceResource, message: FrameMessage) {
@@ -225,9 +248,11 @@ export class ExtensionOutletComponent extends AsyncHandler {
     }
 
     private _postMessage(message: FrameMessage) {
+        const origin = this._frame_origin();
+        if (!origin) return;
         this._frame_el()?.nativeElement?.contentWindow?.postMessage(
             JSON.stringify(message),
-            '*',
+            origin,
         );
     }
 }
diff --git a/src/app/ui/forms/settings-form.component.ts b/src/app/ui/forms/settings-form.component.ts
index ba9c7b370..a59f3b137 100644
--- a/src/app/ui/forms/settings-form.component.ts
+++ b/src/app/ui/forms/settings-form.component.ts
@@ -409,40 +409,36 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
     public ngOnInit(): void {
         this.subscription(
             'save_all',
-            this._hotkey.listen(['KeyA'], () => this.saveAll()),
+            this._hotkey.listen(['Alt', 'Shift', 'KeyA'], () => this.saveAll()),
         );
         this.subscription(
             'clear_all',
-            this._hotkey.listen(['KeyC'], () => this.clearChanges()),
+            this._hotkey.listen(['Alt', 'Shift', 'KeyC'], () =>
+                this.clearChanges(),
+            ),
         );
     }
 
     /** Save changes to the given setting level */
     public save(level: EncryptionLevel) {
         const item = this.used_settings()[level];
-        if (!item && this.saving()[level]) return;
-        this.saving.update((s) => {
-            s[level] = true;
-            return s;
-        });
+        if (!item || this.saving()[level]) return;
+        if (this._hasMaskedValues(level)) {
+            return notifyError(i18n('COMMON.SETTINGS_MASKED_ERROR'));
+        }
+        if (!this._canSave(level)) return;
+        this._setSaving(level, true);
         const details = {
             ...item,
             settings_string: this.settingValue(level),
         };
-        const settings = this.settings();
-        (settings[level].id
-            ? updateSettings(settings[level].id, details)
+        (item.id
+            ? updateSettings(item.id, details)
             : addSettings(details)
         ).then(
             (new_settings: PlaceSettings) => {
-                this.saving.update((s) => {
-                    s[level] = false;
-                    return s;
-                });
-                this.settings.update((s) => {
-                    s[level] = new_settings;
-                    return s;
-                });
+                this._setSaving(level, false);
+                this._setSettings(level, new_settings);
                 notifySuccess(
                     i18n('COMMON.SETTINGS_SAVE_SUCCESS', {
                         type: this.type(level),
@@ -451,10 +447,7 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
                 this.clearChanges();
             },
             (err) => {
-                this.saving.update((s) => {
-                    s[level] = false;
-                    return s;
-                });
+                this._setSaving(level, false);
                 notifyError(
                     i18n('COMMON.SETTINGS_SAVE_ERROR', {
                         error: JSON.stringify(
@@ -466,51 +459,43 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
         );
     }
 
-    /** Save all changes to settings */
+    /** Save all changed settings levels that the user can edit */
     public saveAll() {
         if (this.has_errors())
             return notifyError('Some of the settings are invalid');
         const promises = [];
+        const saved_levels: number[] = [];
         for (let i = 0; i < EncryptionLevel.NeverDisplay + 1; i++) {
-            const settings = this.settings();
-            if (settings[i] && !this.saving()[i]) {
-                this.saving.update((s) => {
-                    s[i] = true;
-                    return s;
-                });
-                const details = {
-                    ...settings[i],
-                    settings_string: this.settingValue(i),
-                };
-                promises.push(
-                    settings[i].id
-                        ? updateSettings(settings[i].id, details)
-                        : addSettings(details),
-                );
+            if (this.settingDirty(i) && this._hasMaskedValues(i)) {
+                notifyError(i18n('COMMON.SETTINGS_MASKED_ERROR'));
             }
+            const item = this.used_settings()[i];
+            if (!item || this.saving()[i] || !this._canSave(i)) continue;
+            this._setSaving(i, true);
+            saved_levels.push(i);
+            const details = {
+                ...item,
+                settings_string: this.settingValue(i),
+            };
+            promises.push(
+                item.id
+                    ? updateSettings(item.id, details)
+                    : addSettings(details),
+            );
         }
         if (promises.length) {
             Promise.all(promises).then(
                 (results: PlaceSettings[]) => {
-                    for (const result of results) {
-                        this.saving.update((s) => {
-                            s[result.encryption_level] = false;
-                            return s;
-                        });
-                        this.settings.update((s) => {
-                            s[result.encryption_level] = result;
-                            return s;
-                        });
-                    }
+                    results.forEach((result, index) => {
+                        this._setSaving(saved_levels[index], false);
+                        this._setSettings(saved_levels[index], result);
+                    });
                     notifySuccess(i18n('COMMON.SETTINGS_SAVE_SUCCESS_ALL'));
                     this.clearChanges();
                 },
                 (err) => {
-                    for (let i = 0; i < EncryptionLevel.NeverDisplay + 1; i++) {
-                        this.saving.update((s) => {
-                            s[i] = false;
-                            return s;
-                        });
+                    for (const level of saved_levels) {
+                        this._setSaving(level, false);
                     }
                     notifyError(
                         i18n('COMMON.SETTINGS_SAVE_ERROR', {
@@ -524,6 +509,46 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
         }
     }
 
+    /** Whether the level has changes the user is allowed to save */
+    private _canSave(level: number) {
+        const option = this.levels().find((i) => i.id === level);
+        return (
+            !!option?.active &&
+            this.settingDirty(level) &&
+            !this._hasMaskedValues(level)
+        );
+    }
+
+    /** Whether encrypted settings still hold masked placeholder values */
+    private _hasMaskedValues(level: number) {
+        return (
+            level === EncryptionLevel.NeverDisplay &&
+            this.settingValue(level).includes(
+                `<${i18n('COMMON.SETTINGS_MASKED')}>`,
+            )
+        );
+    }
+
+    private _setSaving(level: number, state: boolean) {
+        this.saving.update(
+            (s) =>
+                s.map((v, i) => (i === level ? state : v)) as [
+                    boolean,
+                    boolean,
+                    boolean,
+                    boolean,
+                ],
+        );
+    }
+
+    private _setSettings(level: number, new_settings: PlaceSettings) {
+        this.settings.update((s) => {
+            const next = [...(s || [])] as SettingsArray;
+            next[level] = new_settings;
+            return next;
+        });
+    }
+
     public clearChanges() {
         this.used_settings.set(this._processSettings(this.settings() || []));
         this._initForm();
@@ -555,7 +580,7 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
                 );
                 continue;
             }
-            processed_settings.push(this._processSetting(settings[i]));
+            processed_settings.push(this._processSetting(setting));
         }
         processed_settings.push(
             this.merge()
@@ -568,9 +593,9 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
     private _processSetting(setting: PlaceSettings): PlaceSettings {
         if (
             (setting.encryption_level === EncryptionLevel.Admin &&
-                !this.is_admin) ||
+                !this.is_admin()) ||
             (setting.encryption_level === EncryptionLevel.Support &&
-                !this.is_support) ||
+                !this.is_support()) ||
             setting.encryption_level === EncryptionLevel.NeverDisplay
         ) {
             const obj = {};
diff --git a/src/app/ui/metadata-display.component.ts b/src/app/ui/metadata-display.component.ts
index 78d603353..1913c3432 100644
--- a/src/app/ui/metadata-display.component.ts
+++ b/src/app/ui/metadata-display.component.ts
@@ -22,6 +22,7 @@ import {
     updateMetadata,
 } from '@placeos/ts-client';
 import { VERSION } from '../../env/version';
+import { escapeHtml } from '../common/general';
 // import { SchemaStateService } from '../admin/schema-state.service';
 import { AsyncHandler } from '../common/async-handler.class';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -322,7 +323,7 @@ export class MetadataDisplayComponent
             {
                 title: `Remove Metadata block`,
                 content: `
-                <p>Are you sure you want delete the metadata property "${field}"?</p>
+                <p>Are you sure you want delete the metadata property "${escapeHtml(field)}"?</p>
             `,
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/users/users-state.service.ts b/src/app/users/users-state.service.ts
index 2fbbe3ec7..6456cc622 100644
--- a/src/app/users/users-state.service.ts
+++ b/src/app/users/users-state.service.ts
@@ -12,6 +12,7 @@ import {
     reviveUser,
     updateGroupUser,
 } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -178,7 +179,7 @@ export class UsersStateService {
             {
                 title: i18n('USERS.GROUP_REMOVE'),
                 content: i18n('USERS.GROUP_REMOVE_MSG', {
-                    name: item.group?.name || item.group_id,
+                    name: escapeHtml(item.group?.name || item.group_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
@@ -229,7 +230,9 @@ export class UsersStateService {
         const details = await openConfirmModal(
             {
                 title: i18n('USERS.REVIVE'),
-                content: i18n('USERS.REVIVE_MSG', { name: item.name }),
+                content: i18n('USERS.REVIVE_MSG', {
+                    name: escapeHtml(item.name),
+                }),
                 confirm_text: i18n('USERS.REVIVE'),
                 icon: { type: 'icon', content: 'restore_from_trash' },
             },
diff --git a/src/app/zones/zones-state.service.ts b/src/app/zones/zones-state.service.ts
index 7adf5f9d5..bd9bc31eb 100644
--- a/src/app/zones/zones-state.service.ts
+++ b/src/app/zones/zones-state.service.ts
@@ -18,7 +18,7 @@ import {
     updateGroupZone,
     updateZone,
 } from '@placeos/ts-client';
-import { unique } from '../common/general';
+import { escapeHtml, unique } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -250,7 +250,7 @@ export class ZonesStateService {
         const details = await openConfirmModal(
             {
                 title: `Remove trigger`,
-                content: `<p>Are you sure you want remove trigger "${trigger.name}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
+                content: `<p>Are you sure you want remove trigger "${escapeHtml(trigger.name)}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
                 icon: { type: 'icon', content: 'delete' },
             },
             this._dialog,
@@ -347,7 +347,7 @@ export class ZonesStateService {
             {
                 title: i18n('ZONES.GROUP_REMOVE'),
                 content: i18n('ZONES.GROUP_REMOVE_MSG', {
-                    name: item.group?.name || item.group_id,
+                    name: escapeHtml(item.group?.name || item.group_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/tests/admin/signage-plugin-embed.component.spec.ts b/src/tests/admin/signage-plugin-embed.component.spec.ts
index 9c9ee10ba..dce0a2344 100644
--- a/src/tests/admin/signage-plugin-embed.component.spec.ts
+++ b/src/tests/admin/signage-plugin-embed.component.spec.ts
@@ -29,5 +29,11 @@ describe('SignagePluginEmbedComponent', () => {
         it('rejects an invalid plugin URI', () => {
             expect(resolveSignagePluginUrl('http://[', base_uri)).toBeNull();
         });
+
+        it('rejects a non-http plugin URI', () => {
+            expect(
+                resolveSignagePluginUrl('javascript:alert(1)', base_uri),
+            ).toBeNull();
+        });
     });
 });
diff --git a/src/tests/common/api.spec.ts b/src/tests/common/api.spec.ts
index 6524fc49b..984ebc77d 100644
--- a/src/tests/common/api.spec.ts
+++ b/src/tests/common/api.spec.ts
@@ -7,7 +7,11 @@ vi.mock('@placeos/ts-client', () => ({
     PlaceResource: class {},
 }));
 
-import { toQueryString, calculateModuleIndex } from '../../app/common/api';
+import {
+    allowedEmbedUrl,
+    calculateModuleIndex,
+    toQueryString,
+} from '../../app/common/api';
 
 describe('api.ts utilities', () => {
     describe('toQueryString', () => {
@@ -222,4 +226,47 @@ describe('api.ts utilities', () => {
             expect(index).toBe(2);
         });
     });
+
+    describe('allowedEmbedUrl', () => {
+        const base = 'https://backoffice.example';
+        const allowed = [
+            'https://ext.example/view?id=sys-1',
+            '/local/extension',
+        ];
+
+        it('allows a configured extension URL', () => {
+            expect(
+                allowedEmbedUrl(
+                    'https://ext.example/view?id=sys-1',
+                    allowed,
+                    base,
+                ),
+            ).toBe('https://ext.example/view?id=sys-1');
+        });
+
+        it('resolves a relative extension URL', () => {
+            expect(allowedEmbedUrl('/local/extension', allowed, base)).toBe(
+                'https://backoffice.example/local/extension',
+            );
+        });
+
+        it('rejects script URLs', () => {
+            expect(
+                allowedEmbedUrl('javascript:alert(1)', ['javascript:alert(1)']),
+            ).toBeNull();
+        });
+
+        it('rejects a URL that is not configured', () => {
+            expect(
+                allowedEmbedUrl('https://evil.example/view', allowed, base),
+            ).toBeNull();
+            expect(
+                allowedEmbedUrl(
+                    'https://ext.example/view?id=sys-2',
+                    allowed,
+                    base,
+                ),
+            ).toBeNull();
+        });
+    });
 });
diff --git a/src/tests/common/general.spec.ts b/src/tests/common/general.spec.ts
index 4e6133ba8..cff523516 100644
--- a/src/tests/common/general.spec.ts
+++ b/src/tests/common/general.spec.ts
@@ -4,6 +4,7 @@ import {
     csvToJson,
     detectIE,
     downloadFile,
+    escapeHtml,
     eventToPoint,
     flatten,
     getItemWithKeys,
@@ -156,6 +157,19 @@ describe('general.ts utilities', () => {
         });
     });
 
+    describe('escapeHtml', () => {
+        it('escapes HTML special characters', () => {
+            expect(escapeHtml(`<img src=x onerror="a('b')">&`)).toBe(
+                '&lt;img src=x onerror=&quot;a(&#39;b&#39;)&quot;&gt;&amp;',
+            );
+        });
+
+        it('returns an empty string for null or undefined', () => {
+            expect(escapeHtml(null)).toBe('');
+            expect(escapeHtml(undefined)).toBe('');
+        });
+    });
+
     describe('unique', () => {
         it('should remove duplicate primitives', () => {
             const arr = [1, 2, 2, 3, 3, 3];
diff --git a/src/tests/common/hotkeys.service.spec.ts b/src/tests/common/hotkeys.service.spec.ts
index 9702e6c4e..b79baa4fc 100644
--- a/src/tests/common/hotkeys.service.spec.ts
+++ b/src/tests/common/hotkeys.service.spec.ts
@@ -1,13 +1,46 @@
 import { TestBed } from '@angular/core/testing';
+import { MatDialog, MatDialogState } from '@angular/material/dialog';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { HotkeysService } from '../../app/common/hotkeys.service';
 
 describe('HotkeysService', () => {
     let service: HotkeysService;
+    let open_dialogs: { getState: () => MatDialogState }[];
+
+    const keyEvent = (
+        type: 'keydown' | 'keyup',
+        code: string,
+        init: KeyboardEventInit = {},
+    ) => {
+        const event = new KeyboardEvent(type, {
+            code,
+            cancelable: true,
+            ...init,
+        });
+        window.dispatchEvent(event);
+        return event;
+    };
+
+    const openDialog = () => {
+        const ref = { getState: () => MatDialogState.OPEN };
+        open_dialogs.push(ref);
+        return ref;
+    };
 
     beforeEach(() => {
+        open_dialogs = [];
         TestBed.configureTestingModule({
-            providers: [HotkeysService],
+            providers: [
+                HotkeysService,
+                {
+                    provide: MatDialog,
+                    useValue: {
+                        get openDialogs() {
+                            return open_dialogs;
+                        },
+                    },
+                },
+            ],
         });
         service = TestBed.inject(HotkeysService);
     });
@@ -126,6 +159,119 @@ describe('HotkeysService', () => {
         });
     });
 
+    describe('modifier keys', () => {
+        it('ignores a single key combination while Control or Meta is held', () => {
+            const callback = vi.fn();
+            const subscription = service.listen(['KeyE'], callback);
+            for (const init of [{ ctrlKey: true }, { metaKey: true }]) {
+                const event = keyEvent('keydown', 'KeyE', init);
+                keyEvent('keyup', 'KeyE', init);
+                expect(event.defaultPrevented).toBe(false);
+            }
+            expect(callback).not.toHaveBeenCalled();
+            keyEvent('keydown', 'KeyE');
+            keyEvent('keyup', 'KeyE');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
+
+        it('fires a combination that includes the held modifier', () => {
+            const callback = vi.fn();
+            const subscription = service.listen(['Control', 'KeyK'], callback);
+            keyEvent('keydown', 'ControlLeft', { ctrlKey: true });
+            keyEvent('keydown', 'KeyK', { ctrlKey: true });
+            keyEvent('keyup', 'KeyK', { ctrlKey: true });
+            keyEvent('keyup', 'ControlLeft');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
+
+        it.each([
+            ['AltLeft', 'ShiftLeft'],
+            ['ShiftLeft', 'AltLeft'],
+        ])(
+            'fires Alt+Shift+A when %s is pressed before %s',
+            (first, second) => {
+                const callback = vi.fn();
+                const subscription = service.listen('Alt+Shift+KeyA', callback);
+                const init = { altKey: true, shiftKey: true };
+                keyEvent('keydown', first, init);
+                keyEvent('keydown', second, init);
+                keyEvent('keydown', 'KeyA', init);
+                keyEvent('keyup', 'KeyA', init);
+                keyEvent('keyup', second);
+                keyEvent('keyup', first);
+                expect(callback).toHaveBeenCalledTimes(1);
+                subscription?.unsubscribe();
+            },
+        );
+
+        it('does not fire a combination when one of its modifiers is missing', () => {
+            const callback = vi.fn();
+            const subscription = service.listen('Alt+Shift+KeyA', callback);
+            keyEvent('keydown', 'AltLeft', { altKey: true });
+            keyEvent('keydown', 'KeyA', { altKey: true });
+            keyEvent('keyup', 'KeyA', { altKey: true });
+            keyEvent('keyup', 'AltLeft');
+            expect(callback).not.toHaveBeenCalled();
+            subscription?.unsubscribe();
+        });
+    });
+
+    describe('dialogs', () => {
+        const press = (code: string) => {
+            keyEvent('keydown', code);
+            keyEvent('keyup', code);
+        };
+
+        it('ignores page hotkeys while a dialog is open', () => {
+            const callback = vi.fn();
+            const subscription = service.listen(['KeyE'], callback);
+            const dialog = openDialog();
+            press('KeyE');
+            expect(callback).not.toHaveBeenCalled();
+            open_dialogs.splice(open_dialogs.indexOf(dialog), 1);
+            press('KeyE');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
+
+        it('fires hotkeys registered by the top dialog only', () => {
+            openDialog();
+            const first = vi.fn();
+            const first_sub = service.listen(['KeyS'], first);
+            press('KeyS');
+            expect(first).toHaveBeenCalledTimes(1);
+            const nested = openDialog();
+            const second = vi.fn();
+            const second_sub = service.listen(['KeyS'], second);
+            press('KeyS');
+            expect(first).toHaveBeenCalledTimes(1);
+            expect(second).toHaveBeenCalledTimes(1);
+            second_sub?.unsubscribe();
+            open_dialogs.splice(open_dialogs.indexOf(nested), 1);
+            press('KeyS');
+            expect(first).toHaveBeenCalledTimes(2);
+            first_sub?.unsubscribe();
+        });
+
+        it('treats a listener registered during a dialog close as page level', () => {
+            const dialog = {
+                state: MatDialogState.CLOSING,
+                getState() {
+                    return this.state;
+                },
+            };
+            open_dialogs.push(dialog);
+            const callback = vi.fn();
+            const subscription = service.listen(['KeyK'], callback);
+            open_dialogs.splice(0, 1);
+            press('KeyK');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
+    });
+
     describe('multiple subscriptions', () => {
         it('should allow multiple subscriptions to different combinations', () => {
             const callback1 = vi.fn();
diff --git a/src/tests/common/validation.spec.ts b/src/tests/common/validation.spec.ts
index 99f9cb112..f108cca7a 100644
--- a/src/tests/common/validation.spec.ts
+++ b/src/tests/common/validation.spec.ts
@@ -106,14 +106,12 @@ describe('validation.ts utilities', () => {
                 expect(validateURI(ctrl)).toBeNull();
             });
 
-            it('should accept mailto:user@example.com', () => {
-                const ctrl = { value: 'mailto:user@example.com' };
-                expect(validateURI(ctrl)).toBeNull();
-            });
-
-            it('should accept custom:scheme', () => {
-                const ctrl = { value: 'custom:scheme' };
-                expect(validateURI(ctrl)).toBeNull();
+            it.each([
+                'wss://example.com/socket',
+                'udp://192.168.1.1:161',
+                'https://192.168.1.1:8443/api',
+            ])('should accept %s', (value) => {
+                expect(validateURI({ value })).toBeNull();
             });
         });
 
@@ -127,6 +125,30 @@ describe('validation.ts utilities', () => {
                 const ctrl = { value: '/path/to/file' };
                 expect(validateURI(ctrl)).toEqual({ pattern: true });
             });
+
+            it.each([
+                '192.168.1.1:80',
+                'example.com:8080',
+                'localhost:80',
+                'mailto:user@example.com',
+                'custom:scheme',
+                'http://',
+                'http://example.com/a b',
+            ])('should reject malformed URI %s', (value) => {
+                expect(validateURI({ value })).toEqual({ pattern: true });
+            });
+
+            it.each([
+                'javascript:alert(1)',
+                'javascript://%0aalert(1)',
+                'data://text/html,x',
+                ' JavaScript://%0aalert(1)',
+                'vbscript:msgbox(1)',
+                'data:text/html,<script>alert(1)</script>',
+                'text before javascript:alert(1)',
+            ])('should reject script URI %s', (value) => {
+                expect(validateURI({ value })).toEqual({ pattern: true });
+            });
         });
 
         describe('edge cases', () => {
diff --git a/src/tests/drivers/driver-form-schema.spec.ts b/src/tests/drivers/driver-form-schema.spec.ts
index ff5e0e219..988bee278 100644
--- a/src/tests/drivers/driver-form-schema.spec.ts
+++ b/src/tests/drivers/driver-form-schema.spec.ts
@@ -44,4 +44,19 @@ describe('driver form validation', () => {
             expect(fields().valid()).toBe(true);
         },
     );
+
+    it('rejects a default URI without a scheme', () => {
+        const { fields } = createTestForm(
+            {
+                ...generateDriverFormModel(),
+                name: 'Display',
+                module_name: 'Display',
+                default_uri: 'example.com:8080',
+            },
+            applyDriverFormSchema,
+        );
+        expect(fields.default_uri().invalid()).toBe(true);
+        fields.default_uri().value.set('https://example.com:8080');
+        expect(fields().valid()).toBe(true);
+    });
 });
diff --git a/src/tests/modules/module-form-schema.spec.ts b/src/tests/modules/module-form-schema.spec.ts
index d9a3b1fe0..5b3fe2f48 100644
--- a/src/tests/modules/module-form-schema.spec.ts
+++ b/src/tests/modules/module-form-schema.spec.ts
@@ -47,11 +47,26 @@ describe('module form validation', () => {
             expect(fields.uri().invalid()).toBe(true);
             fields.uri().value.set('https://service.example.com');
             expect(fields().valid()).toBe(true);
-            fields.uri().value.set('invalid');
+            fields.uri().value.set('service.example.com:443');
             expect(fields.uri().invalid()).toBe(true);
         },
     );
 
+    it('ignores the hidden URI field for device modules', () => {
+        const { fields } = createTestForm(
+            {
+                ...generateModuleFormModel(),
+                role: PlaceDriverRole.Device,
+                driver_id: 'driver-1',
+                ip: '192.168.1.10',
+                port: 80,
+                uri: '192.168.1.10:80',
+            },
+            applyModuleFormSchema,
+        );
+        expect(fields().valid()).toBe(true);
+    });
+
     it('revalidates connection requirements when switching from device to logic', () => {
         const { fields, model } = createTestForm(
             {
diff --git a/src/tests/repositories/repositories.utilities.spec.ts b/src/tests/repositories/repositories.utilities.spec.ts
index ded337952..7f1801dea 100644
--- a/src/tests/repositories/repositories.utilities.spec.ts
+++ b/src/tests/repositories/repositories.utilities.spec.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it, vi } from 'vitest';
-import { generateRepositoryFormModel } from '../../app/repositories/repositories.utilities';
+import {
+    generateRepositoryFormModel,
+    maskUriCredentials,
+} from '../../app/repositories/repositories.utilities';
 
 const mocks = vi.hoisted(() => ({
     PlaceRepositoryType: {
@@ -57,4 +60,26 @@ describe('repositories.utilities', () => {
             });
         });
     });
+
+    describe('maskUriCredentials', () => {
+        it('removes a username and password with special characters', () => {
+            expect(
+                maskUriCredentials(
+                    'https://my_user+1:p%40ss_w%2Bd@github.com/org/repo.git',
+                ),
+            ).toBe('https://github.com/org/repo.git');
+        });
+
+        it('keeps a URI without credentials', () => {
+            expect(maskUriCredentials('https://github.com/org/repo')).toBe(
+                'https://github.com/org/repo',
+            );
+        });
+
+        it('removes credentials from a URI that does not parse', () => {
+            expect(maskUriCredentials('//user:pass@host/repo')).toBe(
+                '//host/repo',
+            );
+        });
+    });
 });
diff --git a/src/tests/ui/components/settings-form.component.spec.ts b/src/tests/ui/components/settings-form.component.spec.ts
new file mode 100644
index 000000000..37a8545bc
--- /dev/null
+++ b/src/tests/ui/components/settings-form.component.spec.ts
@@ -0,0 +1,107 @@
+import { provideZonelessChangeDetection, signal } from '@angular/core';
+import { TestBed } from '@angular/core/testing';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+    updateSettings: vi.fn(),
+    addSettings: vi.fn(),
+    notifyError: vi.fn(),
+    user: { sys_admin: true, support: true },
+}));
+
+vi.mock('../../../app/common/notifications', () => ({
+    notifyError: mocks.notifyError,
+    notifySuccess: vi.fn(),
+}));
+
+vi.mock('@placeos/ts-client', () => ({
+    EncryptionLevel: { None: 0, Support: 1, Admin: 2, NeverDisplay: 3 },
+    PlaceSettings: class {
+        constructor(data: Record<string, unknown> = {}) {
+            Object.assign(this, { keys: [], settings_string: '', ...data });
+        }
+    },
+    PlaceUser: class {},
+    updateSettings: mocks.updateSettings,
+    addSettings: mocks.addSettings,
+}));
+
+vi.mock('../../../app/users/users.service', () => ({
+    BackofficeUsersService: class {
+        public currentSignal() {
+            return signal(mocks.user);
+        }
+    },
+}));
+
+import { PlaceSettings } from '@placeos/ts-client';
+import { SettingsFormComponent } from '../../../app/ui/forms/settings-form.component';
+import { BackofficeUsersService } from '../../../app/users/users.service';
+
+const MASK = '<COMMON.SETTINGS_MASKED>';
+
+function createForm() {
+    const component = TestBed.runInInjectionContext(
+        () => new SettingsFormComponent(),
+    );
+    component.settings.set(
+        [0, 1, 2, 3].map(
+            (level) =>
+                new PlaceSettings({
+                    id: `settings-${level}`,
+                    encryption_level: level,
+                    settings_string: `level${level}: value`,
+                    keys: [`level${level}`],
+                } as never),
+        ) as never,
+    );
+    TestBed.tick();
+    return component;
+}
+
+describe('SettingsFormComponent', () => {
+    beforeEach(() => {
+        mocks.user = { sys_admin: true, support: true };
+        mocks.updateSettings.mockReset();
+        mocks.notifyError.mockReset();
+        mocks.updateSettings.mockImplementation((id, details) =>
+            Promise.resolve(details),
+        );
+        TestBed.configureTestingModule({
+            providers: [
+                provideZonelessChangeDetection(),
+                BackofficeUsersService,
+            ],
+        });
+    });
+
+    it('saves only the changed levels', () => {
+        const component = createForm();
+        component.updateSetting(0, 'level0: changed');
+        component.saveAll();
+        expect(mocks.updateSettings).toHaveBeenCalledTimes(1);
+        expect(mocks.updateSettings).toHaveBeenCalledWith(
+            'settings-0',
+            expect.objectContaining({ settings_string: 'level0: changed' }),
+        );
+    });
+
+    it('never saves masked encrypted settings', () => {
+        const component = createForm();
+        expect(component.settingValue(3)).toContain(MASK);
+        component.updateSetting(3, `${component.settingValue(3)}new: key\n`);
+        component.saveAll();
+        component.save(3);
+        expect(mocks.updateSettings).not.toHaveBeenCalled();
+        expect(mocks.notifyError).toHaveBeenCalledWith(
+            'COMMON.SETTINGS_MASKED_ERROR',
+        );
+    });
+
+    it('masks admin settings for support users', () => {
+        mocks.user = { sys_admin: false, support: true };
+        const component = createForm();
+        expect(component.settingValue(1)).toBe('level1: value');
+        expect(component.settingValue(2)).toContain(MASK);
+    });
+});
diff --git a/src/tests/ui/custom-fields/item-search-field.component.spec.ts b/src/tests/ui/custom-fields/item-search-field.component.spec.ts
index b0fe67e65..7d30a3ace 100644
--- a/src/tests/ui/custom-fields/item-search-field.component.spec.ts
+++ b/src/tests/ui/custom-fields/item-search-field.component.spec.ts
@@ -1,6 +1,11 @@
-import { Component, provideZonelessChangeDetection, signal } from '@angular/core';
-import { form, FormField } from '@angular/forms/signals';
+import {
+    Component,
+    provideZonelessChangeDetection,
+    signal,
+} from '@angular/core';
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { form, FormField } from '@angular/forms/signals';
+import { PlaceModule } from '@placeos/ts-client';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { ItemSearchFieldComponent } from '../../../app/ui/custom-fields/item-search-field.component';
 
@@ -60,4 +65,25 @@ describe('ItemSearchFieldComponent', () => {
         fixture.detectChanges();
         expect(inputValue()).toBe('Late System');
     });
+
+    it('should escape item names in option labels', async () => {
+        const field = TestBed.createComponent(ItemSearchFieldComponent);
+        const mod = Object.assign(new PlaceModule(), {
+            id: 'mod-1',
+            name: '<img src=x>',
+            role: 2,
+            uri: 'https://a.com/<b>',
+        });
+        field.componentRef.setInput('options', [
+            mod,
+            { id: 'sys-1', name: '' },
+        ]);
+        field.detectChanges();
+        await sleep(50);
+        const names = field.componentInstance.item_name();
+        expect(names['mod-1']).toBe(
+            '&lt;img src=x&gt; <span class="small">https://a.com/&lt;b&gt;</span>',
+        );
+        expect(names['sys-1']).toBe('&lt;Unnamed&gt;');
+    });
 });
diff --git a/src/tests/users/user-lifecycle.spec.ts b/src/tests/users/user-lifecycle.spec.ts
index 461891274..76f6b7138 100644
--- a/src/tests/users/user-lifecycle.spec.ts
+++ b/src/tests/users/user-lifecycle.spec.ts
@@ -39,7 +39,10 @@ vi.mock('../../app/common/hotkeys.service', () => ({
 vi.mock('../../app/common/settings.service', () => ({
     SettingsService: class {},
 }));
-vi.mock('../../app/common/general', () => ({ log: vi.fn() }));
+vi.mock('../../app/common/general', async () => ({
+    ...(await vi.importActual('../../app/common/general')),
+    log: vi.fn(),
+}));
 vi.mock('../../app/common/notifications', () => ({
     notifyError: vi.fn(),
     notifySuccess: vi.fn(),