Security, errors, lifecycle limitations and troubleshooting

Client Discovery & Project Briefing Portal

Protect secure brief tokens

Treat recipient links as credentials and do not publish them.

Protect uploaded files

Use module download actions and server protections rather than direct public file URLs.

Protect signature evidence

Restrict signature data, IP, user-agent and hashes to authorised staff.

Understand CSRF handling

Autosave/upload/submit responses refresh CSRF values for subsequent browser requests.

Understand the JSON login-redirect guard

Only the module top-bar and status-autosave JSON endpoints return the custom unauthenticated 401 behaviour.

Resolve an invalid or expired-looking secure link

Verify the exact stored token and request state; the module uses secure tokens but does not implement a documented time-based token expiry control.

Resolve request not found

Check deletion, ID/token correctness and customer ownership.

Resolve administrator permission errors

Grant only the required View/Create/Edit/Delete capability and core customer access.

Resolve template save errors

Check system protection, slug rules, duplicate/in-use status and valid JSON.

Resolve autosave errors

Check token, CSRF, network response, server logs and answer payload.

Resolve upload errors

Check extension, PHP/server size limits, writable request folder and file integrity.

Resolve submission errors

Check typed name, PNG signature payload, consent and all current answers.

Resolve invite/reminder/status email errors

Check SMTP, valid recipient and configured sender/admin email.

Resolve Companies House lookup errors

Continue with manual company information where the assistance endpoint cannot return a result.

Understand reminder automation limits

The supplied module installs reminder-days configuration and manual reminder actions; no dedicated module cron hook is present in the entry file.

Understand integration limits

The supplied module has no dedicated outbound webhook or public API management interface.

Understand permanent request deletion

Delete is a destructive administrator action, not an archive status.

Prepare for uninstall

Export required briefs and signature evidence because the supplied signature table is dropped even when general keep-data is enabled.

Understand excluded archive artefacts

Bundled sample uploads, signatures, audit/fix reports and development snapshots are not product features and are excluded from user guidance.

Run a full production verification

Test linked and standalone requests, public intake, Companies House, every brief type, autosave, upload, signature, emails, status, client portal, exports and permissions.