Security, errors, lifecycle limitations and troubleshooting
Protect secure tokens, files and signature evidence; resolve access, form, upload, email, session and uninstall issues.
Guides in this workflow
Follow the guide that matches the exact action, filter, menu change or issue.
Protect secure brief tokens
Treat recipient links as credentials and do not publish them.
Protect uploaded files
Use module download actions and server protections rather than direct public file URLs.
Protect signature evidence
Restrict signature data, IP, user-agent and hashes to authorised staff.
Understand CSRF handling
Autosave/upload/submit responses refresh CSRF values for subsequent browser requests.
Understand the JSON login-redirect guard
Only the module top-bar and status-autosave JSON endpoints return the custom unauthenticated 401 behaviour.
Resolve an invalid or expired-looking secure link
Verify the exact stored token and request state; the module uses secure tokens but does not implement a documented time-based token expiry control.
Resolve request not found
Check deletion, ID/token correctness and customer ownership.
Resolve administrator permission errors
Grant only the required View/Create/Edit/Delete capability and core customer access.
Resolve template save errors
Check system protection, slug rules, duplicate/in-use status and valid JSON.
Resolve autosave errors
Check token, CSRF, network response, server logs and answer payload.
Resolve upload errors
Check extension, PHP/server size limits, writable request folder and file integrity.
Resolve submission errors
Check typed name, PNG signature payload, consent and all current answers.
Resolve invite/reminder/status email errors
Check SMTP, valid recipient and configured sender/admin email.
Resolve Companies House lookup errors
Continue with manual company information where the assistance endpoint cannot return a result.
Understand reminder automation limits
The supplied module installs reminder-days configuration and manual reminder actions; no dedicated module cron hook is present in the entry file.
Understand integration limits
The supplied module has no dedicated outbound webhook or public API management interface.
Understand permanent request deletion
Delete is a destructive administrator action, not an archive status.
Prepare for uninstall
Export required briefs and signature evidence because the supplied signature table is dropped even when general keep-data is enabled.
Understand excluded archive artefacts
Bundled sample uploads, signatures, audit/fix reports and development snapshots are not product features and are excluded from user guidance.
Run a full production verification
Test linked and standalone requests, public intake, Companies House, every brief type, autosave, upload, signature, emails, status, client portal, exports and permissions.