diff --git a/helpers/undici/index.js b/helpers/undici/index.js
index 9c761756e..ba0e14bcd 100644
--- a/helpers/undici/index.js
+++ b/helpers/undici/index.js
@@ -13,7 +13,7 @@ const copies = {
 };
 
 export const bundledVersion = process.versions.undici;
-export const packageName = copies[Number(bundledVersion.split(".", 1)[0])];
+export const packageName = copies[Number(bundledVersion?.split(".", 1)[0])];
 
 if (!packageName) {
   throw new Error(
diff --git a/jsconfig.base.json b/jsconfig.base.json
index c7adc1642..bf528c87c 100644
--- a/jsconfig.base.json
+++ b/jsconfig.base.json
@@ -8,6 +8,7 @@
     "resolveJsonModule": true,
     "skipLibCheck": true,
     "strict": false,
+    "strictNullChecks": true,
     "target": "ESNext",
     "types": [],
     "useUnknownInCatchVariables": true
diff --git a/packages/endpoint-auth/lib/client.js b/packages/endpoint-auth/lib/client.js
index f4d61966a..bc8497760 100644
--- a/packages/endpoint-auth/lib/client.js
+++ b/packages/endpoint-auth/lib/client.js
@@ -63,7 +63,7 @@ export const getApplicationInformation = (body, client) => {
   for (const item of items) {
     const { properties, type } = item;
 
-    if (/^h-(?:x-)?app$/.test(type[0])) {
+    if (type && /^h-(?:x-)?app$/.test(type[0])) {
       // If no URL property, use baseUrl
       if (!properties.url) {
         properties.url = [client.url];
diff --git a/packages/endpoint-auth/lib/controllers/introspection.js b/packages/endpoint-auth/lib/controllers/introspection.js
index 22f2aa4bf..cf549add5 100644
--- a/packages/endpoint-auth/lib/controllers/introspection.js
+++ b/packages/endpoint-auth/lib/controllers/introspection.js
@@ -14,7 +14,11 @@ export const introspectionController = {
 
       if (!token) {
         // Remove ‘Bearer ’ from authorization header
-        token = request.headers.authorization.trim().split(/\s+/, 2)[1];
+        token = request.headers.authorization?.trim().split(/\s+/, 2)[1];
+      }
+
+      if (!token) {
+        return response.json({ active: false });
       }
 
       let accessToken = verifyToken(token);
diff --git a/packages/endpoint-auth/lib/controllers/userinfo.js b/packages/endpoint-auth/lib/controllers/userinfo.js
index 5e744dcd4..ed337fc6f 100644
--- a/packages/endpoint-auth/lib/controllers/userinfo.js
+++ b/packages/endpoint-auth/lib/controllers/userinfo.js
@@ -20,6 +20,10 @@ export const userinfoController =
       try {
         // Remove ‘Bearer ’ from authorization header
         const token = request.headers.authorization?.trim().split(/\s+/, 2)[1];
+        if (!token) {
+          throw new Error("No token");
+        }
+
         accessToken = verifyToken(token);
       } catch {
         throw IndiekitError.unauthorized(
diff --git a/packages/endpoint-files/lib/controllers/files.js b/packages/endpoint-files/lib/controllers/files.js
index 598ca098d..68cd54a92 100644
--- a/packages/endpoint-files/lib/controllers/files.js
+++ b/packages/endpoint-files/lib/controllers/files.js
@@ -10,7 +10,8 @@ import { getFileName } from "../utils.js";
 export const filesController = async (request, response, next) => {
   try {
     const { application } = request.app.locals;
-    const { access_token, scope } = request.session;
+    const access_token = request.session?.access_token;
+    const scope = request.session?.scope;
     const { after, before, success } = request.query;
     const limit = Number(request.query.limit) || 20;
 
diff --git a/packages/endpoint-files/lib/utils.js b/packages/endpoint-files/lib/utils.js
index 4ff8651ba..bfb47b667 100644
--- a/packages/endpoint-files/lib/utils.js
+++ b/packages/endpoint-files/lib/utils.js
@@ -40,7 +40,7 @@ export const getFileProperties = async (uid, mediaEndpoint, accessToken) => {
  */
 export const getFileName = (url) => {
   const { pathname } = new URL(url);
-  return pathname.split("/").pop();
+  return pathname.slice(pathname.lastIndexOf("/") + 1);
 };
 
 /**
diff --git a/packages/endpoint-media/lib/controllers/action.js b/packages/endpoint-media/lib/controllers/action.js
index f305293b6..17dd3a67b 100644
--- a/packages/endpoint-media/lib/controllers/action.js
+++ b/packages/endpoint-media/lib/controllers/action.js
@@ -19,7 +19,7 @@ export const actionController = (imageProcessing) =>
 
     try {
       // Check provided scope
-      const { scope } = session;
+      const scope = session?.scope;
       const hasScope = checkScope(scope);
       if (!hasScope) {
         throw IndiekitError.insufficientScope(
diff --git a/packages/endpoint-media/lib/file.js b/packages/endpoint-media/lib/file.js
index 897dda1b3..13a5693d7 100644
--- a/packages/endpoint-media/lib/file.js
+++ b/packages/endpoint-media/lib/file.js
@@ -1,8 +1,24 @@
 import path from "node:path";
 
+import { IndiekitError } from "@indiekit/error";
 import { getDate, slugify } from "@indiekit/util";
 import { fileTypeFromBuffer } from "file-type";
 
+/**
+ * Get file type from file data
+ * @param {object} file - File object
+ * @returns {Promise<import("file-type").FileTypeResult>} File type
+ */
+const getFileType = async (file) => {
+  const fileType = await fileTypeFromBuffer(file.data);
+  if (!fileType) {
+    // Message is the media type; controller localises the error
+    throw IndiekitError.unsupportedMediaType(file.mimetype || "unknown");
+  }
+
+  return fileType;
+};
+
 /**
  * Derive properties from file data
  * @param {object} publication - Publication configuration
@@ -17,7 +33,7 @@ import { fileTypeFromBuffer } from "file-type";
  * }
  */
 export const getFileProperties = async (publication, file, timeZone) => {
-  const { ext } = await fileTypeFromBuffer(file.data);
+  const { ext } = await getFileType(file);
   const published = getPublishedProperty(timeZone);
 
   let basename = path.basename(file.name, path.extname(file.name));
@@ -39,7 +55,7 @@ export const getFileProperties = async (publication, file, timeZone) => {
  * @example getMediaType("brighton-pier.jpg") => "photo"
  */
 export const getMediaType = async (file) => {
-  const { mime } = await fileTypeFromBuffer(file.data);
+  const { mime } = await getFileType(file);
   const type = mime.split("/", 1)[0];
 
   if (type === "image") {
diff --git a/packages/endpoint-media/lib/scope.js b/packages/endpoint-media/lib/scope.js
index def0013a0..707be9165 100644
--- a/packages/endpoint-media/lib/scope.js
+++ b/packages/endpoint-media/lib/scope.js
@@ -1,6 +1,6 @@
 /**
  * Check provided scope(s) satisfies required scope
- * @param {string} scope - Provided scope (space separated)
+ * @param {string} [scope] - Provided scope (space separated)
  * @param {string} [action] - Required action
  * @returns {boolean} `true` if provided scope includes action
  */
diff --git a/packages/endpoint-media/test/unit/file.js b/packages/endpoint-media/test/unit/file.js
index 149207e43..537d6274e 100644
--- a/packages/endpoint-media/test/unit/file.js
+++ b/packages/endpoint-media/test/unit/file.js
@@ -1,4 +1,5 @@
 import { strict as assert } from "node:assert";
+import { Buffer } from "node:buffer";
 import { describe, it } from "node:test";
 
 import { getFixture } from "@indiekit-test/fixtures";
@@ -35,4 +36,21 @@ describe("endpoint-media/lib/file", () => {
     assert.equal(result.md5, "be7d321488de26f2eb38834af7162164");
     assert.equal(isValid(parseISO(result.published)), true);
   });
+
+  it("Throws error if file type can’t be determined", async () => {
+    const file = {
+      data: Buffer.from("Plain text"),
+      mimetype: "text/plain",
+      name: "notes.txt",
+    };
+
+    await assert.rejects(getMediaType(file), {
+      name: "UnsupportedMediaTypeError",
+      message: "text/plain",
+      status: 415,
+    });
+    await assert.rejects(getFileProperties({}, file, "UTC"), {
+      name: "UnsupportedMediaTypeError",
+    });
+  });
 });
diff --git a/packages/endpoint-micropub/lib/controllers/action.js b/packages/endpoint-micropub/lib/controllers/action.js
index 792266e33..2c976f816 100644
--- a/packages/endpoint-micropub/lib/controllers/action.js
+++ b/packages/endpoint-micropub/lib/controllers/action.js
@@ -18,7 +18,8 @@ export const actionController = async (request, response, next) => {
 
   try {
     // Check provided scope
-    const { scope, token } = session;
+    const scope = session?.scope;
+    const token = session?.token;
     const hasScope = checkScope(scope, action);
     if (!hasScope) {
       throw IndiekitError.insufficientScope(
diff --git a/packages/endpoint-micropub/lib/controllers/query.js b/packages/endpoint-micropub/lib/controllers/query.js
index c80b4144e..d322927f2 100644
--- a/packages/endpoint-micropub/lib/controllers/query.js
+++ b/packages/endpoint-micropub/lib/controllers/query.js
@@ -77,6 +77,9 @@ export const queryController = async (request, response, next) => {
           return response.json(getMf2Properties(mf2, properties));
         }
         // Return mf2 for published posts
+        /**
+         * @type {{ items: object[], hasNext: boolean, hasPrev: boolean, firstItem?: string, lastItem?: string }}
+         */
         let cursor = {
           items: [],
           hasNext: false,
diff --git a/packages/endpoint-micropub/lib/jf2.js b/packages/endpoint-micropub/lib/jf2.js
index a9cc736b4..2b411a673 100644
--- a/packages/endpoint-micropub/lib/jf2.js
+++ b/packages/endpoint-micropub/lib/jf2.js
@@ -215,15 +215,19 @@ export const getLocationProperty = (properties) => {
   if (typeof location === "string" && location.startsWith("geo:")) {
     const geoUriRegexp =
       /geo:(?<latitude>[\d+.?-]*),(?<longitude>[\d+.?-]*)(?:,(?<altitude>[\d+.?-]*))?/;
-    const { latitude, longitude, altitude } =
-      location.match(geoUriRegexp).groups;
-
-    location = {
-      type: "geo",
-      latitude,
-      longitude,
-      ...(altitude && { altitude }),
-    };
+    const groups = location.match(geoUriRegexp)?.groups;
+
+    // Leave an un-parseable Geo URI as given
+    if (groups) {
+      const { latitude, longitude, altitude } = groups;
+
+      location = {
+        type: "geo",
+        latitude,
+        longitude,
+        ...(altitude && { altitude }),
+      };
+    }
   }
 
   return location;
@@ -278,6 +282,9 @@ export const getSlugProperty = (properties, separator) => {
   const suggested = properties["mp-slug"];
   const { name, published } = properties;
 
+  /**
+   * @type {string}
+   */
   let string;
   if (suggested) {
     string = suggested;
diff --git a/packages/endpoint-micropub/lib/mf2.js b/packages/endpoint-micropub/lib/mf2.js
index 37931ed17..69f1ea754 100644
--- a/packages/endpoint-micropub/lib/mf2.js
+++ b/packages/endpoint-micropub/lib/mf2.js
@@ -1,7 +1,7 @@
 /**
  * Return mf2 properties of a post
  * @param {object} mf2 - mf2 object
- * @param {Array<string>|string} requestedProperties - mf2 properties to select
+ * @param {Array<string>|string} [requestedProperties] - mf2 properties to select
  * @returns {Promise<object>} mf2 with requested properties
  */
 export const getMf2Properties = (mf2, requestedProperties) => {
diff --git a/packages/endpoint-micropub/lib/post-data.js b/packages/endpoint-micropub/lib/post-data.js
index fddd1db08..69d74f1fa 100644
--- a/packages/endpoint-micropub/lib/post-data.js
+++ b/packages/endpoint-micropub/lib/post-data.js
@@ -15,13 +15,13 @@ const debug = makeDebug("indiekit:endpoint-micropub:post-data");
 /**
  * Get post type configuration, which must include a post path
  * @param {object} postTypes - Publication post types
- * @param {string} type - Post type
+ * @param {string|null} type - Post type
  * @returns {object} Post type configuration
  */
 const getTypeConfig = (postTypes, type) => {
-  const typeConfig = postTypes[type];
+  const typeConfig = type ? postTypes[type] : undefined;
   if (!typeConfig?.post?.path) {
-    throw IndiekitError.notImplemented(type);
+    throw IndiekitError.notImplemented(String(type));
   }
 
   return typeConfig;
diff --git a/packages/endpoint-micropub/lib/scope.js b/packages/endpoint-micropub/lib/scope.js
index d1f5d8552..6a133645f 100644
--- a/packages/endpoint-micropub/lib/scope.js
+++ b/packages/endpoint-micropub/lib/scope.js
@@ -1,6 +1,6 @@
 /**
  * Check provided scope(s) satisfies required scope
- * @param {string} scope - Provided scope (space separated)
+ * @param {string} [scope] - Provided scope (space separated)
  * @param {string} [action] - Required action
  * @returns {boolean|string} `true` if provided scope includes action,
  *                           `draft` if draft scope, otherwise `false`
diff --git a/packages/endpoint-micropub/test/unit/media.js b/packages/endpoint-micropub/test/unit/media.js
index 5e523fe18..55ad986ce 100644
--- a/packages/endpoint-micropub/test/unit/media.js
+++ b/packages/endpoint-micropub/test/unit/media.js
@@ -53,6 +53,7 @@ describe("endpoint-micropub/lib/media", () => {
   });
 
   it("Throws error no media endpoint URL", async () => {
+    // @ts-ignore: Testing invalid input
     await assert.rejects(uploadMedia(undefined, token, properties, files), {
       message: "Failed to parse URL from undefined",
     });
diff --git a/packages/endpoint-posts/lib/controllers/new.js b/packages/endpoint-posts/lib/controllers/new.js
index 96b1984c2..1f7e30f9d 100644
--- a/packages/endpoint-posts/lib/controllers/new.js
+++ b/packages/endpoint-posts/lib/controllers/new.js
@@ -14,7 +14,7 @@ export const newController = {
     const { publication } = request.app.locals;
     const postsPath = path.dirname(request.baseUrl + request.path);
     const postType = request.query.type;
-    const { scope } = request.session;
+    const scope = request.session?.scope;
 
     const postTypeItems = Object.values(publication.postTypes)
       .toSorted((a, b) => {
diff --git a/packages/endpoint-posts/lib/controllers/posts.js b/packages/endpoint-posts/lib/controllers/posts.js
index cca8bcf80..2c85bf287 100644
--- a/packages/endpoint-posts/lib/controllers/posts.js
+++ b/packages/endpoint-posts/lib/controllers/posts.js
@@ -15,7 +15,8 @@ import { getPostStatusBadges, getPostName, getPhotoUrl } from "../utils.js";
 export const postsController = async (request, response, next) => {
   try {
     const { application, publication } = request.app.locals;
-    const { access_token, scope } = request.session;
+    const access_token = request.session?.access_token;
+    const scope = request.session?.scope;
     const { after, before, success } = request.query;
     const limit = Number(request.query.limit) || 12;
 
diff --git a/packages/endpoint-posts/lib/utils.js b/packages/endpoint-posts/lib/utils.js
index 86ba2867d..db719b5f6 100644
--- a/packages/endpoint-posts/lib/utils.js
+++ b/packages/endpoint-posts/lib/utils.js
@@ -26,7 +26,12 @@ export const getChannelItems = (publication) => {
  * @returns {object} JF2 geo location property
  */
 export const getGeoProperty = (geo) => {
-  const { latitude, longitude } = geo.match(ISO_6709_RE).groups;
+  const groups = geo.match(ISO_6709_RE)?.groups;
+  if (!groups) {
+    throw IndiekitError.badRequest(`Invalid geographic coordinates: ${geo}`);
+  }
+
+  const { latitude, longitude } = groups;
 
   return {
     type: "geo",
diff --git a/packages/error/test/index.js b/packages/error/test/index.js
index 2e80f1d05..ea351ff64 100644
--- a/packages/error/test/index.js
+++ b/packages/error/test/index.js
@@ -44,6 +44,7 @@ describe("error", () => {
         indiekitError();
       },
       (error) => {
+        assert.ok(error instanceof IndiekitError);
         assert.equal(error.toString(), "IndiekitError: Message");
         return true;
       },
diff --git a/packages/frontend/components/add-another/index.js b/packages/frontend/components/add-another/index.js
index 35d5e83bb..5285803c8 100644
--- a/packages/frontend/components/add-another/index.js
+++ b/packages/frontend/components/add-another/index.js
@@ -1,3 +1,5 @@
+import { getElement } from "../../scripts/utils/get-element";
+
 const focusableSelector = `button:not([disabled]), input:not([disabled]):not([type="hidden"]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"]`;
 
 export const AddAnotherComponent = class extends HTMLElement {
@@ -22,10 +24,10 @@ export const AddAnotherComponent = class extends HTMLElement {
   $list;
 
   connectedCallback() {
-    this.$addButtonTemplate = this.querySelector("#add-button");
-    this.$deleteButtonTemplate = this.querySelector("#delete-button");
+    this.$addButtonTemplate = getElement(this, "#add-button");
+    this.$deleteButtonTemplate = getElement(this, "#delete-button");
     this.$$fields = this.querySelectorAll(".field");
-    this.$list = this.querySelector(".add-another__list");
+    this.$list = getElement(this, ".add-another__list");
 
     this.updateItems();
     this.createAddButton();
@@ -70,7 +72,7 @@ export const AddAnotherComponent = class extends HTMLElement {
    * @returns {HTMLLegendElement} - Group legend
    */
   getHeading() {
-    return this.querySelector("legend");
+    return getElement(this, "legend");
   }
 
   /**
@@ -91,14 +93,14 @@ export const AddAnotherComponent = class extends HTMLElement {
 
     this.append($addButton);
 
-    $addButton = this.querySelector(".add-another__add");
+    $addButton = getElement(this, ".add-another__add");
     $addButton.addEventListener("click", (event) => this.add(event));
   }
 
   /**
    * Get delete button
    * @param {HTMLElement} element - Containing element
-   * @returns {HTMLButtonElement} - Delete button
+   * @returns {HTMLButtonElement|null} - Delete button
    */
   getDeleteButton(element) {
     return element.querySelector(".add-another__delete");
@@ -109,8 +111,10 @@ export const AddAnotherComponent = class extends HTMLElement {
    * @param {HTMLElement} element - Containing element
    */
   createDeleteButton(element) {
-    const $deleteButton =
-      this.$deleteButtonTemplate.content.firstElementChild.cloneNode(true);
+    const $deleteButton = getElement(
+      this.$deleteButtonTemplate.content,
+      ".add-another__delete",
+    ).cloneNode(true);
 
     element.append($deleteButton);
   }
@@ -121,6 +125,11 @@ export const AddAnotherComponent = class extends HTMLElement {
    */
   updateDeleteButton(element) {
     const $deleteButton = this.getDeleteButton(element);
+
+    if (!$deleteButton) {
+      return;
+    }
+
     $deleteButton.setAttribute("aria-labelledby", `delete-title ${element.id}`);
     $deleteButton.addEventListener("click", (event) => this.delete(event));
   }
@@ -161,6 +170,11 @@ export const AddAnotherComponent = class extends HTMLElement {
     const $$labels = $item.querySelectorAll("label");
     for (const $label of $$labels) {
       const forAttribute = $label.getAttribute("for");
+
+      if (!forAttribute) {
+        continue;
+      }
+
       $label.setAttribute("for", forAttribute.replace("-0", `-${uid}`));
     }
 
@@ -190,13 +204,13 @@ export const AddAnotherComponent = class extends HTMLElement {
         this.createDeleteButton($item);
       }
 
+      const $deleteButton = this.getDeleteButton($item);
+
       // If has delete button
-      if (this.getDeleteButton($item)) {
+      if ($deleteButton) {
         if ($$items.length === 1) {
-          // If only 1 item in list, remove button
-          this.getDeleteButton($item).remove();
+          $deleteButton.remove();
         } else {
-          // Else update button attributes
           this.updateDeleteButton($item);
         }
       }
diff --git a/packages/frontend/components/character-count/index.js b/packages/frontend/components/character-count/index.js
index 73472dff9..699a4e440 100644
--- a/packages/frontend/components/character-count/index.js
+++ b/packages/frontend/components/character-count/index.js
@@ -1,3 +1,5 @@
+import { getElement } from "../../scripts/utils/get-element";
+
 /**
  * Based on the Character count component from the GOV.UK Design System.
  * Provides a visible, real-time character and word count, and visually
@@ -9,6 +11,31 @@
  * @see {@link https://dav-idc.com/making-a-character-count-component-more-accessible}
  */
 export const CharacterCountComponent = class extends HTMLElement {
+  /**
+   * @type {string}
+   */
+  i18nChar;
+
+  /**
+   * @type {string}
+   */
+  i18nChars;
+
+  /**
+   * @type {string}
+   */
+  i18nWord;
+
+  /**
+   * @type {string}
+   */
+  i18nWords;
+
+  /**
+   * @type {HTMLTextAreaElement}
+   */
+  $textarea;
+
   constructor() {
     super();
 
@@ -19,13 +46,8 @@ export const CharacterCountComponent = class extends HTMLElement {
     this.$screenReaderCountMessage = document.createElement("p");
     this.$screenReaderCountMessage.className = "-!-visually-hidden";
     this.$screenReaderCountMessage.setAttribute("aria-live", "polite");
-    this.$textareaDescription.insertAdjacentElement(
-      "afterend",
-      this.$screenReaderCountMessage,
-    );
 
     this.$visibleCountMessage = document.createElement("p");
-    this.$visibleCountMessage.className = this.$textareaDescription.className;
     this.$visibleCountMessage.setAttribute("aria-hidden", "true");
   }
 
@@ -168,17 +190,20 @@ export const CharacterCountComponent = class extends HTMLElement {
     this.i18nWord = this.getAttribute("i18n-word") || `%s word`;
     this.i18nWords = this.getAttribute("i18n-words") || `%s words`;
 
-    this.$textarea = this.querySelector("textarea");
+    this.$textarea = getElement(this, "textarea");
     this.$textarea.addEventListener("keyup", this.#handleKeyUp.bind(this));
     this.$textarea.addEventListener("focus", this.#handleFocus.bind(this));
     this.$textarea.addEventListener("blur", this.#handleBlur.bind(this));
     window.addEventListener("pageshow", this.#updateCountMessages.bind(this));
     this.#updateCountMessages();
 
-    this.$textareaDescription = this.querySelector(
-      `#${this.$textarea.id}-info`,
-    );
+    this.$textareaDescription = getElement(this, `#${this.$textarea.id}-info`);
     this.$textareaDescription.classList.add("-!-visually-hidden");
+    this.$textareaDescription.insertAdjacentElement(
+      "afterend",
+      this.$screenReaderCountMessage,
+    );
+    this.$visibleCountMessage.className = this.$textareaDescription.className;
     this.$textareaDescription.insertAdjacentElement(
       "afterend",
       this.$visibleCountMessage,
diff --git a/packages/frontend/components/checkboxes/index.js b/packages/frontend/components/checkboxes/index.js
index a9022cb64..ab5fb055f 100644
--- a/packages/frontend/components/checkboxes/index.js
+++ b/packages/frontend/components/checkboxes/index.js
@@ -3,6 +3,11 @@
  * @see {@link https://github.com/alphagov/govuk-frontend/blob/main/packages/govuk-frontend/src/govuk/components/checkboxes/checkboxes.mjs}
  */
 export const CheckboxesFieldComponent = class extends HTMLElement {
+  /**
+   * @type {NodeListOf<HTMLInputElement>}
+   */
+  $$inputTargets;
+
   connectedCallback() {
     this.$$inputTargets = this.querySelectorAll("input");
     for (const $input of this.$$inputTargets) {
diff --git a/packages/frontend/components/error-summary/index.js b/packages/frontend/components/error-summary/index.js
index 8246ad43b..edaa212d8 100644
--- a/packages/frontend/components/error-summary/index.js
+++ b/packages/frontend/components/error-summary/index.js
@@ -62,10 +62,14 @@ export const ErrorSummaryComponent = class extends HTMLElement {
 
     const fragment = this.getFragmentFromUrl($target.href);
 
-    /**
-     * @satisfies {HTMLInputElement}
-     */
-    const $input = document.querySelector(`#${fragment}`);
+    if (!fragment) {
+      return false;
+    }
+
+    const $input = /** @type {HTMLInputElement|null} */ (
+      document.querySelector(`#${CSS.escape(fragment)}`)
+    );
+
     if (!$input) {
       return false;
     }
@@ -85,11 +89,12 @@ export const ErrorSummaryComponent = class extends HTMLElement {
 
   /**
    * Get fragment name from a URL
-   * @param {string} url - URL
-   * @returns {string|boolean} Fragment name (without the hash)
+   * @param {string} url - Absolute or relative URL, or a bare fragment
+   * @returns {string|undefined} Fragment name (without hash), undefined if none
    */
   getFragmentFromUrl(url) {
-    return !url.startsWith("#") && url.split("#").pop();
+    const index = url.indexOf("#");
+    return index === -1 ? undefined : url.slice(index + 1);
   }
 
   /**
@@ -103,7 +108,7 @@ export const ErrorSummaryComponent = class extends HTMLElement {
    * - The first `<label>` that is associated with the input using for="inputId"
    * - The closest parent `<label>`
    * @param {HTMLInputElement} $input - The input
-   * @returns {HTMLLegendElement|HTMLLabelElement} Associated legend or label
+   * @returns {HTMLLegendElement|HTMLLabelElement|null} Associated legend or label
    */
   getAssociatedLegendOrLabel($input) {
     const $fieldset = $input.closest("fieldset");
diff --git a/packages/frontend/components/event-duration/index.js b/packages/frontend/components/event-duration/index.js
index aa70ce0d2..6aa826cef 100644
--- a/packages/frontend/components/event-duration/index.js
+++ b/packages/frontend/components/event-duration/index.js
@@ -1,3 +1,5 @@
+import { getElement } from "../../scripts/utils/get-element";
+
 export const EventDurationComponent = class extends HTMLElement {
   /**
    * @type {HTMLInputElement}
@@ -10,7 +12,7 @@ export const EventDurationComponent = class extends HTMLElement {
   $$dateTimeInputs;
 
   connectedCallback() {
-    this.$allDayToggle = this.querySelector(`input[type="checkbox"]`);
+    this.$allDayToggle = getElement(this, `input[type="checkbox"]`);
     this.$$dateTimeInputs = this.querySelectorAll(
       `input[type="datetime-local"]`,
     );
diff --git a/packages/frontend/components/file-input/index.js b/packages/frontend/components/file-input/index.js
index d856f2c0b..abe84bd31 100644
--- a/packages/frontend/components/file-input/index.js
+++ b/packages/frontend/components/file-input/index.js
@@ -1,8 +1,14 @@
 import { IndiekitError } from "@indiekit/error";
 
+import { getElement } from "../../scripts/utils/get-element.js";
 import { wrapElement } from "../../scripts/utils/wrap-element.js";
 
 export const FileInputFieldController = class extends HTMLElement {
+  /**
+   * @type {string}
+   */
+  endpoint;
+
   /**
    * @type {HTMLElement}
    */
@@ -29,13 +35,19 @@ export const FileInputFieldController = class extends HTMLElement {
   $errorMessageTemplate;
 
   connectedCallback() {
-    this.endpoint = this.getAttribute("endpoint");
+    const endpoint = this.getAttribute("endpoint");
+
+    if (!endpoint) {
+      throw new Error("File input requires an `endpoint` attribute");
+    }
+
+    this.endpoint = endpoint;
 
-    this.$uploadProgress = this.querySelector(".file-input__progress");
-    this.$fileInputPath = this.querySelector(".file-input__path");
-    this.$fileInputPicker = this.querySelector(".file-input__picker");
-    this.$fileInputPickerTemplate = this.querySelector("#file-input-picker");
-    this.$errorMessageTemplate = this.querySelector("#error-message");
+    this.$uploadProgress = getElement(this, ".file-input__progress");
+    this.$fileInputPath = getElement(this, ".file-input__path");
+    this.$fileInputPicker = getElement(this, ".file-input__picker");
+    this.$fileInputPickerTemplate = getElement(this, "#file-input-picker");
+    this.$errorMessageTemplate = getElement(this, "#error-message");
 
     if (!this.$fileInputPicker) {
       // Create group to hold input and button
@@ -53,7 +65,7 @@ export const FileInputFieldController = class extends HTMLElement {
       $inputButtonGroup.append($fileInputPicker);
 
       // Update `this.$fileInputPicker`
-      this.$fileInputPicker = this.querySelector(".file-input__picker");
+      this.$fileInputPicker = getElement(this, ".file-input__picker");
     }
 
     // Make file input label behave like a button to trigger file input
@@ -89,8 +101,10 @@ export const FileInputFieldController = class extends HTMLElement {
     });
 
     // Add event to file input
-    const $fileInputFile =
-      this.$fileInputPicker.querySelector(`.file-input__file`);
+    const $fileInputFile = getElement(
+      this.$fileInputPicker,
+      ".file-input__file",
+    );
     $fileInputFile.addEventListener("change", (event) => this.fetch(event));
   }
 
@@ -99,12 +113,17 @@ export const FileInputFieldController = class extends HTMLElement {
    * @param {Event} event - File input event
    */
   async fetch(event) {
+    const $target = /** @type {HTMLInputElement} */ (event.target);
+    const [file] = $target.files ?? [];
+
+    if (!file) {
+      return;
+    }
+
     this.$uploadProgress.hidden = false;
 
-    const $target = /** @type {HTMLInputElement} */ (event.target);
     const formData = new FormData();
-
-    formData.append("file", $target.files[0]);
+    formData.append("file", file);
 
     try {
       this.$fileInputPath.readOnly = true;
@@ -121,8 +140,13 @@ export const FileInputFieldController = class extends HTMLElement {
         throw await IndiekitError.fromFetch(endpointResponse);
       }
 
-      this.$fileInputPath.value =
-        await endpointResponse.headers.get("location");
+      const location = endpointResponse.headers.get("location");
+
+      if (!location) {
+        throw new Error("No location for uploaded file");
+      }
+
+      this.$fileInputPath.value = location;
       this.$fileInputPath.readOnly = false;
       this.$uploadProgress.hidden = true;
     } catch (error) {
diff --git a/packages/frontend/components/geo-input/index.js b/packages/frontend/components/geo-input/index.js
index add87ec33..c07bd01a8 100644
--- a/packages/frontend/components/geo-input/index.js
+++ b/packages/frontend/components/geo-input/index.js
@@ -1,3 +1,4 @@
+import { getElement } from "../../scripts/utils/get-element.js";
 import { wrapElement } from "../../scripts/utils/wrap-element.js";
 
 export const GeoInputFieldComponent = class extends HTMLElement {
@@ -25,10 +26,10 @@ export const GeoInputFieldComponent = class extends HTMLElement {
     this.i18nDenied = this.getAttribute("i18n-denied");
     this.i18nFailed = this.getAttribute("i18n-failed");
 
-    this.$geoInput = this.querySelector(".geo-input");
-    this.$geoInputButton = this.querySelector(".geo-input__button");
-    this.$geoInputButtonTemplate = this.querySelector("#geo-input-button");
-    this.$errorMessageTemplate = this.querySelector("#error-message");
+    this.$geoInput = getElement(this, ".geo-input");
+    this.$geoInputButton = getElement(this, ".geo-input__button");
+    this.$geoInputButtonTemplate = getElement(this, "#geo-input-button");
+    this.$errorMessageTemplate = getElement(this, "#error-message");
 
     if (!navigator.geolocation) {
       return;
@@ -50,7 +51,7 @@ export const GeoInputFieldComponent = class extends HTMLElement {
       $inputButtonGroup.append($geoInputButton);
 
       // Update `this.$geoInputButton`
-      this.$geoInputButton = this.querySelector(".geo-input__button");
+      this.$geoInputButton = getElement(this, ".geo-input__button");
     }
 
     // Add event to cloned button
diff --git a/packages/frontend/components/radios/index.js b/packages/frontend/components/radios/index.js
index b69487e7e..a316911f3 100644
--- a/packages/frontend/components/radios/index.js
+++ b/packages/frontend/components/radios/index.js
@@ -3,6 +3,11 @@
  * @see {@link https://github.com/alphagov/govuk-frontend/blob/main/packages/govuk-frontend/src/govuk/components/radios/radios.mjs}
  */
 export const RadiosFieldComponent = class extends HTMLElement {
+  /**
+   * @type {NodeListOf<HTMLInputElement>}
+   */
+  $$inputTargets;
+
   connectedCallback() {
     this.$$inputTargets = this.querySelectorAll("input");
     for (const $input of this.$$inputTargets) {
diff --git a/packages/frontend/components/share-preview/index.js b/packages/frontend/components/share-preview/index.js
index 8694a2654..a0baa346d 100644
--- a/packages/frontend/components/share-preview/index.js
+++ b/packages/frontend/components/share-preview/index.js
@@ -36,6 +36,7 @@ export const SharePreviewComponent = class extends HTMLElement {
    */
   updatePreview($outputElement) {
     const { classList, dataset } = $outputElement;
+    const placeholder = dataset.placeholder ?? "";
     const htmlFor = $outputElement.htmlFor.value;
     const $inputElement = /** @type {HTMLInputElement | null} */ (
       document.querySelector(`[name=${CSS.escape(htmlFor)}]`)
@@ -46,7 +47,7 @@ export const SharePreviewComponent = class extends HTMLElement {
     }
 
     classList.add("placeholder");
-    $outputElement.value = dataset.placeholder;
+    $outputElement.value = placeholder;
 
     $inputElement.addEventListener("input", () => {
       if ($inputElement.value) {
@@ -54,7 +55,7 @@ export const SharePreviewComponent = class extends HTMLElement {
         $outputElement.value = decodeURIComponent($inputElement.value);
       } else {
         classList.add("placeholder");
-        $outputElement.value = dataset.placeholder;
+        $outputElement.value = placeholder;
       }
     });
   }
diff --git a/packages/frontend/components/tag-input/index.js b/packages/frontend/components/tag-input/index.js
index 67f4fb757..ecc97490b 100644
--- a/packages/frontend/components/tag-input/index.js
+++ b/packages/frontend/components/tag-input/index.js
@@ -1,11 +1,13 @@
 import TagInput from "@accessible-components/tag-input";
 
+import { getElement } from "../../scripts/utils/get-element";
+
 export const TagInputFieldComponent = class extends HTMLElement {
   connectedCallback() {
-    this.$errorMessage = this.querySelector(".error-message");
-    this.$hint = this.querySelector(".hint");
-    this.$replacedLabel = this.querySelector(".label");
-    this.$replacedInput = this.querySelector(".input");
+    this.$errorMessage = getElement(this, ".error-message");
+    this.$hint = getElement(this, ".hint");
+    this.$replacedLabel = getElement(this, ".label");
+    this.$replacedInput = getElement(this, ".input");
     this.value = this.$replacedInput.getAttribute("value");
 
     const tags = this.value ? this.value.split(",") : [];
@@ -35,7 +37,8 @@ export const TagInputFieldComponent = class extends HTMLElement {
       this.insertBefore(this.$errorMessage, this.querySelector(".tag-input"));
     }
 
-    this.querySelector(".tag-input-label").classList.add("label");
+    const $tagInputLabel = getElement(this, ".tag-input-label");
+    $tagInputLabel.classList.add("label");
 
     this.$replacedLabel.remove();
     this.$replacedInput.remove();
@@ -43,7 +46,7 @@ export const TagInputFieldComponent = class extends HTMLElement {
     /**
      * @type {HTMLInputElement}
      */
-    const $tagInputInput = this.querySelector(".tag-input__input");
+    const $tagInputInput = getElement(this, ".tag-input__input");
 
     // Add a tag when the Comma key is pressed. This matches the parsing done
     // when JavaScript is not enabled, meaning hint text correct in both cases.
diff --git a/packages/frontend/components/textarea/index.js b/packages/frontend/components/textarea/index.js
index 1acb02ad6..3f6c9eb84 100644
--- a/packages/frontend/components/textarea/index.js
+++ b/packages/frontend/components/textarea/index.js
@@ -1,5 +1,7 @@
 import EasyMDE from "easymde";
 
+import { getElement } from "../../scripts/utils/get-element";
+
 const paths = {
   bold: "M17 30c6.1 0 10-3 10-8 0-3.5-2.7-6.3-6.5-6.5V15c3-.4 5-3 5-6 0-4.5-3.5-7-9-7H5v28h12ZM12 7h2c2.5 0 4 1 4 3 0 1.5-1.5 3-4 3h-2V7Zm0 18v-7h2.3c3.1 0 4.7 1.1 4.7 3.4 0 2.5-1.4 3.6-4.8 3.6H12Z",
   code: "m13.5 8.5-3-3L2 14C.5 15.5.5 16.5 2 18l8.5 8.5 3-3L6 16l7.5-7.5Zm5 0 3-3L30 14c1.5 1.5 1.5 2.5 0 4l-8.5 8.5-3-3L26 16l-7.5-7.5Z",
@@ -35,6 +37,11 @@ const getButtonSvg = (name) => {
 };
 
 export const TextareaFieldComponent = class extends HTMLElement {
+  /**
+   * @type {HTMLTextAreaElement}
+   */
+  $textarea;
+
   connectedCallback() {
     this.editor = this.getAttribute("editor");
 
@@ -42,14 +49,14 @@ export const TextareaFieldComponent = class extends HTMLElement {
       return;
     }
 
-    this.editorEndpoint = this.getAttribute("editor-endpoint");
+    this.editorEndpoint = this.getAttribute("editor-endpoint") ?? undefined;
     this.editorId = this.getAttribute("editor-id");
     this.editorImageUpload = this.getAttribute("editor-image-upload");
     this.editorLocale = this.getAttribute("editor-locale");
     this.editorStatus = this.getAttribute("editor-status");
     this.editorToolbar = this.getAttribute("editor-toolbar");
-    this.$label = this.querySelector("label");
-    this.$textarea = this.querySelector("textarea");
+    this.$label = getElement(this, "label");
+    this.$textarea = getElement(this, "textarea");
 
     const status = this?.editorStatus !== "false" && [
       ...(this.editorImageUpload === "false" ? [] : ["upload-image"]),
@@ -92,7 +99,7 @@ export const TextareaFieldComponent = class extends HTMLElement {
       minHeight: "6rem",
       previewClass: ["editor-preview", "s-flow"],
       status,
-      // @ts-ignore
+      // @ts-expect-error
       toolbar,
       unorderedListStyle: "-",
     });
@@ -152,7 +159,7 @@ export const TextareaFieldComponent = class extends HTMLElement {
      * Restore label behaviour
      * @type {HTMLTextAreaElement}
      */
-    const $codeMirrorTextarea = this.querySelector(".CodeMirror textarea");
+    const $codeMirrorTextarea = getElement(this, ".CodeMirror textarea");
     this.$label.addEventListener("click", () => {
       $codeMirrorTextarea.focus();
     });
@@ -161,7 +168,7 @@ export const TextareaFieldComponent = class extends HTMLElement {
      * Update character count
      * @type {HTMLElement}
      */
-    const $characters = this.querySelector(".editor-statusbar .characters");
+    const $characters = getElement(this, ".editor-statusbar .characters");
     editor.codemirror.on("update", () => {
       if ($characters) {
         $characters.innerHTML = String(editor.value().length);
diff --git a/packages/frontend/lib/globals/item-id.js b/packages/frontend/lib/globals/item-id.js
index bb634c3b7..c01488b38 100644
--- a/packages/frontend/lib/globals/item-id.js
+++ b/packages/frontend/lib/globals/item-id.js
@@ -1,6 +1,6 @@
 /**
  * Get item `id` for radio/checkbox
- * @param {string} id - Item `id`
+ * @param {string|undefined} id - Item `id`
  * @param {string} idPrefix - Prefix for each item `id` if no `id` specified
  * @param {object} loop - Nunjucks for loop object
  * @returns {string} Item `id`
diff --git a/packages/frontend/lib/serviceworker.js b/packages/frontend/lib/serviceworker.js
index c598babf7..825b44e82 100644
--- a/packages/frontend/lib/serviceworker.js
+++ b/packages/frontend/lib/serviceworker.js
@@ -10,7 +10,7 @@ const placeholderImage = `<svg xmlns="http://www.w3.org/2000/svg"><defs><path id
 
 /**
  * Update asset cache
- * @returns {Promise<Cache>} - Updated asset cache
+ * @returns {Promise<void>} - Updated asset cache
  */
 async function updateAssetCache() {
   try {
@@ -21,8 +21,6 @@ async function updateAssetCache() {
 
     // These items must be cached for service worker to complete installation
     await assetCache.addAll(["APP_CSS_PATH", "APP_JS_PATH", "/offline"]);
-
-    return assetCache;
   } catch (error) {
     console.error("Error updating asset cache", error);
   }
@@ -30,7 +28,7 @@ async function updateAssetCache() {
 
 /**
  * Cache the page(s) that initiate the service worker
- * @returns {Promise<Cache>} - Updated page cache
+ * @returns {Promise<void>} - Updated page cache
  */
 async function cacheClients() {
   const pages = [];
@@ -43,8 +41,6 @@ async function cacheClients() {
 
     const pagesCache = await caches.open(pagesCacheName);
     await pagesCache.addAll(pages);
-
-    return pagesCache;
   } catch (error) {
     console.error("Error updating client cache", error);
   }
diff --git a/packages/frontend/lib/sharp.js b/packages/frontend/lib/sharp.js
index ac2871e50..9cbaa0eb0 100644
--- a/packages/frontend/lib/sharp.js
+++ b/packages/frontend/lib/sharp.js
@@ -32,7 +32,12 @@ export const appIcon = async (size, themeColor, purpose = "any") => {
  * @returns {Promise<Buffer>} PNG file
  */
 export const shortcutIcon = async (size, name) => {
-  return sharp(Buffer.from(icon(name)))
+  const svg = icon(name);
+  if (!svg) {
+    throw new Error(`Unknown icon: ${name}`);
+  }
+
+  return sharp(Buffer.from(svg))
     .resize(Number(size))
     .png({ colours: 16 })
     .toBuffer();
diff --git a/packages/frontend/scripts/utils/get-element.js b/packages/frontend/scripts/utils/get-element.js
new file mode 100644
index 000000000..f06369231
--- /dev/null
+++ b/packages/frontend/scripts/utils/get-element.js
@@ -0,0 +1,16 @@
+/**
+ * Get a descendant element, throwing if it is not present
+ * @template {Element} T
+ * @param {ParentNode} scope - Element to search within
+ * @param {string} selector - CSS selector
+ * @returns {T} Matching element
+ */
+export const getElement = (scope, selector) => {
+  const element = scope.querySelector(selector);
+
+  if (!element) {
+    throw new Error(`No element matching ${selector}`);
+  }
+
+  return /** @type {T} */ (element);
+};
diff --git a/packages/frontend/test/unit/globals/icon.js b/packages/frontend/test/unit/globals/icon.js
index f603bc828..bc358f33a 100644
--- a/packages/frontend/test/unit/globals/icon.js
+++ b/packages/frontend/test/unit/globals/icon.js
@@ -7,6 +7,7 @@ describe("frontend/lib/globals/icon", () => {
   it("Renders SVG icon", () => {
     const result = icon("note");
 
+    assert.ok(result);
     assert.equal(result.includes(`<svg class="icon"`), true);
     assert.equal(
       result.includes(
@@ -19,6 +20,7 @@ describe("frontend/lib/globals/icon", () => {
   it("Renders SVG icon with title", () => {
     const result = icon("note", "Note");
 
+    assert.ok(result);
     assert.equal(result.includes(`<title id="note-title">Note</title>`), true);
   });
 
diff --git a/packages/frontend/test/unit/serviceworker.js b/packages/frontend/test/unit/serviceworker.js
index 701a29fe7..e4543a7ec 100644
--- a/packages/frontend/test/unit/serviceworker.js
+++ b/packages/frontend/test/unit/serviceworker.js
@@ -2,9 +2,23 @@ import { strict as assert } from "node:assert";
 import { afterEach, before, describe, it, mock } from "node:test";
 
 // Service worker globals
+
+/**
+ * @type {Record<string, Array<(event: object) => void>>}
+ */
 const handlers = {};
+
+/**
+ * @type {{ fetch: (...args: unknown[]) => Promise<Response>, cacheMatchCount: number }}
+ */
+const state = {
+  fetch: () => {
+    throw new Error("state.fetch was not set by this test");
+  },
+  cacheMatchCount: 0,
+};
+
 const stores = new Map();
-const state = { fetch: undefined, cacheMatchCount: 0 };
 
 const location = new URL("https://indiekit.test/");
 const cacheKey = (request) =>
@@ -98,11 +112,15 @@ const dispatchFetch = (url, { accept = "text/html" } = {}) => {
 
 /**
  * Await a response, failing if none arrives within a second of real time
- * @param {Promise<Response>} result - Response promise
+ * @param {Promise<Response>|undefined} result - Response promise
  * @returns {Promise<Response>} Response
  */
-const settle = (result) =>
-  Promise.race([
+const settle = (result) => {
+  if (!result) {
+    throw new Error("Service worker did not respond");
+  }
+
+  return Promise.race([
     result,
     new Promise((resolve, reject) => {
       AbortSignal.timeout(1000).addEventListener("abort", () =>
@@ -110,6 +128,7 @@ const settle = (result) =>
       );
     }),
   ]);
+};
 
 describe("frontend/lib/serviceworker", () => {
   before(async () => {
diff --git a/packages/indiekit/lib/config.js b/packages/indiekit/lib/config.js
index c311bed31..2e70b410c 100644
--- a/packages/indiekit/lib/config.js
+++ b/packages/indiekit/lib/config.js
@@ -16,6 +16,10 @@ async function _getUserConfig(configFilePath) {
     ? explorer.load(configFilePath)
     : explorer.search());
 
+  if (!result) {
+    throw new Error("No Indiekit configuration found");
+  }
+
   return result.config;
 }
 
diff --git a/packages/indiekit/lib/controllers/session.js b/packages/indiekit/lib/controllers/session.js
index e3a391e0a..bda09b4bd 100644
--- a/packages/indiekit/lib/controllers/session.js
+++ b/packages/indiekit/lib/controllers/session.js
@@ -3,7 +3,7 @@
  * @type {RequestHandler}
  */
 export const login = (request, response) => {
-  if (request.session.access_token) {
+  if (request.session?.access_token) {
     return response.redirect("/");
   }
 
diff --git a/packages/indiekit/lib/indieauth.js b/packages/indiekit/lib/indieauth.js
index 0a8ba4234..8ee06c5b7 100644
--- a/packages/indiekit/lib/indieauth.js
+++ b/packages/indiekit/lib/indieauth.js
@@ -197,6 +197,9 @@ export const IndieAuth = class {
     const { devMode, me } = this;
 
     return async function (request, response, next) {
+      // `cookie-session` only returns `null` once a session has been cleared
+      request.session ??= {};
+
       if (devMode) {
         request.session.access_token = process.env.NODE_ENV;
         request.session.scope = "create update delete media";
diff --git a/packages/indiekit/lib/middleware/locals.js b/packages/indiekit/lib/middleware/locals.js
index d166dc3a1..ffa1176b8 100644
--- a/packages/indiekit/lib/middleware/locals.js
+++ b/packages/indiekit/lib/middleware/locals.js
@@ -54,8 +54,8 @@ export const locals = (Indiekit) =>
       request.app.locals.validationSchemas = Indiekit.validationSchemas;
 
       // Persist scope and token
-      request.app.locals.scope ||= request.session.scope;
-      request.app.locals.token ||= request.session.access_token;
+      request.app.locals.scope ||= request.session?.scope;
+      request.app.locals.token ||= request.session?.access_token;
 
       return next();
     } catch (error) {
diff --git a/packages/indiekit/lib/navigation.js b/packages/indiekit/lib/navigation.js
index 8cf1778cf..8b6aef2e1 100644
--- a/packages/indiekit/lib/navigation.js
+++ b/packages/indiekit/lib/navigation.js
@@ -9,8 +9,10 @@ export const getNavigation = (Indiekit, request, response) => {
   const { database, endpoints } = Indiekit;
 
   // Default navigation items
+  const isLoggedIn = Boolean(request.session?.access_token);
+
   let navigation = [
-    request.session.access_token
+    isLoggedIn
       ? {
           href: "/session/logout",
           text: "session.logout.title",
@@ -21,7 +23,7 @@ export const getNavigation = (Indiekit, request, response) => {
         },
   ];
 
-  if (request.session.access_token) {
+  if (isLoggedIn) {
     navigation.push({
       href: "/status",
       text: "status.title",
diff --git a/packages/indiekit/lib/utils.js b/packages/indiekit/lib/utils.js
index d85060491..aa651bf8f 100644
--- a/packages/indiekit/lib/utils.js
+++ b/packages/indiekit/lib/utils.js
@@ -40,7 +40,7 @@ export const decrypt = (hash, iv) => {
 /**
  * Get serviceworker.js and update asset versions
  * @param {object} application - Application locals
- * @returns {Promise<string>} - serviceworker.js file
+ * @returns {Promise<string|undefined>} - serviceworker.js file, if found
  */
 export const getServiceWorker = async (application) => {
   try {
diff --git a/packages/store-file-system/index.js b/packages/store-file-system/index.js
index 83b7d4bc0..355fb6443 100644
--- a/packages/store-file-system/index.js
+++ b/packages/store-file-system/index.js
@@ -53,14 +53,14 @@ export default class FileSystemStore {
    * Create file
    * @param {string} filePath - Path to file
    * @param {string} content - File content
-   * @returns {Promise<string>} Created file URL
+   * @returns {Promise<string|false>} Created file URL
    */
   async createFile(filePath, content) {
     try {
       const absolutePath = this.#absolutePath(filePath);
 
       if (existsSync(absolutePath)) {
-        return;
+        return false;
       }
 
       const dirname = path.dirname(absolutePath);
diff --git a/packages/store-file-system/test/index.js b/packages/store-file-system/test/index.js
index 542ba19c8..785cb6545 100644
--- a/packages/store-file-system/test/index.js
+++ b/packages/store-file-system/test/index.js
@@ -64,7 +64,7 @@ describe("store-file-system", () => {
 
     const result = await fileSystem.createFile("bar.txt", "foo");
 
-    assert.equal(result, undefined);
+    assert.equal(result, false);
   });
 
   it("Throws error creating file", async () => {
diff --git a/packages/store-ftp/index.js b/packages/store-ftp/index.js
index 544e0d1eb..6706d78fd 100644
--- a/packages/store-ftp/index.js
+++ b/packages/store-ftp/index.js
@@ -119,7 +119,7 @@ export default class FtpStore {
    * Create file
    * @param {string} filePath - Path to file
    * @param {string} content - File content
-   * @returns {Promise<string>} File created
+   * @returns {Promise<string|false>} File created
    */
   async createFile(filePath, content) {
     const client = await this.#client();
@@ -131,7 +131,7 @@ export default class FtpStore {
       // Return if file already exists
       const fileExists = await client.exists(absolutePath);
       if (fileExists) {
-        return;
+        return false;
       }
 
       // Create directory if doesn’t exist
diff --git a/packages/store-ftp/test/index.js b/packages/store-ftp/test/index.js
index 5e4a9b3ab..2ca106c8a 100644
--- a/packages/store-ftp/test/index.js
+++ b/packages/store-ftp/test/index.js
@@ -81,7 +81,7 @@ describe("store-ftp", () => {
   it("Doesn’t create file if already exists", async () => {
     await ftp.createFile("foo.md", "foobar");
 
-    assert.equal(await ftp.createFile("foo.md", "foobar"), undefined);
+    assert.equal(await ftp.createFile("foo.md", "foobar"), false);
   });
 
   it("Throws error creating file with no password", async () => {
@@ -110,6 +110,7 @@ describe("store-ftp", () => {
   });
 
   it("Throws error creating file", async () => {
+    // @ts-ignore: Testing invalid input
     await assert.rejects(ftp.createFile(undefined, ""), {
       message: `FTP store: The "path" argument must be of type string. Received undefined`,
     });
@@ -120,6 +121,7 @@ describe("store-ftp", () => {
   });
 
   it("Throws error reading file", async () => {
+    // @ts-ignore: Testing invalid input
     await assert.rejects(ftp.readFile(undefined), {
       message: `FTP store: The "path" argument must be of type string. Received undefined`,
     });
@@ -149,6 +151,7 @@ describe("store-ftp", () => {
   });
 
   it("Throws error updating file", async () => {
+    // @ts-ignore: Testing invalid input
     await assert.rejects(ftp.updateFile(undefined, "foobar"), {
       message: `FTP store: The "path" argument must be of type string. Received undefined`,
     });
@@ -159,6 +162,7 @@ describe("store-ftp", () => {
   });
 
   it("Throws error deleting file", async () => {
+    // @ts-ignore: Testing invalid input
     await assert.rejects(ftp.deleteFile(undefined), {
       message: `FTP store: The "path" argument must be of type string. Received undefined`,
     });
diff --git a/packages/store-gitea/index.js b/packages/store-gitea/index.js
index 4908ed227..d655a0f9d 100644
--- a/packages/store-gitea/index.js
+++ b/packages/store-gitea/index.js
@@ -130,13 +130,13 @@ export default class GiteaStore {
    * @param {string} content - File content
    * @param {object} options - Options
    * @param {string} options.message - Commit message
-   * @returns {Promise<string>} Created file URL
+   * @returns {Promise<string|false>} Created file URL
    * @see {@link https://gitea.com/api/swagger#/repository/repoCreateFile}
    */
   async createFile(filePath, content, { message }) {
     const fileExists = await this.fileExists(filePath);
     if (fileExists) {
-      return;
+      return false;
     }
 
     const createResponse = await this.#client(filePath, "POST", {
diff --git a/packages/store-gitea/test/index.js b/packages/store-gitea/test/index.js
index 0d185259f..c86756a98 100644
--- a/packages/store-gitea/test/index.js
+++ b/packages/store-gitea/test/index.js
@@ -68,7 +68,7 @@ describe("store-github", async () => {
       message: "Message",
     });
 
-    assert.equal(result, undefined);
+    assert.equal(result, false);
   });
 
   it("Creates file at custom instance", async () => {
diff --git a/packages/store-github/index.js b/packages/store-github/index.js
index 609e497d1..f66036f2b 100644
--- a/packages/store-github/index.js
+++ b/packages/store-github/index.js
@@ -139,7 +139,7 @@ export default class GithubStore {
    * @param {string} content - File content
    * @param {object} options - Options
    * @param {string} options.message - Commit message
-   * @returns {Promise<string>} Created file URL
+   * @returns {Promise<string|false>} Created file URL
    * @see {@link https://docs.github.com/en/rest/repos/contents#create-or-update-file-contents}
    */
   async createFile(filePath, content, { message }) {
@@ -148,7 +148,7 @@ export default class GithubStore {
     try {
       const fileExists = await this.fileExists(filePath);
       if (fileExists) {
-        return;
+        return false;
       }
 
       debug(`Try creating file ${filePath} in repo ${repo}, branch ${branch}`);
diff --git a/packages/store-github/test/index.js b/packages/store-github/test/index.js
index ba507a1b7..3c4e14893 100644
--- a/packages/store-github/test/index.js
+++ b/packages/store-github/test/index.js
@@ -62,7 +62,7 @@ describe("store-github", async () => {
       message: "Message",
     });
 
-    assert.equal(result, undefined);
+    assert.equal(result, false);
   });
 
   it("Throws error creating file with no token", async () => {
diff --git a/packages/store-gitlab/index.js b/packages/store-gitlab/index.js
index 856a56afd..52b14fde0 100644
--- a/packages/store-gitlab/index.js
+++ b/packages/store-gitlab/index.js
@@ -138,14 +138,14 @@ export default class GitlabStore {
    * @param {string} content - File content
    * @param {object} options - Options
    * @param {string} options.message - Commit message
-   * @returns {Promise<string>} Created file URL
+   * @returns {Promise<string|false>} Created file URL
    * @see {@link https://docs.gitlab.com/ee/api/repository_files.html#create-new-file-in-repository}
    */
   async createFile(filePath, content, { message }) {
     try {
       const fileExists = await this.fileExists(filePath);
       if (fileExists) {
-        return;
+        return false;
       }
 
       const createResponse = await this.#client.RepositoryFiles.create(
diff --git a/packages/store-gitlab/test/index.js b/packages/store-gitlab/test/index.js
index edd79e162..a95854309 100644
--- a/packages/store-gitlab/test/index.js
+++ b/packages/store-gitlab/test/index.js
@@ -70,7 +70,7 @@ describe("store-gitlab", async () => {
       message: "Message",
     });
 
-    assert.equal(result, undefined);
+    assert.equal(result, false);
   });
 
   it("Creates file with projectId at custom instance", async () => {
diff --git a/packages/store-s3/index.js b/packages/store-s3/index.js
index 6264ff729..7e880558f 100644
--- a/packages/store-s3/index.js
+++ b/packages/store-s3/index.js
@@ -134,7 +134,7 @@ export default class S3Store {
    * Create file
    * @param {string} filePath - Path to file
    * @param {string} content - File content
-   * @returns {Promise<string>} File created
+   * @returns {Promise<string|false>} File created
    */
   async createFile(filePath, content) {
     const putCommand = new PutObjectCommand({
@@ -147,7 +147,7 @@ export default class S3Store {
     try {
       const fileExists = await this.fileExists(filePath);
       if (fileExists) {
-        return;
+        return false;
       }
 
       const { ETag } = await this.client().send(putCommand);
@@ -158,6 +158,8 @@ export default class S3Store {
 
         return url.href;
       }
+
+      return false;
     } catch (error) {
       throw IndiekitError.fromCaught(error, { plugin: this.name });
     }
@@ -177,11 +179,11 @@ export default class S3Store {
     try {
       const { Body } = await this.client().send(getCommand);
 
-      if (Body) {
-        const content = await Body.transformToString();
-
-        return content;
+      if (!Body) {
+        throw new Error(`No content returned for ${filePath}`);
       }
+
+      return await Body.transformToString();
     } catch (error) {
       throw IndiekitError.fromCaught(error, { plugin: this.name });
     }
@@ -193,7 +195,7 @@ export default class S3Store {
    * @param {string} content - File content
    * @param {object} [options] - Options
    * @param {string} [options.newPath] - New path to file
-   * @returns {Promise<string>} Updated file URL
+   * @returns {Promise<string|false>} Updated file URL
    */
   async updateFile(filePath, content, options) {
     const putCommand = new PutObjectCommand({
@@ -229,6 +231,8 @@ export default class S3Store {
 
         return url.href;
       }
+
+      return false;
     } catch (error) {
       throw IndiekitError.fromCaught(error, { plugin: this.name });
     }
@@ -246,9 +250,9 @@ export default class S3Store {
     });
 
     try {
-      const thing = await this.client().send(deleteCommand);
+      await this.client().send(deleteCommand);
 
-      return thing.DeleteMarker;
+      return true;
     } catch (error) {
       throw IndiekitError.fromCaught(error, { plugin: this.name });
     }
diff --git a/packages/store-s3/test/index.js b/packages/store-s3/test/index.js
index 09d988c9c..aeb00c8db 100644
--- a/packages/store-s3/test/index.js
+++ b/packages/store-s3/test/index.js
@@ -73,7 +73,7 @@ describe("store-s3", () => {
   it("Doesn’t create file if already exists", async () => {
     mockS3Client.on(GetObjectCommand).resolves({ ETag: "true" });
 
-    assert.equal(await s3.createFile("foo.md", "foobar"), undefined);
+    assert.equal(await s3.createFile("foo.md", "foobar"), false);
   });
 
   it("Throws error creating file", async () => {
diff --git a/packages/syndicator-bluesky/lib/bluesky.js b/packages/syndicator-bluesky/lib/bluesky.js
index f4d3f51ea..a22f79bcb 100644
--- a/packages/syndicator-bluesky/lib/bluesky.js
+++ b/packages/syndicator-bluesky/lib/bluesky.js
@@ -84,7 +84,7 @@ export class Bluesky {
   /**
    * Post a like
    * @param {string} postUrl - URL of post to like
-   * @returns {Promise<string>} Bluesky post URL
+   * @returns {Promise<string|undefined>} Bluesky post URL
    */
   async postLike(postUrl) {
     const client = await this.#client();
@@ -97,7 +97,7 @@ export class Bluesky {
   /**
    * Post a repost
    * @param {string} postUrl - URL of post to repost
-   * @returns {Promise<string>} Bluesky post URL
+   * @returns {Promise<string|undefined>} Bluesky post URL
    */
   async postRepost(postUrl) {
     const client = await this.#client();
@@ -112,9 +112,9 @@ export class Bluesky {
    * @param {string} postUrl - URL of post to quote
    * @param {object} richText - Rich text
    * @param {import("@atproto/api").AppBskyEmbedImages.Image[]} [images] - Images
-   * @returns {Promise<string>} Bluesky post URL
+   * @returns {Promise<string|undefined>} Bluesky post URL
    */
-  async postQuotePost(postUrl, richText, images) {
+  async postQuotePost(postUrl, richText, images = []) {
     const client = await this.#client();
     const post = await this.getPost(postUrl);
 
@@ -143,7 +143,7 @@ export class Bluesky {
       media,
     };
 
-    const embed = images?.length > 0 ? recordWithMedia : record;
+    const embed = images.length > 0 ? recordWithMedia : record;
 
     /**
      * @type {import("@atproto/api").AppBskyFeedPost.Record}
@@ -167,11 +167,11 @@ export class Bluesky {
   /**
    * Post a post
    * @param {object} richText - Rich text
-   * @param {object} [images] - Images
+   * @param {import("@atproto/api").AppBskyEmbedImages.Image[]} [images] - Images
    * @param {object} [reply] - Reply reference
-   * @returns {Promise<string>} Bluesky post URL
+   * @returns {Promise<string|undefined>} Bluesky post URL
    */
-  async postPost(richText, images, reply) {
+  async postPost(richText, images = [], reply) {
     const client = await this.#client();
 
     /**
@@ -183,7 +183,7 @@ export class Bluesky {
       facets: richText.facets,
       createdAt: new Date().toISOString(),
       ...(reply && { reply }),
-      ...(images?.length > 0 && {
+      ...(images.length > 0 && {
         embed: {
           $type: "app.bsky.embed.images",
           images,
@@ -200,7 +200,7 @@ export class Bluesky {
    * Upload media
    * @param {object} media - JF2 media object
    * @param {string} me - Publication URL
-   * @returns {Promise<import("@atproto/api").BlobRef>} Blob reference for the uploaded media
+   * @returns {Promise<import("@atproto/api").BlobRef|undefined>} Blob reference for the uploaded media
    */
   async uploadMedia(media, me) {
     const client = await this.#client();
@@ -218,7 +218,7 @@ export class Bluesky {
     }
 
     let blob = await mediaResponse.blob();
-    let encoding = mediaResponse.headers.get("Content-Type");
+    let encoding = mediaResponse.headers.get("Content-Type") ?? undefined;
 
     // Compress image to meet maximum file size limit
     if (encoding?.startsWith("image/")) {
@@ -242,13 +242,16 @@ export class Bluesky {
    * Post to Bluesky
    * @param {object} properties - JF2 properties
    * @param {string} me - Publication URL
-   * @returns {Promise<string|boolean>} URL of syndicated status
+   * @returns {Promise<string|undefined>} URL of syndicated status
    */
   async post(properties, me) {
     const client = await this.#client();
 
     // Upload photos
-    let images = [];
+    /**
+     * @type {import("@atproto/api").AppBskyEmbedImages.Image[]}
+     */
+    const images = [];
     if (properties.photo) {
       // Trim to 4 photos as Bluesky doesn’t support more
       const photos = properties.photo.slice(0, 4);
@@ -259,7 +262,13 @@ export class Bluesky {
         };
       });
 
-      images = await Promise.all(uploads);
+      // Skip photos without a URL that could be uploaded
+      const uploaded = await Promise.all(uploads);
+      for (const { alt, image } of uploaded) {
+        if (image) {
+          images.push({ alt, image });
+        }
+      }
     }
 
     const repostUrl = properties["repost-of"];
diff --git a/packages/syndicator-bluesky/lib/utils.js b/packages/syndicator-bluesky/lib/utils.js
index 8f7d4bb36..1565dca20 100644
--- a/packages/syndicator-bluesky/lib/utils.js
+++ b/packages/syndicator-bluesky/lib/utils.js
@@ -48,9 +48,14 @@ export const getHtmlLinks = (html) => {
   for (const match of html.matchAll(
     /<a\s[^>]*href=["'](?<url>https?:\/\/[^"']+)["'][^>]*>(?<html>.*?)<\/a>/gis,
   )) {
-    const text = match.groups.html.replaceAll(/<[^>]+>/g, "").trim();
+    const { groups } = match;
+    if (!groups) {
+      continue;
+    }
+
+    const text = groups.html.replaceAll(/<[^>]+>/g, "").trim();
     if (text) {
-      links.push({ text, url: match.groups.url });
+      links.push({ text, url: groups.url });
     }
   }
 
@@ -121,14 +126,14 @@ export const getPostParts = (url) => {
 export const uriToPostUrl = (profileUrl, uri) => {
   const match = uri.match(AT_URI);
 
-  if (!match) {
+  if (!match?.groups) {
     return;
   }
 
-  let { did, rkey, type } = match.groups;
-  type = type.split(".").at(-1);
+  const { did, rkey, type } = match.groups;
+  const postType = type.slice(type.lastIndexOf(".") + 1);
 
-  return `${profileUrl}/${did}/${type}/${rkey}`;
+  return `${profileUrl}/${did}/${postType}/${rkey}`;
 };
 
 /**
@@ -157,7 +162,7 @@ export const createHashtags = (category) => {
     const name = item
       .split("/")
       .at(-1)
-      .replaceAll(/[^\p{L}\p{N}_]/gu, "");
+      ?.replaceAll(/[^\p{L}\p{N}_]/gu, "");
     const hashtag = `#${name}`;
 
     if (name && name.length <= 64 && !hashtags.includes(hashtag)) {
@@ -263,8 +268,8 @@ export const htmlToStatusText = (html) => {
   // Get all the link references
   let hrefs = [...html.matchAll(/href="(https?:\/\/.+?)"/g)];
 
-  // Get the last link mentioned, or return false
-  const lastHref = hrefs.length > 0 && hrefs.at(-1)[1];
+  // Get the last link mentioned, if any
+  const lastHref = hrefs.at(-1)?.[1];
 
   // Convert HTML to plain text, removing any links
   const text = htmlToText(html, {
diff --git a/packages/syndicator-bluesky/test/unit/utils.js b/packages/syndicator-bluesky/test/unit/utils.js
index 04bd2c32a..432c5f160 100644
--- a/packages/syndicator-bluesky/test/unit/utils.js
+++ b/packages/syndicator-bluesky/test/unit/utils.js
@@ -100,6 +100,7 @@ describe("syndicator-bluesky/lib/utils", async () => {
     const metadata = await sharp(result.buffer).metadata();
     const maxBytes = 1024 * 1024; // 1MB
 
+    assert.ok(metadata.size);
     assert.ok(metadata.size <= maxBytes);
     assert.equal(result.mimeType, "image/jpeg");
   });
@@ -288,6 +289,7 @@ describe("syndicator-bluesky/lib/utils", async () => {
     ]);
     const result = await createRichText(agent, text, facets);
 
+    assert.ok(result.facets);
     assert.deepEqual(
       result.facets.map(
         (facet) =>
diff --git a/packages/syndicator-mastodon/lib/mastodon.js b/packages/syndicator-mastodon/lib/mastodon.js
index 9eeef914b..a3a92c002 100644
--- a/packages/syndicator-mastodon/lib/mastodon.js
+++ b/packages/syndicator-mastodon/lib/mastodon.js
@@ -93,7 +93,7 @@ export class Mastodon {
    * Upload media and return Mastodon media id
    * @param {object} media - JF2 media object
    * @param {string} me - Publication URL
-   * @returns {Promise<string>} Mastodon media id
+   * @returns {Promise<string|undefined>} Mastodon media id
    */
   async uploadMedia(media, me) {
     const { alt, url } = media;
@@ -123,7 +123,7 @@ export class Mastodon {
    * Post to Mastodon
    * @param {object} properties - JF2 properties
    * @param {string} me - Publication URL
-   * @returns {Promise<string|boolean>} URL of syndicated status
+   * @returns {Promise<string|undefined>} URL of syndicated status
    */
   async post(properties, me) {
     let mediaIds = [];
@@ -138,7 +138,8 @@ export class Mastodon {
         uploads.push(this.uploadMedia(photo, me));
       }
 
-      mediaIds = await Promise.all(uploads);
+      const uploadedIds = await Promise.all(uploads);
+      mediaIds = uploadedIds.filter((id) => id !== undefined);
     }
 
     if (properties["repost-of"]) {
diff --git a/packages/syndicator-mastodon/lib/utils.js b/packages/syndicator-mastodon/lib/utils.js
index fa7612085..10af7198e 100644
--- a/packages/syndicator-mastodon/lib/utils.js
+++ b/packages/syndicator-mastodon/lib/utils.js
@@ -6,15 +6,15 @@ import { htmlToText } from "html-to-text";
 /**
  * Get status parameters from given JF2 properties
  * @param {object} properties - JF2 properties
- * @param {object} [options] - Options
+ * @param {object} options - Options
  * @param {number} [options.characterLimit] - Character limit
  * @param {boolean} [options.includeCategories] - Add categories as hashtags
  * @param {boolean} [options.includePermalink] - Include permalink in status
  * @param {Array} [options.mediaIds] - Mastodon media IDs
- * @param {string} [options.serverUrl] - Server URL
+ * @param {string} options.serverUrl - Server URL
  * @returns {object} Status parameters
  */
-export const createStatus = (properties, options = {}) => {
+export const createStatus = (properties, options) => {
   const {
     characterLimit,
     includeCategories,
@@ -123,7 +123,7 @@ export const createHashtags = (category) => {
     const name = item
       .split("/")
       .at(-1)
-      .replaceAll(/[^\p{L}\p{N}_]/gu, "");
+      ?.replaceAll(/[^\p{L}\p{N}_]/gu, "");
     const hashtag = `#${name}`;
 
     if (name && !hashtags.includes(hashtag)) {
@@ -163,8 +163,8 @@ export const htmlToStatusText = (html, serverUrl) => {
     return hrefHostname !== serverHostname;
   });
 
-  // Get the last link mentioned, or return false
-  const lastHref = hrefs.length > 0 && hrefs.at(-1)[1];
+  // Get the last link mentioned, if any
+  const lastHref = hrefs.at(-1)?.[1];
 
   // Convert HTML to plain text, removing any links
   const text = htmlToText(html, {
diff --git a/packages/util/lib/string.js b/packages/util/lib/string.js
index c5941802a..5729a78a4 100644
--- a/packages/util/lib/string.js
+++ b/packages/util/lib/string.js
@@ -54,9 +54,21 @@ export const randomString = (length = 16) =>
   randomBytes(length).toString("base64url").slice(0, length);
 
 /**
- * Slugify a string
+ * @overload
  * @param {string} string - String to slugify
  * @param {object} [options] - Slugify options
+ * @returns {string} Slugified string
+ */
+/**
+ * @overload
+ * @param {unknown} string - Value to slugify
+ * @param {object} [options] - Slugify options
+ * @returns {string|undefined} Slugified string, if value is a string
+ */
+/**
+ * Slugify a string
+ * @param {unknown} string - String to slugify
+ * @param {object} [options] - Slugify options
  * @returns {string|undefined} Slugified string
  * @example slugify("Foo bar baz", { separator: "_"} ) => "foo_bar_baz"
  */