I feel a bit stoopid now. I just hadn't thought to actually look in that file. I looked in the config files, all my tpl files, my css files.

Well. Now I know, and as GI Joe used to say, "knowing is half the battle". (I annoy my kids with that line all the time).

On the plus side, this security error was pointed out to me by a sudden uptick in sales, so we're finally in a financial position to donate to the Zencart project - yay!

Thanks for your help and for a great product.

Jess