Saudi Banks — a bilingual fraud-awareness campaign and banking news hub for Saudi Arabia's official Banking Media and Awareness Committee.

Statamic 6 changed the Link fieldtype from a plain string to an object requiring a GraphQL sub-selection — a non-additive, schema-breaking change. The fix queries the nested URL field instead of the flat string, which only works against the new CMS; the old CMS rejects the sub-selection outright. Trade-off: this frontend branch can no longer run against both CMS versions — it must deploy in lockstep with the CMS cutover — accepted because straddling both schemas with conditional queries would have doubled the GraphQL surface for a migration that's a one-way door anyway.

The quiz and share-experience forms originally trusted the client-side reCAPTCHA widget alone. A server route now re-checks the token against the verification endpoint with a server-only secret before treating a submission as human-verified. Trade-off: an extra network round-trip on every submission, accepted because a client-only check can be bypassed entirely by calling the form-submission endpoint directly.

13+ components render CMS-authored rich text directly into the page (fraud tips, FAQs, leadership bios, embeds). A shared sanitization utility now runs every one through a sanitizer and constrains CMS-controlled link values to an http(s)/mailto/tel scheme allowlist. Trade-off: sanitization now runs on every render of CMS content instead of trusting the CMS's own editorial controls, accepted because the CMS accepts rich text from multiple editors and a single payload would otherwise execute directly in visitors' browsers.