Issues - cinny - Lotus Git Server

LotusGuild/cinny

Client audit 2026-09 — tracking index

#89 opened 2026-09-12 01:52:08 -04:00 by jared

0 / 94

Labels Milestones New Issue

Privacy: every page load contacts fonts.googleapis.com / fonts.gstatic.com for the VT323 font — self-host it area: appearance priority: medium security

opened 2026-09-18 19:11:16 -04:00 by jared

Features 2026-Q4

[planning] E2EE / call-key cluster KE-1→4: OTK upload conflict storm, EC MissingKey, malformed algorithm, MatrixRTC delayed-event timeouts — capture first, do not spot-fix area: calls needs-human-review planning priority: high security

opened 2026-09-17 23:25:31 -04:00 by jared

[QA] QR device verification: show / scan / confirm, emoji fallback, camera denied, wrong scan cancels area: auth-session qa security

opened 2026-09-17 23:24:11 -04:00 by jared

Manual QA backlog 0 / 1

[QA] §N OIDC / next-gen auth (MSC3861): login, persistence, refresh, logout revoke, account deep-link, password regression area: auth-session qa security

opened 2026-09-17 23:24:09 -04:00 by jared

Manual QA backlog 0 / 6

[research] Verification reminder for your OWN unverified sessions area: auth-session enhancement priority: medium research security

opened 2026-09-17 15:43:35 -04:00 by jared

Features 2026-Q4

[planning] Session hygiene nudges — design session needed area: auth-session enhancement needs-human-review priority: medium security

opened 2026-09-17 13:27:07 -04:00 by jared

Features 2026-Q4

[needs human review] Key-backup health banner — explain, then decide area: auth-session enhancement needs-human-review priority: medium security

opened 2026-09-17 13:27:07 -04:00 by jared

Features 2026-Q4

Strip EXIF/GPS metadata from images by default (currently only when compression is on) area: media enhancement priority: high security

opened 2026-09-17 13:27:07 -04:00 by jared

Features 2026-Q4

[research] Desktop: store the access token in the OS keychain + idle lock area: auth-session area: desktop enhancement priority: high security

opened 2026-09-17 01:39:34 -04:00 by jared

Features 2026-Q4

Element Call iframe is same-origin, so its sandbox is a no-op area: calls bug priority: medium security

opened 2026-09-12 01:51:10 -04:00 by jared

Audit 2026-09 · Medium & Low

2026-11-14