diff --git a/backend/plugin/build.gradle.kts b/backend/plugin/build.gradle.kts
index 80c5807..ef7413e 100644
--- a/backend/plugin/build.gradle.kts
+++ b/backend/plugin/build.gradle.kts
@@ -53,10 +53,13 @@ dependencies {
 
     // Testing
     testImplementation("com.ritense.valtimo:building-block")
+    testImplementation("com.ritense.valtimo:core")
+    testImplementation("com.ritense.valtimo:form")
     testImplementation("com.ritense.valtimo:plugin")
     testImplementation("com.ritense.valtimo:temporary-resource-storage")
     testImplementation("com.ritense.valtimo:test-utils-common")
 
+    testImplementation("org.springframework.boot:spring-boot-starter-data-jpa")
     testImplementation("org.springframework.boot:spring-boot-starter-test")
 
     testImplementation("org.postgresql:postgresql")
diff --git a/backend/plugin/plugin.properties b/backend/plugin/plugin.properties
index 753b277..213ef0c 100644
--- a/backend/plugin/plugin.properties
+++ b/backend/plugin/plugin.properties
@@ -1,3 +1,3 @@
 pluginGroupId=com.ritense.valtimoplugins
 pluginArtifactId=publictask
-pluginVersion=2.1.1
+pluginVersion=2.1.2
diff --git a/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/htmlrenderer/config/FreemarkerConfig.kt b/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/htmlrenderer/config/FreemarkerConfig.kt
index c8e4ff2..8107f58 100644
--- a/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/htmlrenderer/config/FreemarkerConfig.kt
+++ b/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/htmlrenderer/config/FreemarkerConfig.kt
@@ -17,6 +17,7 @@
 package com.ritense.valtimoplugins.publictask.htmlrenderer.config
 
 import freemarker.cache.ClassTemplateLoader
+import freemarker.core.HTMLOutputFormat
 import freemarker.template.Configuration
 import freemarker.template.TemplateExceptionHandler
 
@@ -25,5 +26,8 @@ class FreemarkerConfig : Configuration(VERSION_2_3_31) {
         templateLoader = ClassTemplateLoader(javaClass, "/config/template")
         defaultEncoding = Charsets.UTF_8.toString()
         templateExceptionHandler = TemplateExceptionHandler.RETHROW_HANDLER
+        // Templates render HTML that is served to the public, so every interpolation is HTML escaped unless the
+        // template asks for a different encoder. Without this, a value taken from case data can inject markup.
+        outputFormat = HTMLOutputFormat.INSTANCE
     }
 }
diff --git a/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/service/PublicTaskService.kt b/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/service/PublicTaskService.kt
index 0384bf6..1024409 100644
--- a/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/service/PublicTaskService.kt
+++ b/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/service/PublicTaskService.kt
@@ -34,6 +34,7 @@ import org.springframework.http.HttpStatus
 import org.springframework.http.ResponseEntity
 import org.springframework.web.util.UriComponentsBuilder
 import java.time.LocalDate
+import java.time.format.DateTimeParseException
 import java.util.UUID
 
 class PublicTaskService(
@@ -66,9 +67,7 @@ class PublicTaskService(
     }
 
     fun createPublicTaskHtml(publicTaskId: UUID): ResponseEntity<String> {
-        val publicTaskEntity =
-            publicTaskRepository.findById(publicTaskId).orElse(null)
-                ?: return TASK_NOT_AVAILABLE_ERROR
+        val publicTaskEntity = findAvailablePublicTask(publicTaskId) ?: return TASK_NOT_AVAILABLE_ERROR
 
         val formHtml =
             try {
@@ -96,13 +95,7 @@ class PublicTaskService(
         publicTaskId: UUID,
         submission: JsonNode,
     ): ResponseEntity<String> {
-        val publicTaskEntity =
-            publicTaskRepository.findById(publicTaskId).orElse(null)
-                ?: return TASK_NOT_AVAILABLE_ERROR
-
-        if (LocalDate.parse(publicTaskEntity.taskExpirationDate).isBefore(LocalDate.now())) {
-            return TASK_NOT_AVAILABLE_ERROR
-        }
+        val publicTaskEntity = findAvailablePublicTask(publicTaskId) ?: return TASK_NOT_AVAILABLE_ERROR
 
         val operatonTask =
             try {
@@ -137,11 +130,36 @@ class PublicTaskService(
         return ResponseEntity("Your response has been submitted", HttpStatus.OK)
     }
 
+    /**
+     * Returns the public task only while it is still available: not completed through the public form and not past
+     * its expiration date. Both showing the form and submitting it go through this, so that the two cannot drift
+     * apart and leave the form - which contains case data - retrievable for longer than the task itself lives.
+     */
+    private fun findAvailablePublicTask(publicTaskId: UUID): PublicTaskEntity? =
+        publicTaskRepository
+            .findById(publicTaskId)
+            .orElse(null)
+            ?.takeIf { it.isAvailable() }
+
+    private fun PublicTaskEntity.isAvailable(): Boolean {
+        if (isCompletedByPublicTask) {
+            return false
+        }
+        val expirationDate =
+            try {
+                LocalDate.parse(taskExpirationDate)
+            } catch (e: DateTimeParseException) {
+                logger.warn(e) { "Public task has an unusable expiration date and is treated as expired" }
+                return false
+            }
+        return !expirationDate.isBefore(LocalDate.now())
+    }
+
     private fun publicTaskUrl(publicTaskId: UUID): String =
         UriComponentsBuilder
             .fromUriString(baseUrl.removeSuffix("/"))
             .path(PUBLIC_TASK_URL)
-            .queryParam("publicTaskId", publicTaskId)
+            .pathSegment(publicTaskId.toString())
             .build()
             .toUriString()
 
@@ -157,7 +175,9 @@ class PublicTaskService(
                     isCompletedByPublicTask = publicTaskData.isCompletedByPublicTask,
                 ),
             ).also {
-                logger.debug { "Saved public task entity $it" }
+                // Only the user task is logged: the public task id is what grants access to the form, so it must
+                // not end up in log files.
+                logger.debug { "Saved public task entity for user task ${it.userTaskId}" }
             }
     }
 
diff --git a/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResource.kt b/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResource.kt
index ab47a45..ccf5a1b 100644
--- a/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResource.kt
+++ b/backend/plugin/src/main/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResource.kt
@@ -20,6 +20,7 @@ import com.fasterxml.jackson.databind.JsonNode
 import com.ritense.valtimoplugins.publictask.service.PublicTaskService
 import org.springframework.http.ResponseEntity
 import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.PathVariable
 import org.springframework.web.bind.annotation.PostMapping
 import org.springframework.web.bind.annotation.RequestBody
 import org.springframework.web.bind.annotation.RequestMapping
@@ -32,13 +33,31 @@ import java.util.UUID
 class PublicTaskResource(
     private val publicTaskService: PublicTaskService,
 ) {
-    @GetMapping
+    @GetMapping("/{publicTaskId}")
     fun sendPublicTaskHtml(
-        @RequestParam publicTaskId: UUID,
+        @PathVariable publicTaskId: UUID,
     ): ResponseEntity<String> = publicTaskService.createPublicTaskHtml(publicTaskId)
 
-    @PostMapping
+    @PostMapping("/{publicTaskId}")
     fun completeUserTask(
+        @PathVariable publicTaskId: UUID,
+        @RequestBody submission: JsonNode,
+    ): ResponseEntity<String> = publicTaskService.completeUserTaskWithPublicTaskSubmission(publicTaskId, submission)
+
+    /**
+     * Kept so that public task links which were sent out before the id moved into the path keep working. New links
+     * use the path form, because an id in the query string ends up in Referer headers, proxy logs and browser
+     * history.
+     */
+    @Deprecated("Use GET /api/v1/public-task/{publicTaskId}")
+    @GetMapping(params = ["publicTaskId"])
+    fun sendPublicTaskHtmlForQueryParameter(
+        @RequestParam publicTaskId: UUID,
+    ): ResponseEntity<String> = publicTaskService.createPublicTaskHtml(publicTaskId)
+
+    @Deprecated("Use POST /api/v1/public-task/{publicTaskId}")
+    @PostMapping(params = ["publicTaskId"])
+    fun completeUserTaskForQueryParameter(
         @RequestParam publicTaskId: UUID,
         @RequestBody submission: JsonNode,
     ): ResponseEntity<String> = publicTaskService.completeUserTaskWithPublicTaskSubmission(publicTaskId, submission)
diff --git a/backend/plugin/src/main/resources/config/template/public_task_html.ftl b/backend/plugin/src/main/resources/config/template/public_task_html.ftl
index 92b5441..9faa94c 100644
--- a/backend/plugin/src/main/resources/config/template/public_task_html.ftl
+++ b/backend/plugin/src/main/resources/config/template/public_task_html.ftl
@@ -50,16 +50,25 @@
 <body>
 <div id="form" class="d-block"></div>
 <div id="result" class="d-none"></div>
+<#--
+    The form definition is emitted as a data block instead of as a JavaScript literal, so that its content is never
+    parsed as script. HTML escaping would be the wrong escaping here - the content of a script element is raw text,
+    where entities are not decoded - so the value is marked as no_esc and encoded for this context instead: in JSON a
+    '<' can only occur inside a string literal, where "\u003C" means exactly the same thing. Replacing every '<'
+    therefore keeps the JSON intact while removing every sequence ("</script", "<!--") that the HTML parser acts on.
+-->
+<script id="form-io-form" type="application/json">${form_io_form?replace("<", "\\u003C")?no_esc}</script>
 <script src="https://cdn.form.io/formiojs/formio.full.min.js"></script>
 <script>
     const formContainer = document.getElementById('form');
     const resultContainer = document.getElementById('result');
-    const formJson = ${form_io_form};
+    const formJson = JSON.parse(document.getElementById('form-io-form').textContent);
 
     Formio.createForm(formContainer, formJson).then(function (form) {
         form.on('submit', function (submission) {
             console.debug('Form submitted', submission);
-            fetch('${public_task_url}', {
+            <#-- js_string, not the default HTML escaping: this value sits in a JavaScript string literal. -->
+            fetch('${public_task_url?js_string?no_esc}', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify(submission.data)
diff --git a/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/htmlrenderer/service/PublicTaskHtmlTemplateTest.kt b/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/htmlrenderer/service/PublicTaskHtmlTemplateTest.kt
new file mode 100644
index 0000000..6f5d0c5
--- /dev/null
+++ b/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/htmlrenderer/service/PublicTaskHtmlTemplateTest.kt
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2026 Ritense BV, the Netherlands.
+ *
+ * Licensed under EUPL, Version 1.2 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.ritense.valtimoplugins.publictask.htmlrenderer.service
+
+import com.fasterxml.jackson.databind.ObjectMapper
+import com.ritense.valtimoplugins.publictask.BaseTest
+import com.ritense.valtimoplugins.publictask.htmlrenderer.config.FreemarkerConfig
+import freemarker.core.HTMLOutputFormat
+import freemarker.template.Template
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.Test
+import java.io.StringWriter
+
+internal class PublicTaskHtmlTemplateTest : BaseTest() {
+    private val objectMapper = ObjectMapper()
+
+    private val htmlRenderService = HtmlRenderService(FreemarkerConfig())
+
+    @Test
+    fun `a form value that closes the script element cannot break out of it`() {
+        val formIoForm =
+            """
+            {
+              "components": [
+                { "key": "naam", "defaultValue": "</script><img src=x onerror=alert(1)>" }
+              ]
+            }
+            """.trimIndent()
+
+        val html = render(formIoForm)
+
+        // No '<' survives in the data block, so nothing in it can close the element or open an HTML comment.
+        assertThat(jsonDataBlockOf(html)).doesNotContain("<")
+        assertThat(html).doesNotContain("<img")
+        assertThat(html).contains("\\u003C/script>\\u003Cimg src=x onerror=alert(1)>")
+    }
+
+    @Test
+    fun `a valid form definition is still readable as json after escaping`() {
+        val formIoForm =
+            objectMapper
+                .createObjectNode()
+                .put("quotes", """He said "hi" and \ left""")
+                .put("unicode", "Ruben ë ç 😀")
+                .put("newlines", "line one\nline two\ttabbed")
+                .put("slashes", "https://example.org/a/b?c=d&e=f")
+                .put("markup", "</script> <!-- <b>bold</b>")
+                .toPrettyString()
+
+        val html = render(formIoForm)
+
+        assertThat(objectMapper.readTree(jsonDataBlockOf(html)))
+            .isEqualTo(objectMapper.readTree(formIoForm))
+    }
+
+    @Test
+    fun `the submit url is escaped for the javascript string literal it is placed in`() {
+        val html = render(publicTaskUrl = """https://valtimo.example.org/api/v1/public-task/1' + alert(1) + '""")
+
+        assertThat(html).doesNotContain("""' + alert(1) + '""")
+        assertThat(html).contains("""\' + alert(1) + \'""")
+    }
+
+    @Test
+    fun `the freemarker configuration escapes interpolations by default`() {
+        assertThat(FreemarkerConfig().outputFormat).isEqualTo(HTMLOutputFormat.INSTANCE)
+
+        // Guards the setting behaviourally as well: an interpolation without an explicit encoder must be escaped.
+        val rendered =
+            StringWriter()
+                .apply {
+                    Template("auto-escaping-check", "\${value}", FreemarkerConfig())
+                        .process(mapOf("value" to "</script>"), this)
+                }.toString()
+
+        assertThat(rendered).doesNotContain("</script>")
+    }
+
+    private fun render(
+        formIoForm: String = "{}",
+        publicTaskUrl: String = "https://valtimo.example.org/api/v1/public-task/$PUBLIC_TASK_ID",
+    ): String =
+        htmlRenderService.generatePublicTaskHtml(
+            fileName = "public_task_html",
+            variables =
+                mapOf(
+                    "form_io_form" to formIoForm,
+                    "public_task_url" to publicTaskUrl,
+                ),
+        )
+
+    private fun jsonDataBlockOf(html: String): String =
+        requireNotNull(JSON_DATA_BLOCK.find(html)) {
+            "The rendered page does not contain a <script type=\"application/json\"> data block:\n$html"
+        }.groupValues[1]
+
+    companion object {
+        private const val PUBLIC_TASK_ID = "3f2a1c4e-0b7d-4a19-9c5e-8d6f0a1b2c3d"
+
+        private val JSON_DATA_BLOCK =
+            Regex(
+                """<script id="form-io-form" type="application/json">(.*?)</script>""",
+                RegexOption.DOT_MATCHES_ALL,
+            )
+    }
+}
diff --git a/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/service/PublicTaskServiceTest.kt b/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/service/PublicTaskServiceTest.kt
new file mode 100644
index 0000000..dd22536
--- /dev/null
+++ b/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/service/PublicTaskServiceTest.kt
@@ -0,0 +1,151 @@
+/*
+ * Copyright 2026 Ritense BV, the Netherlands.
+ *
+ * Licensed under EUPL, Version 1.2 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.ritense.valtimoplugins.publictask.service
+
+import com.fasterxml.jackson.databind.node.JsonNodeFactory
+import com.ritense.form.service.impl.DefaultFormSubmissionService
+import com.ritense.processlink.service.ProcessLinkActivityService
+import com.ritense.valtimoplugins.publictask.BaseTest
+import com.ritense.valtimoplugins.publictask.domain.PublicTaskEntity
+import com.ritense.valtimoplugins.publictask.htmlrenderer.service.HtmlRenderService
+import com.ritense.valtimoplugins.publictask.repository.PublicTaskRepository
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.Test
+import org.mockito.kotlin.mock
+import org.mockito.kotlin.verify
+import org.mockito.kotlin.verifyNoInteractions
+import org.mockito.kotlin.whenever
+import org.operaton.bpm.engine.RuntimeService
+import org.springframework.http.HttpStatus
+import java.time.LocalDate
+import java.util.Optional
+import java.util.UUID
+
+internal class PublicTaskServiceTest : BaseTest() {
+    private val publicTaskRepository: PublicTaskRepository = mock()
+    private val runtimeService: RuntimeService = mock()
+    private val processLinkActivityService: ProcessLinkActivityService = mock()
+    private val htmlRenderService: HtmlRenderService = mock()
+    private val defaultFormSubmissionService: DefaultFormSubmissionService = mock()
+
+    private val publicTaskService =
+        PublicTaskService(
+            publicTaskRepository = publicTaskRepository,
+            runtimeService = runtimeService,
+            processLinkActivityService = processLinkActivityService,
+            htmlRenderService = htmlRenderService,
+            defaultFormSubmissionService = defaultFormSubmissionService,
+            baseUrl = "https://valtimo.example.org",
+        )
+
+    @Test
+    fun `rendering the form is refused once the task has expired`() {
+        givenPublicTask(expirationDate = LocalDate.now().minusDays(1))
+
+        val response = publicTaskService.createPublicTaskHtml(PUBLIC_TASK_ID)
+
+        assertThat(response.statusCode).isEqualTo(HttpStatus.NOT_FOUND)
+        verifyNoInteractions(processLinkActivityService, htmlRenderService)
+    }
+
+    @Test
+    fun `rendering the form is refused once the task has been completed`() {
+        givenPublicTask(completed = true)
+
+        val response = publicTaskService.createPublicTaskHtml(PUBLIC_TASK_ID)
+
+        assertThat(response.statusCode).isEqualTo(HttpStatus.NOT_FOUND)
+        verifyNoInteractions(processLinkActivityService, htmlRenderService)
+    }
+
+    @Test
+    fun `rendering the form is refused when the expiration date cannot be read`() {
+        givenPublicTask(expirationDate = null)
+
+        val response = publicTaskService.createPublicTaskHtml(PUBLIC_TASK_ID)
+
+        assertThat(response.statusCode).isEqualTo(HttpStatus.NOT_FOUND)
+        verifyNoInteractions(processLinkActivityService, htmlRenderService)
+    }
+
+    @Test
+    fun `a task that is open and expires today is still rendered`() {
+        givenPublicTask(expirationDate = LocalDate.now())
+
+        // The task is looked up in the process engine, which proves the availability check did not short-circuit.
+        // The mocked engine returns no task, so the response itself is still "not available".
+        publicTaskService.createPublicTaskHtml(PUBLIC_TASK_ID)
+
+        verify(processLinkActivityService).openTask(USER_TASK_ID)
+    }
+
+    @Test
+    fun `submitting the form is refused once the task has expired`() {
+        givenPublicTask(expirationDate = LocalDate.now().minusDays(1))
+
+        val response = publicTaskService.completeUserTaskWithPublicTaskSubmission(PUBLIC_TASK_ID, SUBMISSION)
+
+        assertThat(response.statusCode).isEqualTo(HttpStatus.NOT_FOUND)
+        verifyNoInteractions(processLinkActivityService, defaultFormSubmissionService)
+    }
+
+    @Test
+    fun `submitting the form is refused once the task has been completed`() {
+        givenPublicTask(completed = true)
+
+        val response = publicTaskService.completeUserTaskWithPublicTaskSubmission(PUBLIC_TASK_ID, SUBMISSION)
+
+        assertThat(response.statusCode).isEqualTo(HttpStatus.NOT_FOUND)
+        verifyNoInteractions(processLinkActivityService, defaultFormSubmissionService)
+    }
+
+    @Test
+    fun `an unknown task is not available`() {
+        whenever(publicTaskRepository.findById(PUBLIC_TASK_ID)).thenReturn(Optional.empty())
+
+        val response = publicTaskService.createPublicTaskHtml(PUBLIC_TASK_ID)
+
+        assertThat(response.statusCode).isEqualTo(HttpStatus.NOT_FOUND)
+        verifyNoInteractions(processLinkActivityService, htmlRenderService)
+    }
+
+    private fun givenPublicTask(
+        expirationDate: LocalDate? = LocalDate.now().plusDays(1),
+        completed: Boolean = false,
+    ) {
+        whenever(publicTaskRepository.findById(PUBLIC_TASK_ID)).thenReturn(
+            Optional.of(
+                PublicTaskEntity(
+                    publicTaskId = PUBLIC_TASK_ID,
+                    userTaskId = USER_TASK_ID,
+                    processBusinessKey = "3e6b0dd5-3b4b-4bd4-a1ea-b9f0e4e1c7cb",
+                    assigneeCandidateContactData = "citizen@example.org",
+                    taskExpirationDate = expirationDate?.toString() ?: "",
+                    isCompletedByPublicTask = completed,
+                ),
+            ),
+        )
+    }
+
+    companion object {
+        private val PUBLIC_TASK_ID = UUID.fromString("3f2a1c4e-0b7d-4a19-9c5e-8d6f0a1b2c3d")
+
+        private val USER_TASK_ID = UUID.fromString("a0d1f5c2-1e3b-4a67-8c9d-0e1f2a3b4c5d")
+
+        private val SUBMISSION = JsonNodeFactory.instance.objectNode().put("naam", "Ruben")
+    }
+}
diff --git a/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResourceIT.kt b/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResourceIT.kt
index eee18b5..d8ec84a 100644
--- a/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResourceIT.kt
+++ b/backend/plugin/src/test/kotlin/com/ritense/valtimoplugins/publictask/web/rest/PublicTaskResourceIT.kt
@@ -38,6 +38,15 @@ internal class PublicTaskResourceIT : BaseIntegrationTest() {
         // component scanning. On a real Valtimo host the plugin package is not scanned, so an unmapped endpoint
         // would fall through to the static resource handler ("No static resource api/v1/public-task").
         // Requesting an unknown task must therefore reach the controller and return its "task not available" body.
+        mockMvc
+            .perform(get("/api/v1/public-task/{publicTaskId}", UUID.randomUUID().toString()))
+            .andExpect(status().isNotFound)
+            .andExpect(content().string(containsString("This task does not exist")))
+    }
+
+    @Test
+    fun `GET public-task endpoint still accepts the public task id as a query parameter`() {
+        // Links that were sent to applicants before the id moved into the path must keep working.
         mockMvc
             .perform(get("/api/v1/public-task").queryParam("publicTaskId", UUID.randomUUID().toString()))
             .andExpect(status().isNotFound)
diff --git a/documentation/plugin.md b/documentation/plugin.md
index aacf3f7..fcbbd7f 100644
--- a/documentation/plugin.md
+++ b/documentation/plugin.md
@@ -38,6 +38,22 @@ URL is resolved from application configuration, in the following order of preced
 This keeps existing setups based on `VALTIMO_URL` unchanged, while allowing deployments that only
 configure `VALTIMO_APP_HOSTNAME` (such as Ritense Cloud applications) to generate the URL correctly.
 
+The public task id is a path segment: `<base>/api/v1/public-task/<publicTaskId>`. Older links, which
+carried the id as a `publicTaskId` query parameter, are still accepted so that URLs that have already
+been sent out keep working, but that form is deprecated: an id in the query string ends up in
+`Referer` headers, proxy logs and browser history.
+
+### Availability of the public task
+
+The form is only rendered while the public task is still available. It is refused once the task has
+been submitted through the public form, and once the **TimeToLive** window of the process link has
+passed. Showing the form and submitting it apply the same check.
+
+The generated HTML is an example that implementations are expected to replace. When writing your own
+template, keep the form definition in a `<script type="application/json">` data block and read it with
+`JSON.parse`, as the example does. The form definition contains case data, so interpolating it straight
+into a script block would let that data inject markup or script into the page.
+
 ## Available actions
 
 The Public Task plugin supports the following actions that can be configured in process links in order to store
diff --git a/documentation/release-notes.md b/documentation/release-notes.md
index d01dc8c..c7fd7ed 100644
--- a/documentation/release-notes.md
+++ b/documentation/release-notes.md
@@ -2,6 +2,9 @@
 
 Overzicht van wijzigingen per versie van de Publictask-plugin.
 
+## 2.1.2
+Gegevens uit een zaak worden in het publieke formulier altijd als tekst weergegeven en niet meer als opmaak of script uitgevoerd. Een link naar een publieke taak geeft het formulier daarnaast niet meer terug nadat de taak is afgerond of de uiterste datum is verstreken; links die al zijn verstuurd blijven werken.
+
 ## 2.1.1
 Bugfixes voor de publieke taak-URL
 
diff --git a/frontend/projects/plugin/package.json b/frontend/projects/plugin/package.json
index 9a03781..76bf985 100644
--- a/frontend/projects/plugin/package.json
+++ b/frontend/projects/plugin/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@valtimo-plugins/publictask",
   "license": "EUPL-1.2",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "peerDependencies": {
     "@angular/common": "19.2.20",
     "@angular/core": "19.2.20"