Issues · intendednull/willow · GitHub

Labels Milestones New issue

general-audit lessons: 2026-05-03

#593

· intendednull opened

on May 3, 2026

audit F25 [quality]: 3 stale RUSTSEC IDs in ci.yml ignore list (cargo-audit drift)

#592

· intendednull opened

on May 3, 2026

audit F24 [quality]: longPressAvatar uses bare waitForTimeout(500) for press-hold threshold

#591

· intendednull opened

on May 3, 2026

audit F23 [tech-debt]: longPress post-touchend waitForTimeout(300) with no condition

#590

· intendednull opened

on May 3, 2026

audit F22 [tech-debt]: switchTab helper uses bare waitForTimeout(200)

#589

· intendednull opened

on May 3, 2026

audit F21 [tech-debt]: permanent test.skip(true) on mobile long-press compare-sheet test

#588

· intendednull opened

on May 3, 2026

audit F20 [quality]: WebRTC error closures log JsValue with Debug, not Display

#587

· intendednull opened

on May 3, 2026

audit F19 [observability]: localStorage write failures silently dropped

#586

· intendednull opened

on May 3, 2026

audit F18 [quality]: ICE candidate handle_ice_candidate result swallowed

#585

· intendednull opened

on May 3, 2026

audit F17 [security]: CSP img-src lacks https: but auto-embed renders external images

#584

· intendednull opened

on May 3, 2026

audit F16 [security]: Content::File size_bytes attacker-declared, filename/mime unbounded

#583

· intendednull opened

on May 3, 2026

audit F15 [security]: replay on_event allocates ServerData keyed on attacker-chosen server_id

#582

· intendednull opened

on May 3, 2026