describe unexpected situation where a logged-in user can delete other comments

diff --git a/doc/bugs/logged_in_users_can_remove_any_comments.mdwn b/doc/bugs/logged_in_users_can_remove_any_comments.mdwn
new file mode 100644 (file)
index 0000000..e4bd44e
--- /dev/null
+++ b/doc/bugs/logged_in_users_can_remove_any_comments.mdwn
@@ -0,0 +1,6 @@
+[ the precise circumstances around which this can happen are still being nailed down ]
+
+[[plugins/remove]] says:
+> Users can only remove things that they are allowed to edit or upload.
+
+This permits a logged-in user to remove comments by other users, which might be unexpected. *— [[Jon]], 2021-09-30*