markAsRead derives the receipt type from privateReceipt || privateReadReceipts, where privateReceipt is the hideActivity ("Hide Typing & Read Receipts") setting. The thread panel only passes privateReadReceipts, so a user who has enabled the privacy switch (but not the separate "Private Read Receipts" switch) still emits publicm.read receipts for every thread they open, contradicting the setting's description ("Turn off both typing status and read receipts to keep your activity private"). ThreadTimeline already reads hideActivity for hiding others' receipts — only the send path was missed.
How to trigger
Settings → Privacy → enable "Hide Typing & Read Receipts" (leave "Private Read Receipts" off), open any thread; a public read receipt is sent.
Suggested fix
Read hideActivity in ThreadPanel and pass hideActivity || privateReadReceipts to markThreadAsRead (matching markAsRead).
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** medium · **Type:** security · **Confidence:** high
**Location:** `src/app/features/room/thread/ThreadPanel.tsx:113,160`, compare `src/app/utils/notifications.ts:5-22`, `src/app/features/settings/general/General.tsx:1433-1438`
### Problem
`markAsRead` derives the receipt type from `privateReceipt || privateReadReceipts`, where `privateReceipt` is the `hideActivity` ("Hide Typing & Read Receipts") setting. The thread panel only passes `privateReadReceipts`, so a user who has enabled the privacy switch (but not the separate "Private Read Receipts" switch) still emits **public** `m.read` receipts for every thread they open, contradicting the setting's description ("Turn off both typing status and read receipts to keep your activity private"). `ThreadTimeline` already reads `hideActivity` for hiding others' receipts — only the send path was missed.
### How to trigger
Settings → Privacy → enable "Hide Typing & Read Receipts" (leave "Private Read Receipts" off), open any thread; a public read receipt is sent.
### Suggested fix
Read `hideActivity` in `ThreadPanel` and pass `hideActivity || privateReadReceipts` to `markThreadAsRead` (matching `markAsRead`).
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:05 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: security · Confidence: high
Location:
src/app/features/room/thread/ThreadPanel.tsx:113,160, comparesrc/app/utils/notifications.ts:5-22,src/app/features/settings/general/General.tsx:1433-1438Problem
markAsReadderives the receipt type fromprivateReceipt || privateReadReceipts, whereprivateReceiptis thehideActivity("Hide Typing & Read Receipts") setting. The thread panel only passesprivateReadReceipts, so a user who has enabled the privacy switch (but not the separate "Private Read Receipts" switch) still emits publicm.readreceipts for every thread they open, contradicting the setting's description ("Turn off both typing status and read receipts to keep your activity private").ThreadTimelinealready readshideActivityfor hiding others' receipts — only the send path was missed.How to trigger
Settings → Privacy → enable "Hide Typing & Read Receipts" (leave "Private Read Receipts" off), open any thread; a public read receipt is sent.
Suggested fix
Read
hideActivityinThreadPaneland passhideActivity || privateReadReceiptstomarkThreadAsRead(matchingmarkAsRead).Filed from the September 2026 client audit (branch
lotus@4bea4895).