Inline CSS is considered a security flaw. It's still used, but should be avoided.

We should move all inline CSS to style.css.

The aim is that we can implement a Content Security Policy without the need to inclide unsafe-inline, under the style-src directive.

match.js doesn't run in IE and Edge.

I believe this is due to JQuery variables.

Inline JavaScript is considered a security flaw. It's still heavily used, but should be avoided.

We should move all inline JavaScript to custom.js.

The aim is that we can implement a Content Security Policy without the need to inclide unsafe-inline, under the script-src directive.

Currently, we're identifying our Models with auto-incrementing integers as their primary key.

With this, it's possible (easy, in fact) to deduce the IDs of other Models.

For Example: "If I'm User with ID 2, there is probably also a User with ID 1, and 3, and so on."

A solution is to switch to UUIDs.