The clip is published as an independent Track.Source.Unknown track and is completely decoupled from the mic publication's mute state. A user who is muted (or in a push-to-talk idle state) and clicks a soundboard button still transmits audio into the call under their own identity. Nothing in the handler consults localParticipant.isMicrophoneEnabled or any mute state. This is a genuine surprise for the "I am muted, nothing I do makes noise" mental model, and it is also the one path that can emit audio from a user who has never granted mic permission.
How to trigger
Mute yourself in the call, click a soundboard clip in cinny. Peers hear it.
Suggested fix
Gate playInjectedClip on room.localParticipant.isMicrophoneEnabled (or have the host gate it), and if injection while muted is intended, make the cinny soundboard UI say so explicitly.
Filed from the September 2026 audit (branch lotus).
**Severity:** medium · **Type:** ux · **Confidence:** high
**Location:** `src/lotus/lotusAudioInject.ts:186-203`
### Problem
The clip is published as an independent `Track.Source.Unknown` track and is completely decoupled from the mic publication's mute state. A user who is muted (or in a push-to-talk idle state) and clicks a soundboard button still transmits audio into the call under their own identity. Nothing in the handler consults `localParticipant.isMicrophoneEnabled` or any mute state. This is a genuine surprise for the "I am muted, nothing I do makes noise" mental model, and it is also the one path that can emit audio from a user who has never granted mic permission.
### How to trigger
Mute yourself in the call, click a soundboard clip in cinny. Peers hear it.
### Suggested fix
Gate `playInjectedClip` on `room.localParticipant.isMicrophoneEnabled` (or have the host gate it), and if injection while muted is intended, make the cinny soundboard UI say so explicitly.
---
_Filed from the September 2026 audit (branch `lotus`)._
jared
added this to the EC fork audit 2026-09 · Medium & Low milestone 2026-09-12 02:13:03 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: ux · Confidence: high
Location:
src/lotus/lotusAudioInject.ts:186-203Problem
The clip is published as an independent
Track.Source.Unknowntrack and is completely decoupled from the mic publication's mute state. A user who is muted (or in a push-to-talk idle state) and clicks a soundboard button still transmits audio into the call under their own identity. Nothing in the handler consultslocalParticipant.isMicrophoneEnabledor any mute state. This is a genuine surprise for the "I am muted, nothing I do makes noise" mental model, and it is also the one path that can emit audio from a user who has never granted mic permission.How to trigger
Mute yourself in the call, click a soundboard clip in cinny. Peers hear it.
Suggested fix
Gate
playInjectedCliponroom.localParticipant.isMicrophoneEnabled(or have the host gate it), and if injection while muted is intended, make the cinny soundboard UI say so explicitly.Filed from the September 2026 audit (branch
lotus).