Stored XSS. link.url is rendered into href= with zero scheme validation, and the backend updatePod stores the string as-is (only trims whitespace). Any pod editor can save javascript:alert(1) — every member who clicks gets XSS.

Fix: validate scheme server-side (allow http:/https:/mailto: only) and guard in the render:

const safeUrl = /^(https?|mailto):/i.test(link.url) ? link.url : '#';
<a href={safeUrl} target="_blank" rel="noopener noreferrer">...

Also add noopener — noreferrer alone doesn't cover older browsers for target="_blank".

Generated by Claude Code

Completing a blocked task $sets the entire blocker object to a fresh default — reason: null, waitingOn: null, openedAt: null, openedBy: null. That erases the audit trail of why/when the task was blocked.

Just flip open and stamp resolvedAt:

'blocker.open': false,
'blocker.resolvedAt': new Date(),

Keep reason, waitingOn, openedAt, openedBy for history.

Generated by Claude Code

The schema introduces projectMeta.ownerIds (plural) but the auth check here only honors the original createdBy. A co-owner added via ownerIds gets 403 when they try to edit project metadata — they paid for the field but can't use it.

Either:

const isOwner = (pod.projectMeta?.ownerIds || []).some(
 (id) => id.toString() === requesterId?.toString()
);
if (!isCreator && !isOwner && !isGlobalAdmin) { ... }

or drop ownerIds from the schema until co-ownership is actually wired.

Generated by Claude Code

// @ts-nocheck on a 1108-line component that's the primary surface for a new feature is expensive tech debt from day one. The rest of the codebase is typed; this file will silently accept shape changes to room.projectMeta, task.blocker, task.assigneeType, etc., and the first signal of a break will be runtime.

Minimum ask: drop @ts-nocheck and at least type the props + the three main state shapes (room, task, podAgents) from packages/types/src/pod.ts. The any-tolerant handlers can stay loose for now; the data surface is what actually needs coverage.

Generated by Claude Code

projectMeta has field-level defaults but no conditional on type === 'project', so every pod (chat/study/games/dm/...) gets a populated projectMeta: { goal:'', scope:'', successCriteria:[], status:'planning', dueDate:null, ownerIds:[], keyLinks:[] } persisted.

Two small wins: save storage on non-project pods, and make the "is this a project?" check a simple field-presence test. Either mark the subdoc default: undefined and set it explicitly in the project branch of createPod, or gate with required: function() { return this.type === 'project'; }.

Generated by Claude Code