Block a user
Scene over-splitting: one radio conversation becomes two incidents
/admin reads are not org-scoped, leaking data across tenants
Billing UI is mock data and shows every org a fabricated trial
Google sign-in fails: auth handler is cross-site under Chrome storage partitioning