Issue Reports | whoot. Docs

Reports From the Public

Every sign-up page (the page a QR poster opens) can carry a second capability: Report an issue. Anyone who scans the poster — signed up or not — can describe a hazard, damage or behaviour that concerns them, and it lands in a Security Operations queue rather than in somebody's inbox. The reporter walks away with a reference like IR-7KQ4XN, chosen so it reads cleanly over a radio.

Reading the queue needs security_ops.view; triaging needs security_ops.manage. Report forms are built by anyone holding security_ops.manage or messaging.manage.

Building a Report Form

A report form is a reusable question set, attached to a sign-up link. Build one from the recipient-list screen, with a live preview of the real public page beside it. Every form has exactly one free-text "what happened" question; you can add a category chooser, a location question (with an optional one-tap GPS button), multiple choice, numbers and extra text questions — up to sixteen. Choose whether the reporter's name and contact details are never asked for, optional, or required.

A form that offers attachments opens short. Venues told us the page asked too much before anyone had said anything, so it now leads with the recorder and the photo picker, followed only by what a report cannot be sent without: the questions you marked required, the what happened box (which disappears once a recording replaces it), and a contact detail where you have made one mandatory. Every other question you wrote sits one tap away under Answer the full form instead, and nothing you marked required is ever hidden. Forms with no attachments enabled are unchanged — the questions are the form, so they all show.

Deleting a form never breaks a printed poster: the page quietly goes back to offering sign-up only. And every answer is stored with the question it was actually asked, so editing a form never rewrites past reports.

Photos and Voice Messages

A form's Attachments panel adds two things to the public page. Photos — choose how many a reporter may attach, up to four. Voice messages — pick the room recordings should land in, and the page gains a recorder: sometimes it is easier to say it than to type it. A recording can stand in for the written account entirely — a report needs the typed "what happened" answer or a voice message, never necessarily both, and a voice-only report shows the recording's summary in the queue. Attachments are only sent when the reporter taps Send report, and the page says so in as many words.

Voice — The clip arrives in your chosen room as a playable, transcribed message, and on the report itself with an automatic one-line summary for the queue.

Photos — Re-encoded on the reporter's own phone before upload, which strips any embedded location data. Visible only to Security Operations, on the report.

Use a dedicated TX Only room with transcription enabled — reporters' clips go in, only Security Operations listens, and ordinary room traffic stays out. Each recording is transcribed, which is billed as transcription time.

Triaging the Queue

Open Security Operations → Issue Reports. Reports arrive newest first, and the sidebar badges the open count. A report moves through new → acknowledged → in progress → resolved (or dismissed), can be assigned to a person, and carries a running history of every change. Priority is set here, by you — never by the reporter, because a public form where anyone can assert urgent would sort the queue by confidence rather than risk.

Flagged audio — An amber chip on the row when the automatic review of a recording heard strong language, or something that may not be a genuine report. It is advisory: listen before acting on it.

The map — A reported coordinate opens on your own incident map, in a dialog, with the accuracy circle drawn.

Photos — Open in a gallery you can page through with the arrow keys.

Voice — Plays inline, with the summary above it and the full transcript underneath.

Reporter details are self-declared and unverified — the page is public and asks for no login. The queue says so next to them; treat a typed name as a claim, not an identity.

Every new report notifies whoever holds security_ops.manage (tenant admins as the fallback), with a link straight to the report.