Issues · intendednull/willow · GitHub

Labels Milestones New issue

Hover-toolbar "more reactions" button opens full action dropdown instead of emoji picker

#186

· intendednull opened

on Apr 21, 2026

Editable channel-group labels (state-synced)

#180

· intendednull opened

on Apr 21, 2026

[security] Hardcoded Google STUN server leaks user IP metadata

#179

· intendednull opened

on Apr 20, 2026

[security] RatchetCache retains old channel keys in memory without explicit eviction

#178

· intendednull opened

on Apr 20, 2026

[security] Unrestricted events (Pin/Unpin/SetProfile) bypass membership check after kick

#177

· intendednull opened

on Apr 20, 2026

[security] Relay bootstrap HTTP endpoint susceptible to slow-read DoS

#176

· intendednull opened

on Apr 20, 2026

[security] No Content-Security-Policy header in web app

#175

· intendednull opened

on Apr 20, 2026

[security] No rate limiting on worker sync/history requests

#174

· intendednull opened

on Apr 20, 2026

[security] Worker parse_server_message skips author-signer verification

#173

· intendednull opened

on Apr 20, 2026

[security] Voice peer ID spoofing — no signer verification on voice messages

#172

· intendednull opened

on Apr 20, 2026

[security] XSS-prone js_sys::eval() in pinned message jump

#171

· intendednull opened

on Apr 20, 2026

[relay] Shutdown errors silently swallowed with .ok()

#159

· intendednull opened

on Apr 19, 2026