Block a user
GIF picker sends search terms and IP directly to Giphy, outside any privacy setting
SendingSpinClass and CallAvatarAnimation ignore prefers-reduced-motion
Terminal boot sequence has no touch/click dismiss and isn't hidden from assistive tech
Primary accent color fails WCAG AA 4.5:1 as text in Midnight and Lotus Terminal Light themes
seasonalThemeOverride is the only enum setting with no persisted-value validation
Page Zoom input silently discards a typed-but-unconfirmed value on blur
KaTeX renders remote LaTeX with no
maxSize/maxExpand limits
Location messages load an OpenStreetMap iframe with no facade or auto-load gate
CollapsibleBody's reduced-motion check is a one-time snapshot, not a live listener
Documented "leading emoji rendered 1.15× larger" room-name feature is not implemented
Documented secondary glow/blink keyframes for animated backgrounds don't exist
Earth Day globe decoration risks sitting over the composer
npm audit: 11 advisories in runtime deps (pdfjs-dist JS-execution, react-router, sanitize-html, katex, uuid)
"Focus camera" pins a participant with no way to unpin
CallControl.setPipMode writes state nothing reads
Soundboard clip blob URLs are never revoked and survive logout
No warning when closing the tab or reloading during an active call
RoomMemberEvent.Membership listener on Room never fires (dead handler)
Sender-only search returns membership/state/reaction events as results
Forwarding an encrypted attachment into a plaintext room publishes its AES key