Bookmarking a message writes previewText: body.slice(0, 120), roomName and senderName into the global io.lotus.bookmarks account-data event; "Remind Me" writes message: previewText into io.lotus.reminders. Account data is stored unencrypted on the homeserver. For messages in E2EE rooms this exports decrypted plaintext (plus who said it and where) straight to the server — defeating E2EE for every bookmarked/reminded message, permanently, with no user warning. The rest of the codebase treats the same data carefully (clearTranslationCache, deleteSearchCacheDatabase, clearScheduledMessages all wipe local plaintext on logout) — account data can't be wiped that way.
How to trigger
Bookmark or set a reminder on any message in an encrypted room; inspect GET /_matrix/client/v3/user/{id}/account_data/io.lotus.bookmarks.
Suggested fix
Store only {roomId, eventId, savedAt} on the server and resolve the preview locally from the timeline/local cache; or omit previewText/message for rooms where room.hasEncryptionStateEvent() is true.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** high · **Type:** security · **Confidence:** high
**Location:** `src/app/features/room/message/Message.tsx:1268-1283`, `src/app/hooks/useBookmarks.ts:19-32`, `src/app/features/room/message/RemindMeDialog.tsx:96-101`, `src/app/hooks/useReminders.ts:12`
### Problem
Bookmarking a message writes `previewText: body.slice(0, 120)`, `roomName` and `senderName` into the global `io.lotus.bookmarks` account-data event; "Remind Me" writes `message: previewText` into `io.lotus.reminders`. Account data is stored **unencrypted** on the homeserver. For messages in E2EE rooms this exports decrypted plaintext (plus who said it and where) straight to the server — defeating E2EE for every bookmarked/reminded message, permanently, with no user warning. The rest of the codebase treats the same data carefully (`clearTranslationCache`, `deleteSearchCacheDatabase`, `clearScheduledMessages` all wipe local plaintext on logout) — account data can't be wiped that way.
### How to trigger
Bookmark or set a reminder on any message in an encrypted room; inspect `GET /_matrix/client/v3/user/{id}/account_data/io.lotus.bookmarks`.
### Suggested fix
Store only `{roomId, eventId, savedAt}` on the server and resolve the preview locally from the timeline/local cache; or omit `previewText`/`message` for rooms where `room.hasEncryptionStateEvent()` is true.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · P0 security & data loss milestone 2026-09-12 01:50:48 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high · Type: security · Confidence: high
Location:
src/app/features/room/message/Message.tsx:1268-1283,src/app/hooks/useBookmarks.ts:19-32,src/app/features/room/message/RemindMeDialog.tsx:96-101,src/app/hooks/useReminders.ts:12Problem
Bookmarking a message writes
previewText: body.slice(0, 120),roomNameandsenderNameinto the globalio.lotus.bookmarksaccount-data event; "Remind Me" writesmessage: previewTextintoio.lotus.reminders. Account data is stored unencrypted on the homeserver. For messages in E2EE rooms this exports decrypted plaintext (plus who said it and where) straight to the server — defeating E2EE for every bookmarked/reminded message, permanently, with no user warning. The rest of the codebase treats the same data carefully (clearTranslationCache,deleteSearchCacheDatabase,clearScheduledMessagesall wipe local plaintext on logout) — account data can't be wiped that way.How to trigger
Bookmark or set a reminder on any message in an encrypted room; inspect
GET /_matrix/client/v3/user/{id}/account_data/io.lotus.bookmarks.Suggested fix
Store only
{roomId, eventId, savedAt}on the server and resolve the preview locally from the timeline/local cache; or omitpreviewText/messagefor rooms whereroom.hasEncryptionStateEvent()is true.Filed from the September 2026 client audit (branch
lotus@4bea4895).