On Tue, Nov 11, 2025 at 2:12 AM Jelte Fennema-Nio <me@jeltef.nl> wrote: > 3. Make user dropdowns searchable when not logged in
Adding Magnus -- Magnus, do you remember the rationale for re-adding this protection back in 6ff8c6a52? Does it still apply?
Yes, IIRC we had security complaints about people being able to enumerate all users without being logged in. Since it's not just users who submitted any data, it was enough to just having clicked a link once...
If it was restricted to only show those that had actually submitted into it would've probably been considered OK - but at the time it was not considered to be worth the effort to split those up.
