We're using <button>s for Cancel. There's some javascript that will properly destroy the forms when that button is clicked, but without JS, that button will also submit the form. That's probably not what you'd expect when you hit cancel.

We probably just want to hide those buttons if users run Flow without JS, like:

.client-nojs button[data-role=cancel] {
    display: none;
}

Version: unspecified
Severity: normal