LotusGuild/cinny

Audit 2026-09 · P0 security & data loss

New Issue

Critical findings and high-severity security findings from the September 2026 client audit. E2EE breakages, plaintext leaks, session bugs.

2026-09-25

100% Completed

Persistent search index keeps decrypted plaintext of redacted messages and left rooms area: messaging bug priority: high security

by jared was closed 2026-09-12 19:46:14 -04:00

2026-09-25

GIF picker sends unencrypted media into encrypted rooms area: messaging bug priority: high security

by jared was closed 2026-09-12 02:14:51 -04:00

2026-09-25

Bookmarks and reminders upload decrypted message text to server account data area: messaging bug priority: high security

by jared was closed 2026-09-12 19:46:14 -04:00

2026-09-25

Scheduled messages bypass encryption — plaintext m.room.message in E2EE rooms area: messaging bug priority: critical security

by jared was closed 2026-09-12 02:14:51 -04:00

2026-09-18

Image compression in an E2EE room uploads plaintext and breaks the event area: messaging bug priority: critical security

by jared was closed 2026-09-12 02:14:51 -04:00

2026-09-18