diff --git a/include/api.php b/include/api.php
index 85a34d2753..53d00b27de 100644
--- a/include/api.php
+++ b/include/api.php
@@ -335,16 +335,16 @@ function api_call(App $a, App\Arguments $args = null)
 
 				if (!empty($info['auth']) && api_user() === false) {
 					api_login($a);
+					Logger::info(API_LOG_PREFIX . 'username {username}', ['module' => 'api', 'action' => 'call', 'username' => $a->user['username']]);
 				}
 
-				Logger::info(API_LOG_PREFIX . 'username {username}', ['module' => 'api', 'action' => 'call', 'username' => $a->user['username']]);
 				Logger::debug(API_LOG_PREFIX . 'parameters', ['module' => 'api', 'action' => 'call', 'parameters' => $_REQUEST]);
 
 				$stamp =  microtime(true);
 				$return = call_user_func($info['func'], $type);
 				$duration = floatval(microtime(true) - $stamp);
 
-				Logger::info(API_LOG_PREFIX . 'username {username}', ['module' => 'api', 'action' => 'call', 'username' => $a->user['username'], 'duration' => round($duration, 2)]);
+				Logger::info(API_LOG_PREFIX . 'duration {duration}', ['module' => 'api', 'action' => 'call', 'duration' => round($duration, 2)]);
 
 				DI::profiler()->saveLog(DI::logger(), API_LOG_PREFIX . 'performance');
 
diff --git a/mod/cal.php b/mod/cal.php
index 4b90b02cd8..dcfb5db9c8 100644
--- a/mod/cal.php
+++ b/mod/cal.php
@@ -37,17 +37,18 @@ use Friendica\Model\Event;
 use Friendica\Model\Item;
 use Friendica\Model\Profile;
 use Friendica\Module\BaseProfile;
+use Friendica\Network\HTTPException;
 use Friendica\Util\DateTimeFormat;
 use Friendica\Util\Temporal;
 
 function cal_init(App $a)
 {
 	if (DI::config()->get('system', 'block_public') && !Session::isAuthenticated()) {
-		throw new \Friendica\Network\HTTPException\ForbiddenException(DI::l10n()->t('Access denied.'));
+		throw new HTTPException\ForbiddenException(DI::l10n()->t('Access denied.'));
 	}
 
 	if ($a->argc < 2) {
-		throw new \Friendica\Network\HTTPException\ForbiddenException(DI::l10n()->t('Access denied.'));
+		throw new HTTPException\ForbiddenException(DI::l10n()->t('Access denied.'));
 	}
 
 	Nav::setSelected('events');
@@ -55,7 +56,7 @@ function cal_init(App $a)
 	$nick = $a->argv[1];
 	$user = DBA::selectFirst('user', [], ['nickname' => $nick, 'blocked' => false]);
 	if (!DBA::isResult($user)) {
-		throw new \Friendica\Network\HTTPException\NotFoundException();
+		throw new HTTPException\NotFoundException();
 	}
 
 	$a->data['user'] = $user;
@@ -67,18 +68,22 @@ function cal_init(App $a)
 		return;
 	}
 
-	$profile = Profile::getByNickname($nick, $a->profile_uid);
+	$a->profile = Profile::getByNickname($nick, $a->profile_uid);
 
-	$account_type = Contact::getAccountType($profile);
+	if (empty($a->profile)) {
+		throw new HTTPException\NotFoundException(DI::l10n()->t('User not found.'));
+	}
+
+	$account_type = Contact::getAccountType($a->profile);
 
 	$tpl = Renderer::getMarkupTemplate('widget/vcard.tpl');
 
 	$vcard_widget = Renderer::replaceMacros($tpl, [
-		'$name' => $profile['name'],
-		'$photo' => $profile['photo'],
-		'$addr' => $profile['addr'] ?: '',
+		'$name' => $a->profile['name'],
+		'$photo' => $a->profile['photo'],
+		'$addr' => $a->profile['addr'] ?: '',
 		'$account_type' => $account_type,
-		'$about' => BBCode::convert($profile['about']),
+		'$about' => BBCode::convert($a->profile['about']),
 	]);
 
 	$cal_widget = Widget\CalendarExport::getHTML();
diff --git a/mod/photos.php b/mod/photos.php
index 2b72fd3e4e..f33a9241ef 100644
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -778,7 +778,7 @@ function photos_post(App $a)
 
 	// Create item container
 	$lat = $lon = null;
-	if ($exif && $exif['GPS'] && Feature::isEnabled($page_owner_uid, 'photo_location')) {
+	if (!empty($exif['GPS']) && Feature::isEnabled($page_owner_uid, 'photo_location')) {
 		$lat = Photo::getGps($exif['GPS']['GPSLatitude'], $exif['GPS']['GPSLatitudeRef']);
 		$lon = Photo::getGps($exif['GPS']['GPSLongitude'], $exif['GPS']['GPSLongitudeRef']);
 	}
diff --git a/src/App/Page.php b/src/App/Page.php
index 50afac1b4f..d3365a16c1 100644
--- a/src/App/Page.php
+++ b/src/App/Page.php
@@ -276,7 +276,7 @@ class Page implements ArrayAccess
 		// If you're just visiting, let javascript take you home
 		if (!empty($_SESSION['visitor_home'])) {
 			$homebase = $_SESSION['visitor_home'];
-		} elseif (local_user()) {
+		} elseif (!empty($app->user['nickname'])) {
 			$homebase = 'profile/' . $app->user['nickname'];
 		}
 
diff --git a/src/BaseModule.php b/src/BaseModule.php
index 1dbf3f38d5..0e0fedb80c 100644
--- a/src/BaseModule.php
+++ b/src/BaseModule.php
@@ -96,11 +96,11 @@ abstract class BaseModule
 	 * Functions used to protect against Cross-Site Request Forgery
 	 * The security token has to base on at least one value that an attacker can't know - here it's the session ID and the private key.
 	 * In this implementation, a security token is reusable (if the user submits a form, goes back and resubmits the form, maybe with small changes;
-	 * or if the security token is used for ajax-calls that happen several times), but only valid for a certain amout of time (3hours).
-	 * The "typename" seperates the security tokens of different types of forms. This could be relevant in the following case:
-	 *    A security token is used to protekt a link from CSRF (e.g. the "delete this profile"-link).
+	 * or if the security token is used for ajax-calls that happen several times), but only valid for a certain amount of time (3hours).
+	 * The "typename" separates the security tokens of different types of forms. This could be relevant in the following case:
+	 *    A security token is used to protect a link from CSRF (e.g. the "delete this profile"-link).
 	 *    If the new page contains by any chance external elements, then the used security token is exposed by the referrer.
-	 *    Actually, important actions should not be triggered by Links / GET-Requests at all, but somethimes they still are,
+	 *    Actually, important actions should not be triggered by Links / GET-Requests at all, but sometimes they still are,
 	 *    so this mechanism brings in some damage control (the attacker would be able to forge a request to a form of this type, but not to forms of other types).
 	 */
 	public static function getFormSecurityToken($typename = '')
@@ -108,7 +108,7 @@ abstract class BaseModule
 		$a = DI::app();
 
 		$timestamp = time();
-		$sec_hash = hash('whirlpool', $a->user['guid'] . $a->user['prvkey'] . session_id() . $timestamp . $typename);
+		$sec_hash = hash('whirlpool', ($a->user['guid'] ?? '') . ($a->user['prvkey'] ?? '') . session_id() . $timestamp . $typename);
 
 		return $timestamp . '.' . $sec_hash;
 	}
diff --git a/src/Model/UserItem.php b/src/Model/UserItem.php
index 89dbafed82..afb13829df 100644
--- a/src/Model/UserItem.php
+++ b/src/Model/UserItem.php
@@ -75,7 +75,7 @@ class UserItem
 	private static function setNotificationForUser(array $item, int $uid)
 	{
 		$thread = Item::selectFirstThreadForUser($uid, ['ignored'], ['iid' => $item['parent'], 'deleted' => false]);
-		if ($thread['ignored']) {
+		if (!empty($thread['ignored'])) {
 			return;
 		}
 
diff --git a/src/Module/HoverCard.php b/src/Module/HoverCard.php
index f3b8248a6b..ae107ca172 100644
--- a/src/Module/HoverCard.php
+++ b/src/Module/HoverCard.php
@@ -26,7 +26,7 @@ use Friendica\Core\Session;
 use Friendica\DI;
 use Friendica\Model\Profile;
 use Friendica\Model\User;
-use Friendica\Network\HTTPException\NotFoundException;
+use Friendica\Network\HTTPException;
 
 /**
  * Loads a profile for the HoverCard view
@@ -44,11 +44,15 @@ class HoverCard extends BaseModule
 			// Show the profile hovercard
 			$nickname = $parameters['profile'];
 		} else {
-			throw new NotFoundException(DI::l10n()->t('No profile'));
+			throw new HTTPException\NotFoundException(DI::l10n()->t('No profile'));
 		}
 
 		Profile::load($a, $nickname);
 
+		if (empty($a->profile)) {
+			throw new HTTPException\NotFoundException(DI::l10n()->t('User not found.'));
+		}
+
 		$page = DI::page();
 
 		if (!empty($a->profile['page-flags']) && ($a->profile['page-flags'] == User::PAGE_FLAGS_COMMUNITY)) {
diff --git a/view/theme/frio/theme.php b/view/theme/frio/theme.php
index 0202fda0ef..fd69278354 100644
--- a/view/theme/frio/theme.php
+++ b/view/theme/frio/theme.php
@@ -224,7 +224,7 @@ function frio_remote_nav($a, &$nav)
 
 	// since $userinfo isn't available for the hook we write it to the nav array
 	// this isn't optimal because the contact query will be done now twice
-	if (local_user()) {
+	if (local_user() && !empty($a->user['uid'])) {
 		// empty the server url for local user because we won't need it
 		$server_url = '';
 		// user info
diff --git a/view/theme/vier/theme.php b/view/theme/vier/theme.php
index cec5e5ba63..fdcc8f11d5 100644
--- a/view/theme/vier/theme.php
+++ b/view/theme/vier/theme.php
@@ -27,7 +27,7 @@ function vier_init(App $a)
 
 	Renderer::setActiveTemplateEngine('smarty3');
 
-	if (!empty($a->argv[0]) && ($a->argv[0] . ($a->argv[1] ?? '')) === ('profile' . $a->user['nickname']) || $a->argv[0] === 'network' && local_user()) {
+	if (!empty($a->argv[0]) && ($a->argv[0] . ($a->argv[1] ?? '')) === ('profile' . ($a->user['nickname'] ?? '')) || $a->argv[0] === 'network' && local_user()) {
 		vier_community_info();
 
 		DI::page()['htmlhead'] .= "<link rel='stylesheet' type='text/css' href='view/theme/vier/wide.css' media='screen and (min-width: 1300px)'/>\n";