diff --git a/.gitignore b/.gitignore
index c4118dd..56980d4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,8 @@
 uploads/*
 *.log
 .env
+.agents/*
+.antigravity/*
+.vscode/*
+.gemini/*
+.cursor/*
diff --git a/index.php b/index.php
index 01c10db..36f4f0d 100644
--- a/index.php
+++ b/index.php
@@ -96,14 +96,23 @@ if ($action === 'api') {
         if(!isset($_SESSION['user_id'])) die(json_encode(['status'=>'error','msg'=>'unauthorized']));
         $comment_id = $_POST['comment_id'] ?? null;
         if($comment_id) {
-            $stmt = $pdo->prepare("DELETE FROM task_comments WHERE id = ?");
-            $stmt->execute([$comment_id]);
+            $user_id = $_SESSION['user_id'];
+            $is_admin = !empty($_SESSION['is_admin']);
+            $comment_check = query("SELECT created_by FROM task_comments WHERE id = ?", [$comment_id])->fetch();
+            if($comment_check && ($comment_check['created_by'] == $user_id || $is_admin)) {
+                $stmt = $pdo->prepare("DELETE FROM task_comments WHERE id = ?");
+                $stmt->execute([$comment_id]);
+            } else {
+                echo json_encode(['status'=>'error','msg'=>'forbidden']);
+                exit;
+            }
         }
         echo json_encode(['status'=>'ok']);
         exit;
     }
 
     if($api_action === 'get_tasks_status') {
+        if(!isset($_SESSION['user_id'])) die(json_encode(['status'=>'error','msg'=>'unauthorized']));
         $task_id = $_GET['task_id'] ?? null;
 
         // Correlated subquery gives attachment count per task.
diff --git a/views/dashboard.php b/views/dashboard.php
index eba04a5..6bf7fc1 100644
--- a/views/dashboard.php
+++ b/views/dashboard.php
@@ -17,7 +17,7 @@ try {
 // ── Task Counts ───────────────────────────────────────────────────────────────
 $user_groups   = get_user_groups($user_id);
 $my_group_ids  = array_column($user_groups, 'id');
-$group_in      = implode(',', array_fill(0, max(count($my_group_ids), 1), '?')) ?: '0';
+$group_in      = $my_group_ids ? implode(',', array_fill(0, count($my_group_ids), '?')) : '0';
 $params_tasks  = array_merge([$user_id, $user_id], $my_group_ids, $my_group_ids, [$user_id]);
 $sql_tasks = "SELECT status, COUNT(*) as cnt FROM tasks WHERE
     (assignee_type='user'  AND assignee_id=?)
diff --git a/views/tasks.php b/views/tasks.php
index e0f6167..6975809 100644
--- a/views/tasks.php
+++ b/views/tasks.php
@@ -155,7 +155,7 @@ if($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_task'])) {
     }
 
     // Handle notifications
-    $ctx = ['action' => 'Created', 'module' => 'Task', 'item' => $title, 'assignor' => $_SESSION['username'] ?? 'System', 'due_date' => $due_date ?: 'None'];
+    $ctx = ['action' => 'Created', 'module' => 'Task', 'item' => $title, 'assignor' => $current_user['username'] ?? 'System', 'due_date' => $due_date ?: 'None'];
     foreach($to_list as $rec) {
         $u = query("SELECT id FROM users WHERE username=?", [$rec])->fetch();
         if($u) notify_user($u['id'], "You have been assigned a new task: $title", $ctx);
@@ -463,7 +463,7 @@ body.dark-mode .kanban-task { border: 1px solid rgba(255,255,255,0.05); border-l
             <span id="att-lightbox-title">Preview</span>
             <button id="att-lightbox-close" onclick="closeAttachmentPreview()" title="Close">✕</button>
         </div>
-        <div id="att-lightbox-body" id="att-lightbox-body"></div>
+        <div id="att-lightbox-body"></div>
     </div>
 </div>