Every attachment of stored content records the key it was stored under, via the library
The chat-only StoredContentExtension (299a911) becomes ImageService.storageExtension in the shared library, and the other MediaService paths that attach content...
An Img keeps the extension its content is stored under — on dedup and on rename
fileExt is part of the storage key (<imgDatId>.<ext>) every reader builds, but dedup matches on the BYTES. Content already held arriving under another name (a ....
The lit Settings row follows the page's own tab
The rail lit the row the member last clicked, so switching tabs inside a settings page (Docs -> General from the page's tab strip) left the light on the old row...
An SI that sends a note with no level the internal default back changes nothing
CP97 Task 17's Luna compare found a live SI's own My Master Note, written before KamoCollab, carrying sensitivity MEMBER after one of her own appends in an AUDI...
An AUDIT org's SI is shown the record-link kinds every SI saw before KamoCollab
CP97 Task 17's Luna compare found her tools/list changed by KamoCollab: CP05 Task 7 appended TASK, DOCUMENT, KB_ARTICLE, MEMBER, AI_RUN and SMS_THREAD to Record...
Reopening a field shows the settings just saved
The stack's sorted field list was memoized on each field's id and order only, so a change from Save Field (Display on Intake, title, required…) never rebuilt it...
IOT_EVENTS max-bytes in binary units — nats CLI 0.5 refuses the bare 10737418240 (IoT SP00)
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
GD alone no longer grants every right on proxy routes
ksemHasRight treated GD (god-mode ELIGIBILITY) as an all-rights bypass, so every god-eligible operator held every right on the 18 proxy routes that use it, with...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
Seal member VoIP credentials at rest with PlatformSecretCipher; re-seal legacy rows at boot
**************** held each member's access token, refresh token (Teams, RingCentral OAuth) and RingCentral JWT assertion exactly as the provider issued them. Ev...
Never relay a browser-set X-God-Mode-Active
God mode is SERVER-owned. The billing and LOS proxies copied the browser's X-God-Mode-Active onto the upstream call, and BillingService treated it plus users.is...
God mode comes from the caller's own session window, never a header
BillingService took X-God-Mode-Active plus users.is_god as god mode, and kamo-internal copied that header straight off the browser, so a god-eligible operator h...
Meeting-provider OAuth state is an opaque one-time Redis token; refresh is locked and committed on its own
state was base64 JSON {orgId, nonce, provider} built by the caller, the nonce was never stored or checked, and the sessionless callback trusted the decoded orgI...
Vet and pin every webhook target, return only failure categories, encrypt signing secrets
The outbound webhook worker POSTed to whatever URL a subscriber stored, from inside the cluster, with no egress control - a subscription aimed at **************...
/api/voip/webhook answers a form post 415 and a non-JSON body 400, never a silent 200
A form-encoded post (Twilio, Sinch, Vonage pointed at the wrong address) fell into readTree(), failed, and was answered 200, so the carrier never retried and th...
No literal internal-auth secret fallback — a blank public-chat secret answers 503
Seven @Value sites and application.yml fell back to the literal dev-secret-change-in-prod when **************** was missing, so a pod without its Secret sent a ...
Read the bulk-export and exchange-document sweeps instead of reporting 0
OrgObjectStorageSweep writes BULK_EXPORTS and EXCHANGE_DOCUMENTS rows into object_storage_days, but OrgStorageAggregator only read that table for BRANDING and D...
Deleting a public API key needs MANAGE_ACCESS_RULES, like creating one
Any member of an org could delete the org's public chat / integration keys: deleteKey checked only that the key belonged to the caller's org.
Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
Stamp a communication-policy refusal of a tool with no intent COLLAB_DENY interaction:<ruleId>
An SI's chat_find_or_create_dm refused by the interaction policy answered COLLAB_DENIED INTERACTION_POLICY but left its audit row's policy_decision and policy_r...
The tours really do start by themselves at sign-in
They never had, for anybody. The trigger waited for userInfo.tokenId, which the type declares but the web app's /api/user-info never sends — so it returned befo...
An image attachment that has not drawn holds a placeholder, and one that never answers fails over
An <img> reports load or error and nothing in between, so a request that never answered left an unsized element at 0x0 — a chat bubble with nothing in it. A mem...
An attachment whose bytes were already stored keeps the extension they were stored under
The content-addressed key is <imgDatId>.<ext>, and every reader builds it from the attaching Img's own fileExt. Dedup matches on the bytes, so the same screensh...
A docked chess window is as wide as its board
The window opened at a fixed 560 while the row decided its height, so at the default 690 row the board was 346px square in a 540px column: 97px of empty table e...
Drag-selecting up or left out of a text field scrolls it
WebKit (Safari, DuckDuckGo on macOS — the reporter's browser) only autoscrolls a text field toward the END of its text during a drag-select: dragging up out of ...
The Settings rail keeps your place in its tree
Choosing a row in the expanded rail ran close(), which also emptied every expanded branch, so each click folded Settings back to its own row and the next sub-to...
A card taller than the room it has scrolls instead of running off the screen
Opened from a name low on a laptop screen (the Interaction Center's "..." on a roster row), the member card was placed below it at full height; once "More" open...
The profile save stores the member's address
The My Profile Address card posted { address, addressDetails, locality, subdivision, postalCode, country } and PUT /members/{id} never read the key, so every sa...
Related-article rows open the article
The Related Articles list under an open article drew each link as a plain box with no href or click handler, so nothing happened when a reader clicked one. A re...
Tiles recover on their own, a manager's Watch shows the camera, cloud logins never stored in clear
From an independent review of the shipped Cameras screens. Viewer: - A Settings "Watch" of a camera not shared with the manager showed "unavailable": the windo...
Nothing dials by itself any more, and four red tests on main go green
The softphone never places a call for the member (owner rule, 2026-10-13): - The lead header's Call work / Call personal now fill the dialpad and stop, like eve...
Tours show for members signed in before them, and survive a failed progress read
Two reasons the first deploy showed no tour, not even on the App Shelf: - The progress read was attempted once per page, and every tour surface waited on it. ...
The guided-tours read answers the member's CURRENT Show Tour rights
A session carries the rights it was issued with and the routine refresh does not re-read them, so everyone signed in before the Show Tour rights existed saw no ...
The boot-time rights sync inserts a role's missing rights in ONE statement
b8014ab3's deploy never became ready. The 31 Show Tour rights made the row-at-a-time insert loop 31 YugabyteDB round trips per role — ~3.5 s a role, ~490 s acro...
Display on Intake now saves
The form editor built each field for the save request without isDisplayOnIntake, so the server stored false for every field that was not required. The toggle re...
The connector relay never sends a reserved close code
When KamoCameraService rolled, the backend socket closed without a close frame (1006) and the relay passed 1006 to the connector; 1005, 1006 and 1015 only descr...
Connector download sizes arrive as strings; the checksums file is not offered as a build
CamerasApi turns KamoCameraService's string longs (config versions) into numbers
An SI's HIGH chat card is raised even while an unread-chat card stands
A person with an undismissed CHAT_MESSAGE card was never told of an SI's NOTIFY (KamoCollab CP12 D14): the announce-once rule dropped the HIGH card too, while t...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.