Block a user
CallControl.setPipMode writes state nothing reads
Soundboard clip blob URLs are never revoked and survive logout
No warning when closing the tab or reloading during an active call
Fragile postinstall patch script for folds Icon
"Focus camera" pins a participant with no way to unpin
Lotus-added UI bypasses the app's i18next mechanism entirely — always renders in English regardless of user locale
Package.json engines version misalignment with README and CI
Primary accent color fails WCAG AA 4.5:1 as text in Midnight and Lotus Terminal Light themes
Room-history export shows outdated content and a garbled duplicate line for edited messages
Room invite link / QR code always uses the local homeserver as the only via-server, ignoring the shared via-server resolver
Notification profile presets don't clear an active "Pause Notifications" snooze
"Deny" on a pending knock request has no error handling and can be shown to users who lack kick power
Avatar Decoration settings panel shows "None" on any fetch failure, not just true absence
Profile field edits can be clobbered by a slow-loading initial fetch (pronouns, timezone, avatar decoration)
Logout's search-index wipe can report success while another tab still holds the DB
Element Call iframe is same-origin, so its
sandbox is a no-op
Shipped nginx/Netlify configs set no CSP, frame-ancestors or referrer policy
Composer drafts survive logout and are auto-hydrated into the next account's session
Settings are never synced across tabs — one tab's whole blob clobbers the other's
Read-position recompute walks all joined members and re-renders the whole timeline