# Data privacy concern

**URL:** <https://meta.discourse.org/t/data-privacy-concern/153787>\
**Category:** Support\
**Created:** [June 4, 2020, 8:16am UTC](https://meta.discourse.org/t/data-privacy-concern/153787 "2020-06-04T08:16:42Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Hilario](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hilario/32/152199_2.png) [@Hilario](https://meta.discourse.org/u/Hilario)\
**Post date:** [June 4, 2020, 8:16am UTC](https://meta.discourse.org/t/data-privacy-concern/153787/1 "2020-06-04T08:16:42Z")

</div>

Hello I have been reported some security flaws I would like to understand

**User List** :  
All the platform users are visibles without being identified  
`https://*domain*/directory_items.json?period=daily&order=posts_read`

**User** details:  
We can get all the user details without being identified  
`https://*domain*/users/*user*.json`

Is there a way to limit this situation or the level of user details accesible publicly?  
I know if I only allow login users, all this info is blocked.  
How can I keep some public info but:

- Limiting the posibility of getting USERs LISTING (all the database)

---

_[View the full topic](https://meta.discourse.org/t/data-privacy-concern/153787)._