diff --git a/cli_scripts/reset.php b/cli_scripts/reset.php
index 6cd3f1f..2cc6f1c 100755
--- a/cli_scripts/reset.php
+++ b/cli_scripts/reset.php
@@ -1,28 +1,80 @@
+#!/usr/bin/env php
 <?php
-session_start();
+/**
+ * ZapMachine Reset Script
+ *
+ * CLI only. Resets the current session and optionally purges all session
+ * folders. Confirmation is required before any destructive action.
+ *
+ * Usage:
+ *   php cli_scripts/reset.php            Reset current session only
+ *   php cli_scripts/reset.php --all      Purge all session folders (with prompt)
+ *   php cli_scripts/reset.php --all -f   Purge all session folders, no prompt
+ */
 
-unset($_SESSION['imgOriginal']);
-unset($_SESSION['words']);
-unset($_SESSION['folder']);
-unset($_SESSION['collages']);
-unset($_SESSION['width']);
-unset($_SESSION['height']);
-
-echo '<p>session reset</p><p>';
-
-if ($_GET['allcollages'] == 'clear') {
-	$sessions = glob('./Sessions/*');
-	foreach($sessions as $folder){
-		$files = glob($folder.'/*');
-		foreach($files as $fileToDelete){
-			echo "$fileToDelete deleted<br />";
-			unlink($fileToDelete);
-		}
-		echo "$folder deleted<br />";
-		rmdir($folder);
-	}
+if (php_sapi_name() !== 'cli') {
+	die('This script can only be run from the command line.' . PHP_EOL);
 }
-echo '</p>';
 
-session_destroy();
-?>
\ No newline at end of file
+// Make sure relative paths in init.php resolve against the project root
+chdir(__DIR__);
+
+require_once __DIR__ . '/../conf/init.php';
+
+// Start a session so reset/destroy have something to work with
+if (session_status() === PHP_SESSION_NONE) {
+	session_start();
+}
+
+// --- Session reset ---
+Session::reset();
+
+echo 'Session reset.' . PHP_EOL;
+
+// --- Optional: purge all session folders ---
+$purgeAll = in_array('--all', $argv);
+
+if ($purgeAll) {
+	$force = in_array('-f', $argv);
+
+	if (!$force) {
+		echo 'WARNING: This will permanently delete ALL session folders.' . PHP_EOL;
+		echo 'Are you sure? (type "yes" to confirm): ';
+		$handle = fopen('php://stdin', 'r');
+		$input = trim(fgets($handle));
+		fclose($handle);
+
+		if (strtolower($input) !== 'yes') {
+			echo 'Aborted.' . PHP_EOL;
+			exit(0);
+		}
+	}
+
+	$sessionsDir = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR;
+	$folders = glob($sessionsDir . DIRECTORY_SEPARATOR . '*');
+	$count = 0;
+
+	foreach ($folders as $folder) {
+		if (!is_dir($folder)) {
+			continue;
+		}
+		$files = glob($folder . DIRECTORY_SEPARATOR . '*');
+		foreach ($files as $file) {
+			if (is_file($file)) {
+				unlink($file);
+			}
+		}
+		rmdir($folder);
+		$count++;
+	}
+
+	echo "Purged $count session folder(s)." . PHP_EOL;
+}
+
+// Only destroy if a session was actually started
+if (session_status() === PHP_SESSION_ACTIVE) {
+	Session::destroy();
+	echo 'Session destroyed.' . PHP_EOL;
+}
+
+exit(0);
\ No newline at end of file
diff --git a/cli_scripts/test.php b/cli_scripts/test.php
index 3a618cd..bb1b29b 100755
--- a/cli_scripts/test.php
+++ b/cli_scripts/test.php
@@ -85,9 +85,10 @@ function testImgSearch() {
 		return;
 	}
 
-	$folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'search_test_' . ZAP_MOMENT;
+	$suffix = bin2hex(random_bytes(4));
+	$folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'search_test_' . ZAP_MOMENT . '_' . $suffix;
 	if (!is_dir($folder)) {
-		@mkdir($folder, 0777, true);
+		mkdir($folder, 0777, true);
 	}
 
 	echo "\nQuery: '$word'\n\n";
diff --git a/lib/ZAPController.class.php b/lib/ZAPController.class.php
index 115b416..29df4c8 100755
--- a/lib/ZAPController.class.php
+++ b/lib/ZAPController.class.php
@@ -26,7 +26,9 @@ class ZAPController {
 		$this->mode = ucfirst($mode);
 		$clazz = $this->prefix . $this->mode;
 		if (!class_exists($clazz)) {
-			die('Wrong parameter');
+			http_response_code(404);
+			include getZAPTemplate('404');
+			die();
 		}
 		$this->action = new $clazz();
 	}
diff --git a/lib/ZAPDisplay.class.php b/lib/ZAPDisplay.class.php
index 2d1ef71..65656e9 100755
--- a/lib/ZAPDisplay.class.php
+++ b/lib/ZAPDisplay.class.php
@@ -28,6 +28,18 @@ class ZAPDisplay implements ZAPHandler {
 	 */
 	public function __construct() {
 		ob_start();
+
+		// Validate CSRF token
+		if (
+			empty($_POST['csrf_token'])
+			|| empty($_SESSION['csrf_token'])
+			|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
+		) {
+			http_response_code(400);
+			echo '<p>Invalid or missing security token. Please go back and try again.</p>';
+			die();
+		}
+
 		$this->folder = $this->createFolder();
 		$this->words = $this->handleWords();
 
@@ -49,9 +61,10 @@ class ZAPDisplay implements ZAPHandler {
 	 */
 	private function createFolder() {
 		try {
+			$suffix = bin2hex(random_bytes(4));
 			$folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR
-					. ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'zap_' . ZAP_MOMENT;
-			if (!@mkdir($folder, 0777)) {
+					. ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'zap_' . ZAP_MOMENT . '_' . $suffix;
+			if (!mkdir($folder, 0777, true)) {
 				throw new Exception('<p>' . ERROR_PREFIX . 'Unable to create base dir: ' . $folder . '</p>');
 			}
 			return $folder;
diff --git a/tpl/404.tpl b/tpl/404.tpl
new file mode 100644
index 0000000..68649d5
--- /dev/null
+++ b/tpl/404.tpl
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+	<meta charset="utf-8">
+	<title>404 - ZapMachine</title>
+	<link rel="stylesheet" media="screen" href="css/style.css">
+	<style>
+		.error-404 {
+			position: absolute;
+			top: 50%;
+			left: 50%;
+			transform: translate(-50%, -50%);
+			width: 50vw;
+			height: 50vh;
+			display: flex;
+			align-items: center;
+			justify-content: center;
+			font-family: Georgia, serif;
+			font-size: clamp(2rem, 8vw, 6rem);
+			color: #555;
+			border: 0px;
+			background: #fafafa;
+		}
+	</style>
+</head>
+<body>
+	<div class="error-404">error 404</div>
+</body>
+</html>
diff --git a/tpl/index.tpl b/tpl/index.tpl
index a5fc6f4..249b112 100755
--- a/tpl/index.tpl
+++ b/tpl/index.tpl
@@ -12,7 +12,11 @@
 	<!--input modus: words-->
 	<div id="inpWords" class="inpSection">
 		<h2>Input words</h2>
+<?php if (empty($_SESSION['csrf_token'])) {
+	$_SESSION['csrf_token'] = bin2hex(random_bytes(16));
+} ?>
 		<form id="form1" action="index.php?mode=display" method="post">
+			<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
 <?php for ($i = 1; $i <= MAX_WORDS; $i++) : ?>
 <?php $nr = sprintf("%02d", $i); ?>
 			<div class="inp">