@@ -50,7 +50,7 @@ Each was decided, and in most cases built and reverted. If you want to change on
 - **Collab session helpers.** Auth and disconnect predicates live in `apps/webapp/src/hooks/collabSession.ts`. Do not rewrite `HocuspocusProvider` construction. Do not re-export those helpers from `@utils`.
 - **Report route storage.** The Report action posts to the published contact address in `LEGAL_CONTACT_EMAIL` and keeps nothing. That was the deliberate scope, taken 2026-09-06 with the launch-legal review. Build storage or triage tooling only when real report volume shows it is needed, and bring the count rather than a design. One canonical home, `apps/webapp/src/utils/reportContent.ts` — do not add a second report path. Document report is a Settings row for signed-in users on a pad (`/[...slugs]`). Hide it on Home. Do not restore a pad-title control. The chat message Report row stays at `display: false`. Contract in [apps/webapp/CLAUDE.md](apps/webapp/CLAUDE.md) §Report Route.
 - **Passkeys are off.** Removed 2026-09-07. No sign-in button, no Conditional UI, no Settings card, no `auth.experimental.passkey`. Local `[auth.passkey] enabled = false`. Sign-in is Google or an email link. Do not rebuild the client. A production dashboard toggle that is still on does not restore the UI.
-- **Next product APIs.** Health stays on Next. Validate lives on the email router as `POST /api/email/validate`. Status does not become a Hono route. Confirm is deleted and stays deleted. Leave `apps/webapp/src/utils/supabase/api.ts`. Do not edit `src/proxy.ts`, Next health rewrites, Traefik, or Docker HEALTHCHECK. Names live in `CONTEXT.md` §Product HTTP.
+- **Next product APIs.** Health stays on Next. Validate lives on the email router as `POST /api/email/validate`. Status does not become a Hono route. Confirm is deleted and stays deleted. Leave `apps/webapp/src/utils/supabase/api.ts`. Do not change the Health and API routing in `src/proxy.ts`, Next health rewrites, Traefik, or Docker HEALTHCHECK. Two other `src/proxy.ts` edits are approved: #411 forwards only `error_code` to `/auth/error`, and #442 makes the `new.` host mint its slug with `randomDocumentSlug()`. Any other `src/proxy.ts` edit needs a maintainer ruling. Names live in `CONTEXT.md` §Product HTTP.
 - **History restore is signed-in only.** Visitors may read history. They never see Restore. Do not replace the hidden control with a sign-in toast on the same button. Server refusal is `unauthorized` / `read-only`. See webapp §Document Version History and `CONTEXT.md` §Document access.
 - **Chat send animation.** An iMessage-style send flight was built and reverted at maintainer request on 2026-09-21, and #263 closed with motion rejected. Own sends show only the static pending clock. Do not rebuild any send motion unless the maintainer asks. See [apps/webapp/src/components/chatroom/CLAUDE.md](apps/webapp/src/components/chatroom/CLAUDE.md).
 - **Phone mic is hold-only.** A tap shows a hint and never sends; release sends the note, alone, once its upload is ready. Maintainer ruling, 2026-09-22. Do not add tap-to-record on a phone. Rules and reasons in [apps/webapp/src/components/chatroom/CLAUDE.md](apps/webapp/src/components/chatroom/CLAUDE.md).
 
@@ -545,6 +545,20 @@ plus the house order in [`RELEASE_POLICY.md`](../../RELEASE_POLICY.md).
 - **A notification click opens same-origin URLs only.** The service worker
   opens `/` for any other `action_url`
   ([#417](https://github.com/docs-plus/docs.plus/issues/417)).
+- **A live chat message takes its author's avatar from the profile, not from
+  presence.** Any client can send a presence payload. A forged one could change
+  the avatar on another user's live messages, and the name and avatar in the
+  media viewer. Both now read the profile. One request serves every
+  message by that author
+  ([#428](https://github.com/docs-plus/docs.plus/issues/428)).
+- **A paste or a channel row can no longer crash a document page.** Pasted
+  HTML never creates an upload placeholder, and an unknown file type shows the
+  image icon. The heading unread sync escapes each channel id before it builds
+  a selector ([#436](https://github.com/docs-plus/docs.plus/issues/436)).
+- **A new document link comes from a cryptographic random source.** `/new`,
+  the `new.` host, the home page and shared files make an 11-character link
+  that nobody can predict and claim first
+  ([#442](https://github.com/docs-plus/docs.plus/issues/442)).
 
 ### Removed
 
 
@@ -56,4 +56,21 @@ describe('Standard Paste (Flat Schema)', () => {
     cy.get('h2[data-toc-id]').should('contain', 'My Heading')
     cy.get('.docy_editor .tiptap.ProseMirror p').should('contain', 'Plain paragraph text')
   })
+
+  it('should not create an upload placeholder from pasted HTML', () => {
+    cy.clearEditor()
+    cy.get('.docy_editor > .tiptap.ProseMirror').type('Paste Target{enter}')
+
+    cy.pasteWithMimeTypes({
+      'text/html':
+        '<div data-type="media-upload-placeholder" filetype="constructor"></div><p>after</p>',
+      'text/plain': 'after'
+    })
+
+    cy.get('.docy_editor .tiptap.ProseMirror p').should('contain', 'after')
+    cy.get('.media-upload-placeholder').should('not.exist')
+
+    cy.get('.docy_editor > .tiptap.ProseMirror').type(' still typing')
+    cy.get('.docy_editor .tiptap.ProseMirror').should('contain', 'still typing')
+  })
 })
@@ -44,6 +44,7 @@ const MediaUploadPlaceholderComponent: React.FC<NodeViewProps> = ({ node, delete
 
 // The node type stays registered so stored docs containing zombie placeholders
 // from past sessions remain valid under enableContentCheck; nothing inserts it anymore.
+// It has no parseHTML, so a paste can never create it.
 export default Node.create({
   name: 'mediaUploadPlaceholder',
   group: 'block',
@@ -61,10 +62,6 @@ export default Node.create({
     }
   },
 
-  parseHTML() {
-    return [{ tag: 'div[data-type="media-upload-placeholder"]' }]
-  },
-
   renderHTML({ HTMLAttributes }) {
     return ['div', mergeAttributes(HTMLAttributes, { 'data-type': 'media-upload-placeholder' })]
   },
 
@@ -16,7 +16,7 @@ const FileTypeIcon: React.FC<{ fileType: FileType }> = ({ fileType }) => {
     audio: HiOutlineMusicalNote,
     image: HiOutlinePhoto
   }
-  const IconComponent = icons[fileType] || icons.image
+  const IconComponent = Object.hasOwn(icons, fileType) ? icons[fileType] : icons.image
   return <IconComponent className={ICON_CLASS} />
 }
 
 
@@ -1,5 +1,6 @@
+import { getUserProfileForModal } from '@api'
 import type { MessageRowUserDetails } from '@components/chatroom/types/chat-items'
-import { useStore } from '@stores'
+import { useQuery } from '@tanstack/react-query'
 import type { TGroupedMsgRow } from '@types'
 import { useMemo } from 'react'
 
@@ -20,29 +21,39 @@ const toMessageAuthorDetails = (
   avatar_updated_at: raw.avatar_updated_at ?? null
 })
 
-/** Realtime `messages` rows omit `user_details`; fall back to workspace presence profile. */
+const fetchMessageAuthor = async (userId: string): Promise<MessageRowUserDetails> => {
+  const { data, error } = await getUserProfileForModal(userId)
+  if (error) throw error
+  return toMessageAuthorDetails(userId, data)
+}
+
+/**
+ * Realtime rows omit `user_details`, so load the author's public profile.
+ * Never use presence here, because any client can forge a presence payload.
+ */
 export const useMessageAuthorDetails = (message: TGroupedMsgRow): MessageRowUserDetails | null => {
-  const presenceProfile = useStore((state) =>
-    message.user_id ? state.usersPresence.get(message.user_id) : undefined
-  )
+  const userId = message.user_id
+  const { data: profile } = useQuery({
+    queryKey: ['chat-author', userId],
+    queryFn: () => fetchMessageAuthor(userId),
+    enabled: !message.user_details?.id && !!userId,
+    staleTime: Infinity,
+    // A missing user row stays missing, so a retry only delays the id-only avatar.
+    retry: false
+  })
 
   return useMemo((): MessageRowUserDetails | null => {
     const ud = message.user_details
     if (ud?.id) return toMessageAuthorDetails(ud.id, ud)
-
-    const userId = message.user_id
     if (!userId) return null
+    if (profile) return profile
 
-    if (!presenceProfile) {
-      return {
-        id: userId,
-        username: null,
-        fullname: null,
-        avatar_url: null,
-        avatar_updated_at: null
-      }
+    return {
+      id: userId,
+      username: null,
+      fullname: null,
+      avatar_url: null,
+      avatar_updated_at: null
     }
-
-    return toMessageAuthorDetails(userId, presenceProfile)
-  }, [message.user_details, message.user_id, presenceProfile])
+  }, [message.user_details, userId, profile])
 }
@@ -5,8 +5,8 @@ import type { MessageStatus } from '../../../types/message'
 /**
  * Author profile inlined by fetch_message_window / fetch_messages_since via
  * user_details_json(u). Optional because base-table inserts and realtime
- * `postgres_changes` payloads do not carry it; consumers must fall back to
- * the auth store for those rows.
+ * `postgres_changes` payloads do not carry it. For those rows,
+ * `useMessageAuthorDetails` loads the author's public profile.
  */
 export type MessageRowUserDetails = {
   id: string
 
@@ -1,4 +1,5 @@
 import { logger } from '@utils/logger'
+import { randomDocumentSlug } from '@utils/sanitizeDocumentSlug'
 import { type NextRequest, NextResponse } from 'next/server'
 
 /** Runs on the Edge Runtime — keep it lightweight and free of Node-only APIs. */
@@ -10,7 +11,7 @@ export async function proxy(request: NextRequest) {
   // new.{domain} → a fresh random document, mirrored by the /new page route.
   const hostname = request.headers.get('host') || ''
   if (hostname.startsWith('new.')) {
-    const randomSlug = (Math.random() + 1).toString(36).substring(2)
+    const randomSlug = randomDocumentSlug()
     const mainHost = hostname.replace(/^new\./, '')
     return NextResponse.redirect(`${request.nextUrl.protocol}//${mainHost}/${randomSlug}`, 307)
   }
 
@@ -38,7 +38,9 @@ export function syncHeadingWidgetUnread(): void {
     })
 
   source.channels.forEach((_channel, channelId) => {
-    const headingEl = document.querySelector<HTMLElement>(`[data-toc-id="${channelId}"]`)
+    const headingEl = document.querySelector<HTMLElement>(
+      `[data-toc-id="${CSS.escape(channelId)}"]`
+    )
     if (!headingEl) return
     const el = headingEl.querySelector<HTMLElement>(
       `${headingChatBtnSelector}:not([data-heading-id])`
 
@@ -4,9 +4,22 @@ import { isReservedSlug } from './reservedSlugs'
 
 const MIN_SLUG_LENGTH = 3
 const MAX_SLUG_LENGTH = 30
+const SLUG_ALPHABET = '0123456789abcdefghijklmnopqrstuvwxyz'
+const RANDOM_SLUG_LENGTH = 11
+// 252 is 36 x 7. A byte at or above it would favour the start of the alphabet.
+const UNBIASED_BYTE_LIMIT = 252
 
+/** The first signed-in edit owns a new document, so its slug must not be guessable. */
 export function randomDocumentSlug(): string {
-  return (Math.random() + 1).toString(36).substring(2)
+  let slug = ''
+  while (slug.length < RANDOM_SLUG_LENGTH) {
+    for (const byte of crypto.getRandomValues(new Uint8Array(16))) {
+      if (byte < UNBIASED_BYTE_LIMIT && slug.length < RANDOM_SLUG_LENGTH) {
+        slug += SLUG_ALPHABET[byte % SLUG_ALPHABET.length]
+      }
+    }
+  }
+  return slug
 }
 
 export function sanitizeDocumentSlug(input?: string): string {
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ const FileTypeIcon: React.FC<{ fileType: FileType }> = ({ fileType }) => {`
`16`	`16`	`audio: HiOutlineMusicalNote,`
`17`	`17`	`image: HiOutlinePhoto`
`18`	`18`	`}`
`19`		`- const IconComponent = icons[fileType] \|\| icons.image`
	`19`	`+ const IconComponent = Object.hasOwn(icons, fileType) ? icons[fileType] : icons.image`
`20`	`20`	`return <IconComponent className={ICON_CLASS} />`
`21`	`21`	`}`
`22`	`22`