diff --git a/garminconnect/__init__.py b/garminconnect/__init__.py
index d0649a68..26c9ba78 100644
--- a/garminconnect/__init__.py
+++ b/garminconnect/__init__.py
@@ -1488,15 +1488,19 @@ def get_functional_threshold_power_range(
         url = (
             f"{self.garmin_connect_biometric_stats_url}"
             f"/functionalThresholdPower/range/{start}/{end}"
-            f"?sport={normalized_sport}&aggregation={aggregation}&aggregationStrategy=LATEST"
         )
+        params = {
+            "sport": normalized_sport,
+            "aggregation": aggregation,
+            "aggregationStrategy": "LATEST",
+        }
         logger.debug(
             "Requesting functional threshold power from %s to %s for sport %s",
             start,
             end,
             normalized_sport,
         )
-        return self.connectapi(url)
+        return self.connectapi(url, params=params)
 
     def get_lactate_threshold(
         self,
@@ -1592,20 +1596,23 @@ def get_lactate_threshold(
             aggregation=aggregation,
         )
 
+        params = {
+            "sport": "RUNNING",
+            "aggregation": aggregation,
+            "aggregationStrategy": "LATEST",
+        }
         speed_url = (
             f"{self.garmin_connect_biometric_stats_url}"
             f"/lactateThresholdSpeed/range/{start_date}/{end_date}"
-            f"?sport=RUNNING&aggregation={aggregation}&aggregationStrategy=LATEST"
         )
 
         heart_rate_url = (
             f"{self.garmin_connect_biometric_stats_url}"
             f"/lactateThresholdHeartRate/range/{start_date}/{end_date}"
-            f"?sport=RUNNING&aggregation={aggregation}&aggregationStrategy=LATEST"
         )
 
-        speed = self.connectapi(speed_url)
-        heart_rate = self.connectapi(heart_rate_url)
+        speed = self.connectapi(speed_url, params=params)
+        heart_rate = self.connectapi(heart_rate_url, params=params)
 
         return {"speed": speed, "heart_rate": heart_rate, "power": power}
 
@@ -2991,11 +2998,11 @@ def get_gear_activities(
         limit = _validate_positive_integer(limit, "limit")
         # Optional: enforce a reasonable ceiling to avoid heavy responses
         limit = min(limit, MAX_ACTIVITY_LIMIT)
-        url = f"{self.garmin_connect_activities_baseurl}{gearUUID}/gear?start=0&limit={limit}"
+        url = f"{self.garmin_connect_activities_baseurl}{gearUUID}/gear"
         logger.debug("Requesting activities for gearUUID %s", gearUUID)
 
         try:
-            return self.connectapi(url)
+            return self.connectapi(url, params={"start": 0, "limit": limit})
         except GarminConnectConnectionError as e:
             status = getattr(getattr(e, "response", None), "status_code", None)
             if status == 404:
diff --git a/garminconnect/client.py b/garminconnect/client.py
index 9259cf43..17d0ae10 100644
--- a/garminconnect/client.py
+++ b/garminconnect/client.py
@@ -22,6 +22,7 @@
 from collections.abc import Iterator, Mapping
 from pathlib import Path
 from typing import Any, cast
+from urllib.parse import unquote
 
 import requests
 from requests.adapters import HTTPAdapter
@@ -69,9 +70,11 @@ def token_file_path(path: str) -> Path:
             f"Token path must not reference another user's home directory: {path!r}"
         )
     token_path = Path(path).expanduser()
-    # Reject symlinks on the tokenstore path or its immediate parent
-    # (e.g. ~/.garminconnect -> /attacker/dir).
-    for check_path in (token_path, token_path.parent):
+    # Reject symlinks anywhere in the tokenstore ancestry (e.g.
+    # ~/.garminconnect -> /attacker/dir). O_NOFOLLOW on the final open()
+    # only covers the last component; an intermediate symlinked directory
+    # would still redirect load/dump/logout into an attacker-controlled tree.
+    for check_path in (token_path, *token_path.parents):
         try:
             if check_path.is_symlink():
                 raise ValueError(f"Token path must not be a symlink: {path!r}")
@@ -187,6 +190,20 @@ def _build_basic_auth(client_id: str) -> str:
     return "Basic " + base64.b64encode(f"{client_id}:".encode()).decode()
 
 
+_QUERY_VALUE_RE = re.compile(r"([?&][\w.-]+=)[^&\s)'\"]+")
+
+
+def _sanitize_exception_text(err: Exception) -> str:
+    """Render an exception for logs/messages with URL query values redacted.
+
+    ``requests`` embeds the full request URL — query string included — in its
+    exception text. On the login fallback path that URL carries the CAS
+    service ticket (``?ticket=ST-...``), so logging or re-raising the raw
+    exception would leak a credential into application logs and bug reports.
+    """
+    return _QUERY_VALUE_RE.sub(r"\1<redacted>", f"{type(err).__name__}: {err}")
+
+
 def _iter_file_objects(kwargs: dict[str, Any]) -> Iterator[Any]:
     """Yield file-like objects referenced by request kwargs (files/data)."""
     files = kwargs.get("files")
@@ -408,7 +425,10 @@ def _verify_token(self) -> bool:
             _LOGGER.debug("Token validation inconclusive (kept): %s", msg)
             return True
         except Exception as e:
-            _LOGGER.debug("Token validation inconclusive (kept): %s", e)
+            _LOGGER.debug(
+                "Token validation inconclusive (kept): %s",
+                _sanitize_exception_text(e),
+            )
             return True
 
     def get_api_headers(self) -> dict[str, str]:
@@ -532,12 +552,14 @@ def resolve_mfa(name: str) -> tuple[str | None, Any]:
                     last_err = e
                     continue
             except GarminConnectTooManyRequestsError as e:
-                _LOGGER.warning("%s returned 429: %s", name, e)
+                _LOGGER.warning(
+                    "%s returned 429: %s", name, _sanitize_exception_text(e)
+                )
                 rate_limited_count += 1
                 last_err = e
                 continue
             except Exception as e:
-                _LOGGER.warning("%s failed: %s", name, e)
+                _LOGGER.warning("%s failed: %s", name, _sanitize_exception_text(e))
                 last_err = e
                 continue
 
@@ -547,7 +569,8 @@ def resolve_mfa(name: str) -> tuple[str | None, Any]:
                 "Try again later or check your IP/network."
             )
         raise GarminConnectConnectionError(
-            f"All login strategies exhausted: {last_err}"
+            "All login strategies exhausted: "
+            + (_sanitize_exception_text(last_err) if last_err else "no strategies ran")
         )
 
     # ------------------------------------------------------------------ #
@@ -572,11 +595,15 @@ def _mobile_login_cffi(self, email: str, password: str) -> None:
             except (GarminConnectAuthenticationError, _MFARequired):
                 raise
             except GarminConnectTooManyRequestsError as e:
-                _LOGGER.debug("mobile+cffi(%s) 429: %s", imp, e)
+                _LOGGER.debug(
+                    "mobile+cffi(%s) 429: %s", imp, _sanitize_exception_text(e)
+                )
                 last_err = e
                 continue
             except Exception as e:
-                _LOGGER.debug("mobile+cffi(%s) failed: %s", imp, e)
+                _LOGGER.debug(
+                    "mobile+cffi(%s) failed: %s", imp, _sanitize_exception_text(e)
+                )
                 last_err = e
                 continue
         if last_err:
@@ -938,11 +965,15 @@ def _portal_web_login_cffi(self, email: str, password: str) -> None:
             except (GarminConnectAuthenticationError, _MFARequired):
                 raise
             except GarminConnectTooManyRequestsError as e:
-                _LOGGER.debug("portal+cffi(%s) 429: %s", imp, e)
+                _LOGGER.debug(
+                    "portal+cffi(%s) 429: %s", imp, _sanitize_exception_text(e)
+                )
                 last_err = e
                 continue
             except Exception as e:
-                _LOGGER.debug("portal+cffi(%s) failed: %s", imp, e)
+                _LOGGER.debug(
+                    "portal+cffi(%s) failed: %s", imp, _sanitize_exception_text(e)
+                )
                 last_err = e
                 continue
         if last_err:
@@ -1214,7 +1245,10 @@ def _establish_session(
             self._exchange_service_ticket(ticket, service_url=service_url)
             return
         except Exception as e:
-            _LOGGER.warning("DI token exchange failed (%s), falling back to JWT_WEB", e)
+            _LOGGER.warning(
+                "DI token exchange failed (%s), falling back to JWT_WEB",
+                _sanitize_exception_text(e),
+            )
 
         # Fallback: consume ticket via connect.garmin.com for JWT_WEB cookie
         if sess is not None:
@@ -1396,7 +1430,9 @@ def _refresh_session(self) -> None:
                         with contextlib.suppress(Exception):
                             self.dump(self._tokenstore_path)
                 except Exception as err:
-                    _LOGGER.debug("DI token refresh failed: %s", err)
+                    _LOGGER.debug(
+                        "DI token refresh failed: %s", _sanitize_exception_text(err)
+                    )
                 return
 
             # JWT_WEB refresh via CAS TGT
@@ -1436,7 +1472,7 @@ def _refresh_session(self) -> None:
                         self.jwt_web = c.value
                         break
             except Exception as err:
-                _LOGGER.debug("Refresh failed: %s", err)
+                _LOGGER.debug("Refresh failed: %s", _sanitize_exception_text(err))
 
     def dumps(self) -> str:
         """Serialize session state to JSON string."""
@@ -1587,8 +1623,23 @@ def _run_request(self, method: str, path: str, **kwargs: Any) -> Any:
                 self._refresh_session()
 
         # Defense-in-depth: callers must pass clean path components; query strings
-        # belong in the `params` kwarg, not embedded in the path.
-        if ".." in path or "?" in path or "#" in path:
+        # belong in the `params` kwarg, not embedded in the path. Validate the
+        # percent-decoded form: requests' requote_uri() decodes unreserved
+        # characters (e.g. %2e -> .) after this check, so a literal-only match
+        # would let a %2e%2e traversal slip through.
+        decoded_path = unquote(path)
+        # A quoted display name may legitimately contain a run of dots (e.g.
+        # "first..last"); only a path *segment* that is exactly ".." (or
+        # "..;<matrix-params>", a known filter-bypass trick) is traversal.
+        has_traversal_segment = any(
+            segment.split(";", 1)[0] == ".." for segment in decoded_path.split("/")
+        )
+        if (
+            has_traversal_segment
+            or "?" in decoded_path
+            or "#" in decoded_path
+            or "\\" in decoded_path
+        ):
             raise ValueError(f"Invalid API path: {path!r}")
 
         url = f"{self._connectapi}/{path.lstrip('/')}"
diff --git a/scripts/generate_exercises.py b/scripts/generate_exercises.py
index 82b799ed..6cb79bf0 100644
--- a/scripts/generate_exercises.py
+++ b/scripts/generate_exercises.py
@@ -6,7 +6,10 @@
 
 1. Open the workout editor at https://connect.garmin.com, add a strength
    exercise, and open the exercise picker.
-2. Copy the picker's ``<ul>`` (or the whole page) HTML into a file.
+2. Copy only the picker's ``<ul>`` HTML into a file.  Do not paste the
+   whole page: it comes from an authenticated session and may contain
+   account data, and the generated file is published to a public
+   repository.
 3. Run::
 
        python scripts/generate_exercises.py path/to/picker.html
@@ -22,23 +25,89 @@
 import html
 import re
 import sys
+from html.parser import HTMLParser
 from pathlib import Path
 
 OUT = Path(__file__).resolve().parent.parent / "garminconnect" / "exercises.py"
 
-ROW = re.compile(
-    r'data-category-key="([^"]*)"\s+'
-    r'data-exercise-key="([^"]*)"'
-    r".*?<span>([^<]*)</span>",
-    re.S,
+
+class _PickerParser(HTMLParser):
+    """Collect (category, exercise, name) rows, each scoped to its own <li>.
+
+    Regex extraction with DOTALL can reach past an element boundary and
+    capture a <span> from unrelated page chrome; a real parser cannot, and
+    it also keeps items separate when a closing </li> is omitted.
+    """
+
+    def __init__(self) -> None:
+        super().__init__()
+        self.rows: list[tuple[str, str, str]] = []
+        self._cur: list[str | None] | None = None
+        # Nesting depth of <span> while inside the selected span; 0 means
+        # not in one. A plain in/out flag would drop back out on an inner
+        # </span>, losing any text after it (e.g. "Squat" in
+        # "<span><span>Back</span> Squat</span>").
+        self._span_depth = 0
+
+    def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+        a = dict(attrs)
+        if tag == "li":
+            # An unclosed previous <li> ends here, not at its </li>.
+            self._flush()
+            if "data-category-key" in a and "data-exercise-key" in a:
+                self._cur = [a["data-category-key"], a["data-exercise-key"], None]
+        elif tag == "span" and self._cur is not None:
+            if self._span_depth:
+                self._span_depth += 1
+            elif self._cur[2] is None:
+                self._span_depth = 1
+
+    def handle_data(self, data: str) -> None:
+        # A nested tag inside the span (e.g. <b>) triggers another
+        # handle_data call for its own text; accumulate rather than
+        # overwrite, or a fragment like the "https://" prefix of a stray
+        # URL is dropped and the SUSPECT filter never sees it.
+        if self._span_depth and self._cur is not None:
+            self._cur[2] = (self._cur[2] or "") + data
+
+    def handle_endtag(self, tag: str) -> None:
+        if tag == "span" and self._span_depth:
+            self._span_depth -= 1
+        elif tag == "li" and self._cur is not None:
+            self._flush()
+
+    def _flush(self) -> None:
+        # Attribute-only element (no span of its own): skip rather than
+        # borrowing text from elsewhere in the document.
+        if self._cur is not None and self._cur[2]:
+            self.rows.append((self._cur[0] or "", self._cur[1] or "", self._cur[2]))
+        self._cur = None
+        self._span_depth = 0
+
+
+# Names are display labels; anything shaped like session data means the
+# extraction went out of scope (or the wrong HTML was pasted).
+SUSPECT = re.compile(
+    r"[\w.+-]+@[\w-]+\.[\w.]+"  # e-mail address
+    r"|eyJ[\w-]{10,}"  # JWT
+    r"|https?://"  # URL
+    r"|[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}",  # GUID
+    re.IGNORECASE,
 )
 
 
 def parse(text: str) -> list[dict[str, str]]:
     """Extract unique (name, category, exercise) rows from picker HTML."""
+    parser = _PickerParser()
+    parser.feed(text)
+    parser.close()
+    # HTMLParser.close() doesn't synthesize a missing </li>, so the last
+    # item (if the source HTML omits its closing tag) needs an explicit
+    # flush here.
+    parser._flush()
     seen: set[tuple[str, str]] = set()
     out: list[dict[str, str]] = []
-    for category, exercise, name in ROW.findall(text):
+    for category, exercise, name in parser.rows:
         key = (category, exercise)
         if key in seen:
             continue  # the "Recent" block repeats items listed below
@@ -112,6 +181,15 @@ def main() -> None:
     if len(sys.argv) != 2:
         sys.exit("usage: python scripts/generate_exercises.py <picker.html>")
     exercises = parse(Path(sys.argv[1]).read_text(encoding="utf-8"))
+    suspect = [i for i, e in enumerate(exercises) if SUSPECT.search(e["name"])]
+    if suspect:
+        # Report only row positions — the matched labels are exactly the
+        # potentially sensitive text we refuse to write out.
+        sys.exit(
+            f"refusing to write: {len(suspect)} entr{'ies' if len(suspect) != 1 else 'y'} "
+            "look like session data, not exercise names (rows "
+            f"{suspect}; check the pasted HTML)"
+        )
     OUT.write_text(render(exercises), encoding="utf-8")
     print(f"Wrote {len(exercises)} exercises to {OUT}")
     print("Run `pdm run format` to normalize quoting/formatting.")
diff --git a/tests/conftest.py b/tests/conftest.py
index 6988ea0d..1ecc5b6b 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -10,8 +10,10 @@
 SENSITIVE_FIELDS = {
     "access_token",
     "activityId",
+    "captchaToken",
     "consumer_key",
     "consumer_secret",
+    "customerGuid",
     "di_refresh_token",
     "di_token",
     "displayName",
@@ -20,6 +22,7 @@
     "garminGUID",
     "jti",
     "locationName",
+    "mfaVerificationCode",
     "mfa_token",
     "oauth_token",
     "oauth_token_secret",
@@ -32,11 +35,14 @@
     "profileImageUrlMedium",
     "profileImageUrlSmall",
     "refresh_token",
+    "serviceTicketId",
+    "service_ticket",
     "token",
     "userId",
     "userName",
     "userProfileFullName",
     "userProfileId",
+    "username",
 }
 LOCATION_FIELDS = {
     "endLatitude",
@@ -105,6 +111,7 @@ def scrub_dates(response: Any) -> Any:
     "oauth_token_secret",
     "password",
     "refresh_token",
+    "service_ticket",
     "username",
 ]
 
@@ -138,8 +145,24 @@ def sanitize_request(request: Any) -> Any:
             body = request.body.decode("utf8")
         except UnicodeDecodeError:
             return request  # leave as-is; binary bodies not sanitized
+        # The login strategies post credentials as JSON; a key=value regex
+        # alone never matches those bodies, so parse by structure first and
+        # fall back to form-encoded scrubbing.
+        try:
+            parsed = json.loads(body)
+        except json.JSONDecodeError:
+            body = _sanitize_form_body(body)
         else:
-            request.body = _sanitize_form_body(body).encode("utf8")
+            body = json.dumps(sanitize_json(parsed))
+        request.body = body.encode("utf8")
+
+    # Credentials can also ride in the URI itself (CAS service ticket on the
+    # ticket-consumption fallback: GET <service_url>?ticket=ST-...).
+    uri = getattr(request, "uri", None)
+    if uri:
+        request.uri = re.sub(
+            r"([?&](?:ticket|service_ticket)=)[^&]*", r"\1SANITIZED", uri
+        )
 
     if "Cookie" in request.headers:
         cookies = request.headers["Cookie"].split("; ")
diff --git a/tests/test_cassette_sanitization.py b/tests/test_cassette_sanitization.py
index d1fd90bf..797cc302 100644
--- a/tests/test_cassette_sanitization.py
+++ b/tests/test_cassette_sanitization.py
@@ -111,3 +111,70 @@ def test_sanitize_request_scrubs_oauth_exchange_body():
     assert "access_token=SANITIZED" in body
     assert "private-token" not in body
     assert "secret-value" not in sanitized.headers["Cookie"]
+
+
+def test_sanitize_request_scrubs_json_login_body():
+    """Login strategies post credentials as JSON, not key=value form data.
+
+    Regression test: the form-body regex never matches a JSON body, so the
+    sanitiser was a no-op on exactly the requests carrying the credentials.
+    """
+    body = json.dumps(
+        {
+            "username": "victim@example.com",
+            "password": "S3cr3t-Passw0rd",  # noqa: S105
+            "rememberMe": True,
+            "captchaToken": "captcha-secret",
+        },
+        separators=(",", ":"),
+    ).encode()
+    request = SimpleNamespace(body=body, headers={})
+
+    sanitized = sanitize_request(request)
+
+    parsed = json.loads(sanitized.body)
+    assert parsed["username"] == "SANITIZED"
+    assert parsed["password"] == "SANITIZED"
+    assert parsed["captchaToken"] == "SANITIZED"
+    assert parsed["rememberMe"] is True
+    assert b"victim@example.com" not in sanitized.body
+    assert b"S3cr3t-Passw0rd" not in sanitized.body
+
+
+def test_sanitize_request_scrubs_mfa_code_json_body():
+    body = json.dumps(
+        {"mfaMethod": "email", "mfaVerificationCode": "123456"}
+    ).encode()
+    request = SimpleNamespace(body=body, headers={})
+
+    sanitized = sanitize_request(request)
+
+    assert b"123456" not in sanitized.body
+
+
+def test_sanitize_request_scrubs_di_exchange_form_body():
+    """The DI token exchange posts the CAS service ticket form-encoded."""
+    request = SimpleNamespace(
+        body=b"service_ticket=ST-12345-secret&grant_type=service_ticket",
+        headers={},
+    )
+
+    sanitized = sanitize_request(request)
+
+    body = sanitized.body.decode("utf8")
+    assert "service_ticket=SANITIZED" in body
+    assert "ST-12345-secret" not in body
+
+
+def test_sanitize_request_scrubs_ticket_from_uri():
+    """The ticket-consumption fallback carries ?ticket=ST-... in the URL."""
+    request = SimpleNamespace(
+        body=None,
+        headers={},
+        uri="https://connect.garmin.com/gcm/ios?ticket=ST-999-canary&x=1",
+    )
+
+    sanitized = sanitize_request(request)
+
+    assert "ST-999-canary" not in sanitized.uri
+    assert "ticket=SANITIZED" in sanitized.uri
diff --git a/tests/test_garmin_unit.py b/tests/test_garmin_unit.py
index 635e9098..8d02aca8 100644
--- a/tests/test_garmin_unit.py
+++ b/tests/test_garmin_unit.py
@@ -218,8 +218,12 @@ def test_get_functional_threshold_power_range_builds_cycling_url(
             )
 
         mock.assert_called_once_with(
-            "/biometric-service/stats/functionalThresholdPower/range/2025-06-01/2025-06-30"
-            "?sport=CYCLING&aggregation=daily&aggregationStrategy=LATEST"
+            "/biometric-service/stats/functionalThresholdPower/range/2025-06-01/2025-06-30",
+            params={
+                "sport": "CYCLING",
+                "aggregation": "daily",
+                "aggregationStrategy": "LATEST",
+            },
         )
         assert result == payload
 
@@ -234,7 +238,8 @@ def test_get_functional_threshold_power_range_builds_url_with_weekly_aggregation
                 aggregation="weekly",
             )
 
-        assert "sport=RUNNING&aggregation=weekly" in mock.call_args[0][0]
+        assert mock.call_args.kwargs["params"]["sport"] == "RUNNING"
+        assert mock.call_args.kwargs["params"]["aggregation"] == "weekly"
 
     @pytest.mark.parametrize(
         ("start", "end", "sport", "aggregation", "message"),
@@ -737,6 +742,40 @@ def portal_strategy(_email, _password):
         assert c.di_token == "portal-token"  # noqa: S105
         mock_clear.assert_called_once()
 
+    def test_sanitize_exception_text_redacts_query_values(self):
+        err = Exception("Max retries exceeded with url: /x?ticket=ST-1&foo=bar ok")
+        out = client_mod._sanitize_exception_text(err)
+        assert "ST-1" not in out
+        assert "bar" not in out
+        assert "ticket=<redacted>" in out
+        assert "foo=<redacted>" in out
+        assert out.startswith("Exception: ")
+
+    def test_failed_login_redacts_ticket_from_log_and_error(self, caplog):
+        # requests embeds the full URL — query string included — in exception
+        # text; the ticket-consumption fallback URL carries ?ticket=ST-...,
+        # which must reach neither the log nor the raised error.
+        c = client_mod.Client(verify_login=False)
+        boom = Exception(
+            "Max retries exceeded with url: /gcm/ios?ticket=ST-CANARY-123 "
+            "(Caused by ConnectTimeoutError)"
+        )
+        with (
+            patch.object(c, "_mobile_login_cffi", side_effect=boom),
+            patch.object(c, "_mobile_login_requests", side_effect=boom),
+            patch.object(c, "_widget_web_login", side_effect=boom),
+            patch.object(c, "_portal_web_login_cffi", side_effect=boom),
+            patch.object(c, "_portal_web_login_requests", side_effect=boom),
+            caplog.at_level(logging.WARNING, logger="garminconnect"),
+            pytest.raises(
+                garminconnect.GarminConnectConnectionError, match="exhausted"
+            ) as exc_info,
+        ):
+            c.login("e@x.com", "pw")
+        assert "ST-CANARY-123" not in caplog.text
+        assert "ST-CANARY-123" not in str(exc_info.value)
+        assert "ticket=<redacted>" in caplog.text
+
     def test_return_on_mfa_sets_pending_flag(self):
         c = client_mod.Client(verify_login=False)
 
@@ -1049,6 +1088,18 @@ def test_rejects_symlinked_parent_of_json_tokenstore(self, tmp_path, make_symlin
         with pytest.raises(ValueError, match="must not be a symlink"):
             client_mod.token_file_path(str(link_dir / "garmin_tokens.json"))
 
+    def test_rejects_symlink_two_levels_up(self, tmp_path, make_symlink):
+        # O_NOFOLLOW only covers the final path component; a symlink planted
+        # higher in the ancestry must also be rejected.
+        real = tmp_path / "real"
+        real.mkdir()
+        (tmp_path / "cfg").mkdir()
+        make_symlink(real, tmp_path / "cfg" / "store")
+
+        target = tmp_path / "cfg" / "store" / "sub" / ".garminconnect"
+        with pytest.raises(ValueError, match="must not be a symlink"):
+            client_mod.token_file_path(str(target))
+
 
 # ---------------------------------------------------------------------------
 # Tokenstore path-vs-data detection
@@ -1679,6 +1730,15 @@ def test_error_message_omits_raw_response_body(self, monkeypatch):
             "foo/../bar",
             "foo?bar=1",
             "foo#fragment",
+            # Percent-encoded variants: requests' requote_uri() decodes
+            # unreserved characters (%2e -> .) after the guard would see a
+            # literal-only match, so validation must run on the decoded path.
+            "foo/%2e%2e/bar",
+            "foo/%2E%2E/bar",
+            "foo/%2e%2e%2fbar",
+            "foo/%2e%2e;/bar",
+            "foo/%3fbar=1",
+            "foo\\..\\bar",
         ],
     )
     def test_rejects_path_with_traversal_or_query(
@@ -1688,6 +1748,30 @@ def test_rejects_path_with_traversal_or_query(
         with pytest.raises(ValueError, match="Invalid API path"):
             c._run_request("GET", bad_path)
 
+    @pytest.mark.parametrize(
+        "path",
+        [
+            # A run of dots that doesn't form a ".." path segment (e.g. a
+            # quoted display name like "first..last") must not be rejected
+            # as traversal.
+            "userprofile-service/first..last",
+            "userprofile-service/foo...bar",
+        ],
+    )
+    def test_accepts_path_with_dots_not_forming_traversal_segment(
+        self, monkeypatch, path: str
+    ):
+        c = self._client(monkeypatch, _FakeResp(200, {"ok": True}))
+        resp = c._run_request("GET", path)
+        assert resp.status_code == 200
+
+    def test_accepts_legitimate_path(self, monkeypatch):
+        c = self._client(monkeypatch, _FakeResp(200, {"ok": True}))
+        resp = c._run_request(
+            "GET", "/userprofile-service/socialProfile"
+        )
+        assert resp.status_code == 200
+
 
 # ---------------------------------------------------------------------------
 # _run_request: 401 retry must rewind file bodies and keep custom headers
diff --git a/tests/test_generate_exercises.py b/tests/test_generate_exercises.py
new file mode 100644
index 00000000..df3e47a8
--- /dev/null
+++ b/tests/test_generate_exercises.py
@@ -0,0 +1,117 @@
+"""Regression tests for scripts/generate_exercises.py (report #4024)."""
+
+import importlib.util
+from pathlib import Path
+
+import pytest
+
+
+@pytest.fixture(scope="module")
+def gen():
+    spec = importlib.util.spec_from_file_location(
+        "generate_exercises",
+        Path(__file__).parent.parent / "scripts" / "generate_exercises.py",
+    )
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+PAGE = """<html><body>
+  <div class="user-header">
+    <span>user@example.com</span>
+  </div>
+  <ul id="picker">
+    <li role="option" data-category-key="SQUAT" data-exercise-key="BACK_SQUAT"><span>Back Squat</span></li>
+    <li role="option" data-category-key="LEAK" data-exercise-key="NO_SPAN_HERE"></li>
+  </ul>
+  <footer><span>JWT_WEB=eyJhbGciOi.FAKE.TOKEN</span></footer>
+</body></html>"""
+
+
+def test_parse_does_not_capture_span_outside_element(gen):
+    rows = gen.parse(PAGE)
+    assert rows == [
+        {"name": "Back Squat", "category": "SQUAT", "exercise": "BACK_SQUAT"}
+    ]
+
+
+def test_parse_keeps_unclosed_items_separate(gen):
+    # No </li> after the first item: the next <li> start tag is the
+    # boundary, so the attribute-only item must not merge with (or borrow
+    # the span of) the following one.
+    rows = gen.parse(
+        '<li data-category-key="LEAK" data-exercise-key="NO_SPAN">\n'
+        '<li data-category-key="X" data-exercise-key="Y">'
+        "<span>user@example.com</span></li>"
+    )
+    assert rows == [
+        {"name": "user@example.com", "category": "X", "exercise": "Y"}
+    ]
+
+
+def test_main_refuses_suspect_names(gen, tmp_path, monkeypatch, capsys):
+    html_file = tmp_path / "picker.html"
+    html_file.write_text(
+        '<li data-category-key="X" data-exercise-key="Y">'
+        "<span>user@example.com</span></li>"
+    )
+    monkeypatch.setattr("sys.argv", ["generate_exercises.py", str(html_file)])
+    with pytest.raises(SystemExit) as exc_info:
+        gen.main()
+    # The refusal must name positions only, never the suspected text.
+    assert "user@example.com" not in str(exc_info.value)
+    assert "session data" in str(exc_info.value)
+
+
+@pytest.mark.parametrize(
+    "label",
+    [
+        "see HTTPS://EXAMPLE.COM/x",  # uppercase URL scheme
+        "id 9F8E7D6C-5B4A-4C3D-8E9F-0A1B2C3D4E5F",  # uppercase GUID
+    ],
+)
+def test_suspect_regex_is_case_insensitive(gen, label):
+    assert gen.SUSPECT.search(label)
+
+
+def test_parse_accumulates_text_across_nested_tags(gen):
+    # A nested <b> inside the span splits the label into two handle_data
+    # calls; the "https://" prefix must not be dropped, or the SUSPECT
+    # filter never sees the full (sensitive) label.
+    rows = gen.parse(
+        '<li data-category-key="X" data-exercise-key="Y">'
+        "<span>https://host/<b>?ticket=secret</b></span></li>"
+    )
+    assert rows == [
+        {
+            "name": "https://host/?ticket=secret",
+            "category": "X",
+            "exercise": "Y",
+        }
+    ]
+    assert gen.SUSPECT.search(rows[0]["name"])
+
+
+def test_parse_flushes_final_item_without_closing_tag(gen):
+    # HTMLParser.close() does not synthesize a missing </li>; the last
+    # item in the source HTML must still be captured.
+    rows = gen.parse(
+        '<ul><li data-category-key="SQUAT" data-exercise-key="BACK_SQUAT">'
+        "<span>Back Squat</span>"
+    )
+    assert rows == [
+        {"name": "Back Squat", "category": "SQUAT", "exercise": "BACK_SQUAT"}
+    ]
+
+
+def test_parse_keeps_capturing_after_nested_span_closes(gen):
+    # A plain in/out flag drops back "out of span" on the inner </span>,
+    # losing text that follows it but is still inside the outer span.
+    rows = gen.parse(
+        '<li data-category-key="SQUAT" data-exercise-key="BACK_SQUAT">'
+        "<span><span>Back</span> Squat</span></li>"
+    )
+    assert rows == [
+        {"name": "Back Squat", "category": "SQUAT", "exercise": "BACK_SQUAT"}
+    ]