Area: Account & identity (audit phase 1) · Surface: /account/sessions (AccountController@activeSessions) · Dimension: law-3-contrast · Severity: cosmetic
The 'this device' row tint is hardcoded to the brand blue's RGB. It happens to read acceptably in both themes at 6% alpha, but it bypasses the theming primitive, so a brand-color change would not propagate and it violates the semantic-token rule.
Evidence
platform/templates/account/sessions.php L60: <tr<?= $isCurrent ? ' style="background:rgba(44,124,255,0.06);"' : '' ?>> — 44,124,255 is the brand blue (#2C7CFF) hardcoded as RGB rather than using a token. Elsewhere in the same area the established pattern is color-mix(in srgb, var(--color-primary) N%, transparent) (e.g. partials/notifications.php:105, profile/show.php:121).
Suggested fix. Replace with background:color-mix(in srgb, var(--color-primary) 6%, transparent); on platform/templates/account/sessions.php:60.
Filed by the automated tenant-app audit (phase 1) and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus