Linking to PM breaches privacy?

[hellekin]

Context

1. A private group is assigned a public email address.
2. Someone sends an email to that address: a group PM appears in members’ Inbox.
3. Someone in the team creates a topic in a private category (Everyone has no access) that links to the PM
4. the original poster receives a copy of that topic!

Expectation

The original poster should not receive anything about this, especially if it’s a staged user!

What?

flabberghasted

[zogstrip (Régis Hanol)]

Let’s keep everything in the other topic

Private category comments exposed via email

Hi, Discourse version: v2.1.0.beta3 +21 When the URL of a topic created as a result of receiving a mail to a group custom email is linked from a private topic (with [comment](url-of-the-message) ) , all comments from the private topic are mailed to the sender from that point. Here are the steps to reproduce the problem: Create a private category Create the group foo including user bar Set Custom incoming email address to something@someone.com in the Group settings of the group foo From an…