Block a user
Cross-tab session sync is absent on the auth pages
Quick Reply's failure is swallowed with no user-visible feedback
LotusToastContainer toast auto-dismiss timer is not reset in a fixed slot, so a fast burst can hide a toast before it's read
getNotificationType/main-timeline gate re-derives push rules on every event without memoization
notificationclick always focuses the first matching window client, not the one most relevant to the notification
GIF picker sends search terms and IP directly to Giphy, outside any privacy setting
SendingSpinClass and CallAvatarAnimation ignore prefers-reduced-motion
Terminal boot sequence has no touch/click dismiss and isn't hidden from assistive tech
Primary accent color fails WCAG AA 4.5:1 as text in Midnight and Lotus Terminal Light themes
useTauriCallPower never releases the native keep-awake state on unmount
seasonalThemeOverride is the only enum setting with no persisted-value validation
Page Zoom input silently discards a typed-but-unconfirmed value on blur
KaTeX renders remote LaTeX with no
maxSize/maxExpand limits
Location messages load an OpenStreetMap iframe with no facade or auto-load gate
CollapsibleBody's reduced-motion check is a one-time snapshot, not a live listener
Documented "leading emoji rendered 1.15× larger" room-name feature is not implemented
Documented secondary glow/blink keyframes for animated backgrounds don't exist
Earth Day globe decoration risks sitting over the composer
Sender-only search returns membership/state/reaction events as results
Forwarding an encrypted attachment into a plaintext room publishes its AES key