Block a user
Cross-tab session sync is absent on the auth pages
GIF picker sends search terms and IP directly to Giphy, outside any privacy setting
Location messages load an OpenStreetMap iframe with no facade or auto-load gate
Any OIDC login failure discards the cached dynamic client id
Avatar-decoration slug from a remote profile is interpolated into a URL unvalidated
KaTeX renders remote LaTeX with no
maxSize/maxExpand limits
Sender-only search returns membership/state/reaction events as results
Forwarding an encrypted attachment into a plaintext room publishes its AES key
In-iframe PTT/deafen key listeners are lost if the EC iframe reloads
RoomMemberEvent.Membership listener on Room never fires (dead handler)
CallControl.setPipMode writes state nothing reads
Soundboard clip blob URLs are never revoked and survive logout
No warning when closing the tab or reloading during an active call
Fragile postinstall patch script for folds Icon
"Focus camera" pins a participant with no way to unpin
Lotus-added UI bypasses the app's i18next mechanism entirely — always renders in English regardless of user locale
Package.json engines version misalignment with README and CI
Primary accent color fails WCAG AA 4.5:1 as text in Midnight and Lotus Terminal Light themes
Room-history export shows outdated content and a garbled duplicate line for edited messages
Room invite link / QR code always uses the local homeserver as the only via-server, ignoring the shared via-server resolver