Block a user
Deafen via per-participant setVolume is undone by EC volume controls and clobbers tile volumes on undeafen
Repo hygiene: eight dead GitHub Actions workflows under
.github/workflows never run on Gitea
Process: no CODEOWNERS or required review — a single push to
lotus deploys to production in ~11 minutes
CI: the
lotus-build.sh upstream-merge path deploys without running CI
CI: bundle size is reported but has no budget — regressions pass green
CI: ESLint runs without
--max-warnings, so new react-hooks/exhaustive-deps warnings never surface
CI: no dependency update automation (Renovate/Dependabot)
CI: no secret scanning, and
config.json (incl. any gifApiKey) ships inside the build image
CI: built output is never loaded — add a
vite preview boot check after npm run build
CI: the Docker image is never built — add a
docker build job so the documented deploy path can't rot
CI: add a Playwright smoke test that boots the built client and exercises the composer in an E2EE room
CI:
npm audit is informational — high-severity advisories should fail pull requests
Client audit 2026-09 — tracking index
Dead code: unused useForceUpdate.js
syncDecorations.mjs fragile regex parsing
CollapsibleBody's reduced-motion check is a one-time snapshot, not a live listener
Terminal boot sequence has no touch/click dismiss and isn't hidden from assistive tech
Room Insights ("stats") panel freezes at open-time data and never reflects new activity
SendingSpinClass and CallAvatarAnimation ignore prefers-reduced-motion
Room Activity Log can misclassify membership transitions for back-paginated (older) events