ConcordReview

Why: The first registrant on any fresh server becomes owner and admin. A later registrant matching the configured admin email takes ownership, and the first registrant keeps Admin. Nothing verifies email. Reproduced through the real registration handler.

Done when: A local setup command or single-use secret creates exactly one owner, even with simultaneous requests. Transfers revoke the previous holder. Restart cannot reopen setup.

Why: Any logged-in user can read any channel's history by UUID (reproduced). Voice state, voice signaling and file-transfer signaling relay to any target user with no shared-channel check, which hands a stranger a peer connection to someone's microphone and IP. Whispers need no shared server. Edit and delete trust the client's channel ID for the permission check and the broadcast.

Done when: Every handler that takes a channel or target resolves it server-side and requires membership plus the relevant permission. Denied members cannot read, hear, signal or be signaled. Revocation reaches connected clients.

Watch: The permission helper uses any-bit semantics. No caller passes a combined mask today, so fix the contract before one does.

Why: The connection string passes _foreign_keys=on&_journal_mode=WAL, which is the mattn driver's syntax. The pinned driver is modernc, which only reads _pragma=. Probed live: foreign keys 0, journal mode delete, busy timeout 0. Cascade deletes orphan attachments, mentions, reactions and voice states. Plugins sharing the file hit SQLITE_BUSY with no wait. The skipped cascade test blames the test database. It is production.

Done when: The DSN uses _pragma=foreign_keys(1), journal_mode(WAL) and busy_timeout(5000), the cascade test is un-skipped and green, and system messages no longer write a nil author into a NOT NULL foreign key. Do the second part first or the server will not boot.

Why: The hub loop is the only consumer of the broadcast channel. Unregister runs inside that loop and does a blocking send to broadcast a presence update. If the 256-slot queue is full when a client drops, the loop blocks forever, every read pump then blocks on unregister, and the typing manager blocks while holding its lock. The whole server freezes with no recovery. Separately, register overwrites by user ID and unregister never checks identity, so an old socket evicts the live one (reproduced).

Done when: Nothing inside the hub goroutine pushes to its own channels. Unregister compares the map entry to the client being removed. A saturated-queue disconnect completes under a test that fills the queue first.

Why: Anyone with Manage Roles can create a role carrying Administrator, assign Admin to themselves, or put Administrator on everyone. Kick, ban and timeout have no target checks, so a Ban Members holder can ban the owner, who is then rejected at identify and cannot log in to undo it. Bans and kicks are only enforced at identify: a live session keeps posting, and kick never removes membership, so the target reconnects with the same token.

Done when: Nobody can grant a permission they do not hold or act on a role at or above their own. Owner and self are untouchable. Ban checks run on send and whisper, revoke all tokens, and close every connection for that user.

Why: One plaintext password is saved and sent to every server. Config and the hub registration secret are written 0644. Plain ws and http are accepted, so a server operator, or anyone on the path, receives a reused credential. Any login error, including a timeout, falls through to registration. There is no logout, no revocation path in use, and 30-day tokens survive bans.

Done when: Each server has distinct credentials, tokens use OS-protected storage, raw passwords leave config files, secrets are 0600, remote auth requires TLS, timeouts never create accounts, and a logout endpoint plus revoke-on-ban exist.

Why: The voice engine contains no mute or deafen logic; the keys only update state, and the server comments that clients suppress audio. The server sends the voice-state event before the voice-server event, so the lower-UUID peer offers before the joiner's engine exists and nothing retries. Encoding trusts whatever frame count the audio backend delivers, so backends with 512-frame callbacks fail every encode. A failed ICE connection is never torn down, TURN is never populated, and reconnect backoff has no jitter.

Done when: Muted stops sending and deafened stops mixing, verified by test. Signals queue until the engine exists. Frames are accumulated to exact 20 ms. Failed peers are removed and retried. Two-user and three-user calls are demonstrated on real networks.

Why: Message, mention and attachment writes are three separate statements. The history handler ignores the cursor it is sent, so the client cannot page past the first batch. Timestamps are stored as Go's String output including the monotonic suffix, while other paths write UTC or CURRENT_TIMESTAMP, so ordering is lexical on mixed formats and breaks across DST. Full outgoing queues silently drop state-changing events. The client's event reader is re-armed on every reconnect, so dispatches can arrive out of order.

Done when: A failed write leaves no partial message. Users traverse more than 200 messages without gaps. All timestamps are UTC in one format. Slow clients resync or disconnect clearly. One reader forwards events in order.

Why: Message content, usernames, nicknames, titles and role names are accepted as raw bytes and rendered untouched. A message carrying an OSC clipboard-write or title sequence executes in each recipient's terminal. This is the one class of bug unique to a terminal chat app, and it is unhandled.

Done when: Control characters and ESC, CSI and OSC sequences are stripped at validation and again at render, with a test that sends the clipboard sequence and asserts it is inert.

Why: There is no CI. The dist target omits the hub, names a no-voice client as the real one, and its shell loop reports success when a build fails. The no-voice target disables CGO but the client imports a native save dialog, so it fails on macOS and Linux (reproduced). The version variables the Makefile stamps do not exist. The README documents --setup and --dashboard; the server accepts --reconfigure and --hybrid. The macOS prerequisites omit opus, opusfile and pkg-config. The Windows steps name gcc while the Makefile requires clang for a documented compiler bug.

Done when: CI runs build, vet, race and the voice build on every push. Failing builds fail the release. Artifacts match their names. A clean-install walkthrough on each platform works from the README alone.

Why: Server registration is unauthenticated and unlimited, and proves nothing about host ownership, so the listing can be filled with junk. Each join then makes the hub POST to whatever host was registered, which turns the hub into a request proxy into its own network. The join limiter keys on X-Forwarded-For, which any client can set. The admin token is compared with a plain string compare.

Done when: Registration is rate-limited and verified with a ping before listing, forwarded headers are ignored unless behind a trusted proxy, and secrets compare in constant time.

Why: If the channel lookup fails, every permission, lock and mute check is skipped and the message is still stored, so any user can grow the database without limit. Reply targets are never validated. Attachment filenames and sizes are accepted as-is, and the client's no-dialog fallback joins the name onto the download directory, so a dotted path escapes it. Status text is unbounded and broadcast server-wide. Force-move and voice-mute write state for any UUID.

Done when: Unknown channels return an error and store nothing. Filenames are base names. Every free-text field has a length cap. Moderation targets must hold live state in that server.