diff --git a/app/Http/Controllers/Api/TransactionController.php b/app/Http/Controllers/Api/TransactionController.php
index 9e598876..0c1723ae 100644
--- a/app/Http/Controllers/Api/TransactionController.php
+++ b/app/Http/Controllers/Api/TransactionController.php
@@ -112,11 +112,14 @@ class TransactionController extends Controller
             abort(403, 'Some transactions do not belong to the authenticated user.');
         }
 
+        $userId = $request->user()->id;
+
         foreach ($validated['transactions'] as $data) {
             $updateData = collect($data)->except('id')->toArray();
 
             Transaction::query()
                 ->where('id', $data['id'])
+                ->where('user_id', $userId)
                 ->toBase()
                 ->update($updateData);
         }
diff --git a/app/Http/Controllers/OpenBanking/AuthorizationController.php b/app/Http/Controllers/OpenBanking/AuthorizationController.php
index 5d715d8d..be103445 100644
--- a/app/Http/Controllers/OpenBanking/AuthorizationController.php
+++ b/app/Http/Controllers/OpenBanking/AuthorizationController.php
@@ -210,6 +210,10 @@ class AuthorizationController extends Controller
         } catch (\Throwable $e) {
             Log::error('EnableBanking session creation failed', ['error' => $e->getMessage()]);
 
+            if ($connection) {
+                $connection->update(['state_token' => null]);
+            }
+
             return $this->finishRedirect($errorRedirectRoute, $errorRedirectParams, 'error', 'Failed to connect to your bank. Please try again.');
         }
 
diff --git a/app/Http/Controllers/Sync/TransactionSyncController.php b/app/Http/Controllers/Sync/TransactionSyncController.php
index 448fe8eb..677f392c 100644
--- a/app/Http/Controllers/Sync/TransactionSyncController.php
+++ b/app/Http/Controllers/Sync/TransactionSyncController.php
@@ -15,21 +15,27 @@ class TransactionSyncController extends Controller
      */
     public function index(Request $request): JsonResponse
     {
+        $validated = $request->validate([
+            'since' => ['nullable', 'date'],
+        ]);
+
         $query = Transaction::query()
             ->where('user_id', $request->user()->id);
 
-        if ($request->has('since')) {
-            $query->where('updated_at', '>', $request->input('since'));
+        if ($validated['since'] ?? null) {
+            $query->where('updated_at', '>', $validated['since']);
         }
 
         $transactions = $query
             ->with('labels')
             ->orderBy('transaction_date', 'desc')
             ->orderBy('updated_at', 'desc')
+            ->limit(500)
             ->get();
 
         return response()->json([
             'data' => $transactions,
+            'has_more' => $transactions->count() === 500,
         ]);
     }
 }
diff --git a/bootstrap/app.php b/bootstrap/app.php
index c04f75df..404e9296 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -30,8 +30,10 @@ return Application::configure(basePath: dirname(__DIR__))
 
         $middleware->encryptCookies(except: ['appearance', 'sidebar_state', 'chart-color-scheme']);
 
+        $trustedProxies = env('TRUSTED_PROXIES');
+
         $middleware->trustProxies(
-            at: '*',
+            at: is_string($trustedProxies) ? explode(',', $trustedProxies) : null,
             headers: Request::HEADER_X_FORWARDED_FOR
                 | Request::HEADER_X_FORWARDED_HOST
                 | Request::HEADER_X_FORWARDED_PORT
diff --git a/resources/views/app.blade.php b/resources/views/app.blade.php
index 3e0de6ce..025d9edb 100644
--- a/resources/views/app.blade.php
+++ b/resources/views/app.blade.php
@@ -10,7 +10,7 @@
         {{-- Inline script to detect system dark mode preference and apply it immediately --}}
         <script>
             (function() {
-                const appearance = '{{ $appearance ?? "system" }}';
+                const appearance = @json($appearance ?? 'system');
 
                 if (appearance === 'system') {
                     const prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -20,7 +20,7 @@
                     }
                 }
 
-                var chartScheme = '{{ $chartColorScheme ?? "colorful" }}';
+                var chartScheme = @json($chartColorScheme ?? 'colorful');
 
                 try {
                     chartScheme = localStorage.getItem('chart-color-scheme') || chartScheme;
diff --git a/routes/api.php b/routes/api.php
index f26cbb74..959fc34d 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -13,7 +13,7 @@ use App\Http\Controllers\EncryptionController;
 use App\Http\Controllers\Sync\TransactionSyncController;
 use Illuminate\Support\Facades\Route;
 
-Route::middleware(['web', 'auth'])->group(function () {
+Route::middleware(['web', 'auth', 'block-demo', 'throttle:120,1'])->group(function () {
     // Encryption (legacy decrypt-migration support only)
     Route::get('encryption/message', [EncryptionController::class, 'getMessage']);
 
diff --git a/routes/settings.php b/routes/settings.php
index 2071c630..f2febc59 100644
--- a/routes/settings.php
+++ b/routes/settings.php
@@ -20,7 +20,7 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
 use Inertia\Inertia;
 
-Route::middleware('auth')->group(function () {
+Route::middleware(['auth', 'block-demo'])->group(function () {
     Route::redirect('settings', '/settings/accounts');
 
     Route::get('settings/account', [ProfileController::class, 'account'])->name('account.edit');
diff --git a/routes/web.php b/routes/web.php
index 75d547e3..83ba2728 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -99,7 +99,7 @@ Route::get('terms', function () {
     return Inertia::render('terms');
 })->name('terms');
 
-Route::middleware(['auth', 'verified'])->group(function () {
+Route::middleware(['auth', 'verified', 'block-demo'])->group(function () {
     Route::get('subscribe', [SubscriptionController::class, 'index'])->name('subscribe');
     Route::get('subscribe/checkout', [SubscriptionController::class, 'checkout'])->name('subscribe.checkout');
     Route::get('subscribe/success', [SubscriptionController::class, 'success'])->name('subscribe.success');
@@ -135,7 +135,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::delete('integration-requests/{integrationRequest}/vote', [IntegrationRequestController::class, 'removeVote'])->name('integration-requests.vote.destroy');
 });
 
-Route::middleware(['auth', 'verified', 'onboarded', 'subscribed'])->group(function () {
+Route::middleware(['auth', 'verified', 'onboarded', 'subscribed', 'block-demo'])->group(function () {
     Route::get('dashboard', DashboardController::class)->name('dashboard');
     // Renders the dashboard with the integration-requests drawer opened on top.
     Route::get('integration-requests', [IntegrationRequestController::class, 'index'])->name('integration-requests.index');
@@ -159,11 +159,13 @@ Route::middleware(['auth', 'verified', 'onboarded', 'subscribed'])->group(functi
 // The bank authorization callback is intentionally unauthenticated: iOS PWAs hand the
 // redirect back to Safari where the app session does not exist. The connection is
 // resolved from the signed state token EnableBanking echoes back instead.
-Route::get('open-banking/callback', [AuthorizationController::class, 'callback'])->name('open-banking.callback');
+Route::get('open-banking/callback', [AuthorizationController::class, 'callback'])
+    ->middleware('throttle:10,1')
+    ->name('open-banking.callback');
 
 // Open-banking routes are accessible without the onboarded/subscribed middleware
 // so that users can connect their bank during the onboarding flow.
-Route::middleware(['auth', 'verified'])->prefix('open-banking')->group(function () {
+Route::middleware(['auth', 'verified', 'block-demo'])->prefix('open-banking')->group(function () {
     Route::get('institutions', [InstitutionController::class, 'index'])->name('open-banking.institutions');
     Route::post('authorize', [AuthorizationController::class, 'store'])->name('open-banking.authorize');
     Route::post('connections/{connection}/reauthorize', [AuthorizationController::class, 'reauthorize'])->name('open-banking.reauthorize');
@@ -184,7 +186,7 @@ Route::middleware(['auth', 'verified'])->prefix('open-banking')->group(function
         ->name('open-banking.interactive-brokers.connect');
 });
 
-Route::middleware(['auth', 'verified', 'onboarded', 'subscribed'])->group(function () {
+Route::middleware(['auth', 'verified', 'onboarded', 'subscribed', 'block-demo'])->group(function () {
     Route::get('budgets', [BudgetController::class, 'index'])->name('budgets.index');
     Route::post('budgets', [BudgetController::class, 'store'])->name('budgets.store');
     Route::get('budgets/{budget}', [BudgetController::class, 'show'])->name('budgets.show');