Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/org/example/team6backend/comment/controller/CommentController.java`:
- Around line 30-34: The createComment method should handle validation failures
and guard against a null incidentId: change the signature of
CommentController.createComment to accept a
org.springframework.validation.BindingResult immediately after the `@Valid`
CommentRequest, check bindingResult.hasErrors() and return the appropriate view
(e.g., the incident detail page or the form view) so validation errors render
instead of throwing MethodArgumentNotValidException; also
validate/request.getIncidentId() != null before building the redirect, and if
null, handle gracefully (render an error view or redirect to a safe list page)
instead of concatenating "null"; ensure you still call
commentService.createComment(request.getIncidentId(), request.getUserId(),
request.getMessage()) only when validation passes and incidentId is present.

In
`@src/main/java/org/example/team6backend/incident/service/IncidentService.java`:
- Around line 71-73: Replace the generic RuntimeException thrown from
IncidentService.getById with a specific 404-mapped exception: create
IncidentNotFoundException extends RuntimeException and throw it from
IncidentService.getById when incidentRepository.findById(id) is empty, or
alternatively throw a ResponseStatusException(HttpStatus.NOT_FOUND, "...") from
getById; then add or update a `@ControllerAdvice` (e.g., GlobalExceptionHandler)
with an `@ExceptionHandler`(IncidentNotFoundException.class) that returns
ResponseEntity.status(HttpStatus.NOT_FOUND) so the service returns HTTP 404 for
missing incidents.

In `@src/main/resources/templates/incidents.html`:
- Around line 136-144: The template uses card.innerHTML to inject unescaped user
fields (incident.subject, incident.incidentCategory, incident.description),
creating an XSS risk; fix by avoiding direct innerHTML: build DOM nodes with
document.createElement and set textContent for title/category/description or
implement and call an escapeHtml(text) helper before inserting into the
template, replacing the inline `${...}` insertions; update the code that
populates the card (reference card.innerHTML usage) to use safe DOM manipulation
or escaped strings for all three fields.

---

Nitpick comments:
In `@src/main/java/org/example/team6backend/page/PageController.java`:
- Around line 73-80: The viewIncident method in PageController renders the view
without verifying the incident exists; inject and use the existing
IncidentService or IncidentRepository to check presence inside viewIncident(Long
id, ...), and if the incident is missing redirect to "/incidents" with a flash
attribute or model error message (e.g., addRedirectAttribute("error","Incident
not found")) instead of returning "viewincident". Also consider adding
role-based access if desired by annotating viewIncident with a security
annotation (e.g., `@PreAuthorize` or `@Secured`) or otherwise documenting that all
authenticated users may view incidents.

In `@src/main/resources/templates/incidents.html`:
- Line 148: Remove the empty flex container div (<div style="display: flex; gap:
0.5rem;"></div>) from the incidents.html template since it serves no purpose;
simply delete that element so the DOM has no unused empty container left behind.

In `@src/main/resources/templates/viewincident.html`:
- Around line 140-152: The form currently fills incidentId via client-side URL
parsing (and makes setIncidentIdInForm() unnecessary); instead bind the
server-provided model value directly: set the hidden input with id
"incidentIdInput" to use Thymeleaf value binding (th:value="${incidentId}") and
remove the JS function setIncidentIdInForm() and any script that parses the URL
for incidentId so the form uses the controller-provided incidentId consistently.
- Around line 197-200: The ID span currently outputs ${incident.id} unescaped;
update the incident-footer rendering to pass the ID through the existing
escapeHtml helper (ensuring you convert the numeric id to a string if needed) so
the span uses escapeHtml(incident.id) for consistent escaping with the other
fields.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/org/example/team6backend/incident/service/IncidentService.java`:
- Around line 63-64: The service removed the original findById API causing
callers to break; restore compatibility by adding a compat shim method named
findById(Long id) in IncidentService that simply delegates to the new
getById(Long id) (and mark it `@Deprecated` if desired) so existing callers
compile, while leaving the new getById implementation using
incidentRepository.findById(...). Ensure the shim throws the same exception
behavior by forwarding the result/exception from getById.

In `@src/main/java/org/example/team6backend/page/PageController.java`:
- Around line 162-169: There are two identical handlers named viewIncident(Long,
CustomUserDetails, Model) causing a duplicate-method compile error; remove one
of the duplicate methods or consolidate them into a single handler, and if both
routes are required keep one method and rename the other (e.g., viewIncidentList
or viewIncidentAlternate) and update its `@GetMapping` accordingly (/incident/{id}
vs /incidents/{id}) so method names and signatures are unique while preserving
the desired route behavior and model attributes (role, incidentId, userId) set
in the surviving handler.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/main/java/org/example/team6backend/page/PageController.java`:
- Around line 134-141: The viewIncident GET in PageController (viewIncident)
currently always renders the page shell and skips the old per-incident
authorization (admin || creator || assignee), allowing deep-link access; restore
that check in the shared backend path by moving the ownership/assignment logic
into the incident service (e.g., add
IncidentService.isAuthorizedForIncident(User user, Long incidentId) or perform
the check inside IncidentService.getIncident) and call it from both
IncidentController (where /api/incidents/{id} lives) and
PageController.viewIncident so both endpoints enforce the same semantics and
return 403 or 404 as before when unauthorized or not found. Ensure the check
uses the same role/ownership rules (admin || creator || assignee) and that
PageController does not render the page unless the service authorizes the
request.