diff --git a/internal/http_handlers/oauth_callback.go b/internal/http_handlers/oauth_callback.go
index 689946c7..8b9690a7 100644
--- a/internal/http_handlers/oauth_callback.go
+++ b/internal/http_handlers/oauth_callback.go
@@ -460,7 +460,7 @@ func (h *httpProvider) processGithubUserInfo(ctx *gin.Context, code string) (*sc
 		firstName = name[0]
 	}
 	if len(name) > 1 && strings.TrimSpace(name[1]) != "" {
-		lastName = name[0]
+		lastName = name[1]
 	}
 
 	picture := userRawData["avatar_url"]
diff --git a/internal/server/http_routes.go b/internal/server/http_routes.go
index af377fac..c4ba7063 100644
--- a/internal/server/http_routes.go
+++ b/internal/server/http_routes.go
@@ -3,6 +3,7 @@ package server
 import (
 	"encoding/json"
 	"html/template"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 )
@@ -31,14 +32,19 @@ func (s *server) NewRouter() *gin.Engine {
 	router.GET("/authorize", s.Dependencies.HTTPProvider.AuthorizeHandler())
 	router.GET("/userinfo", s.Dependencies.HTTPProvider.UserInfoHandler())
 	router.GET("/logout", s.Dependencies.HTTPProvider.LogoutHandler())
+	router.POST("/logout", s.Dependencies.HTTPProvider.LogoutHandler())
 	router.POST("/oauth/token", s.Dependencies.HTTPProvider.TokenHandler())
 	router.POST("/oauth/revoke", s.Dependencies.HTTPProvider.RevokeRefreshTokenHandler())
 
-	// Set up template functions for JSON encoding
+	// Set up template functions for JSON encoding.
+	// Escape </script> and <!-- to prevent script injection in <script> blocks.
 	router.SetFuncMap(template.FuncMap{
 		"json": func(v interface{}) template.JS {
 			a, _ := json.Marshal(v)
-			return template.JS(a)
+			s := string(a)
+			s = strings.ReplaceAll(s, "</", `<\/`)
+			s = strings.ReplaceAll(s, "<!--", `<\!--`)
+			return template.JS(s)
 		},
 	})
 	router.LoadHTMLGlob("web/templates/*")