Warning: Potentially serious security issue if you use jsConnect and reinstall your site.
Today I stumbled upon an odd behaviour of the latest JsConnect plugin. I was doing a demo to a colleague, and invited him to register to our main website, then move to our forum to show how JsConnect + Auto JsConnect work together. When he opened the forum, he got his account created on it, but, for reasons I can't explain, he got incorrectly assigned the roles Administrator and Forum Moderator.
Our website does not pass any roles to Vanilla, hence we expected the new User to be created as Member. When I went into the Control Panel to check, I also noticed that the column First Visit shows May 18, while this person has never had access to the forum before today (it wasn't even published). Interestingly, May 18 is the date of my first visit, i.e. the day when I installed the forum and set myself as an Administrator. There cannot be any chance that the User already existed, as we never met him before last week and I nobody could have created him an account in May.
I haven't been able to consistently reproduce the issue. All my further attempts to register new Users results in them being correctly created as Members. This, however, makes the issue even more dangerous, as a User could find himself Administrator without anybody noticing, and make all sorts of mess (voluntarily or not).