the header call IconButton has an onContextMenu handler that calls startCall(room, { microphone: true, video: true, sound: true }) directly. There is no confirmation, no menu, no hint that right-click does anything, and it ignores both cameraOnJoin and the room's allow_camera policy. An accidental right-click (or a long-press that maps to contextmenu on a touch device) starts a live camera+mic call in the room.
How to trigger
open a DM or private group, right-click the call/video button in the room header.
Suggested fix
remove the hidden onContextMenu shortcut (the popout menu already offers Voice/Video), or at minimum make it honour cameraOnJoin and the room camera policy.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** medium · **Type:** ux · **Confidence:** high
**Location:** `src/app/features/room/RoomViewHeader.tsx:417-424`
### Problem
the header call `IconButton` has an `onContextMenu` handler that calls `startCall(room, { microphone: true, video: true, sound: true })` directly. There is no confirmation, no menu, no hint that right-click does anything, and it ignores both `cameraOnJoin` and the room's `allow_camera` policy. An accidental right-click (or a long-press that maps to contextmenu on a touch device) starts a live camera+mic call in the room.
### How to trigger
open a DM or private group, right-click the call/video button in the room header.
### Suggested fix
remove the hidden `onContextMenu` shortcut (the popout menu already offers Voice/Video), or at minimum make it honour `cameraOnJoin` and the room camera policy.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:50:57 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: ux · Confidence: high
Location:
src/app/features/room/RoomViewHeader.tsx:417-424Problem
the header call
IconButtonhas anonContextMenuhandler that callsstartCall(room, { microphone: true, video: true, sound: true })directly. There is no confirmation, no menu, no hint that right-click does anything, and it ignores bothcameraOnJoinand the room'sallow_camerapolicy. An accidental right-click (or a long-press that maps to contextmenu on a touch device) starts a live camera+mic call in the room.How to trigger
open a DM or private group, right-click the call/video button in the room header.
Suggested fix
remove the hidden
onContextMenushortcut (the popout menu already offers Voice/Video), or at minimum make it honourcameraOnJoinand the room camera policy.Filed from the September 2026 client audit (branch
lotus@4bea4895).