# Pasting category link into the composer reveals hidden sub-categories
**URL:** https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541
**Category:** Bug
**Tags:** composer, onebox
**Created:** [May 17, 2025, 10:57am UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541 "2025-05-17T10:57:50Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ondrej](https://meta.discourse.org/u/ondrej)
#### Post date: [May 17, 2025, 10:57am UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541/1 "2025-05-17T10:57:50Z")
👋
I’ve just stumbled across this in another community. In that case, only the Espanol and Francais category should be visible. If you press ‘Private’ you’ll get a ‘This page doesn’t exist or is private’.
I tried to repro this on Meta and after pasting the url of some categories into the composer, I found that #Support has a Bot testing category I cannot access but I can see it.
---
### Author:  [@HamMan2118](https://meta.discourse.org/u/HamMan2118)
#### Post date: [May 18, 2025, 6:19pm UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541/2 "2025-05-18T18:19:22Z")
I tested it here and in another community and found that while subcategories show, any private top-level categories do not exhibit this issue.
For example, if I link both the Support category (a public category) and the Discourse Experts category (a private category), no embed in the Experts category appears (which may be by design, but I found it interesting). So, if I had access to a private top-level category but not all of the subcategories, I would be unable to see the subcategories when linking the top-level category in the composer.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 16, 2025, 3:20pm UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541/3 "2025-07-16T15:20:36Z")
Giving this one a bump as I can still repro here on meta with `https://meta.discourse.org/c/support/6`
> **[Support](https://meta.discourse.org/c/support/6)**
>
> Ask the community for help with anything related to Discourse. To help others help you, share as much detail as you can about the issue and what is occurring, including what you have tried so far from searching, reading the documentation or asking our AI bot.
Is this a small security issue?
For instance, if you had a parent support category for your customers (each with their own private subcategory that the other customers couldn’t see), they could get a sneaky peek at a list of who your other customers are by using this trick.
---
### Author:  [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [July 17, 2025, 2:52am UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541/4 "2025-07-17T02:52:55Z")
Also perhaps a UX problem of the lack of spacing:
---
### Author:  [@ondrej](https://meta.discourse.org/u/ondrej)
#### Post date: [July 18, 2025, 11:13am UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541/5 "2025-07-18T11:13:32Z")
> [@JammyDodger](#):
>
> Is this a small security issue?
Thats what I originally thought but since it hadn’t been actioned I assumed it wasn’t _really_ bad.
---
### Author:  [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [July 18, 2025, 12:58pm UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541/6 "2025-07-18T12:58:11Z")
I can repro this. Thanks for the report Ondrej 🙂
---
### Author:  [@markvanlan](https://meta.discourse.org/u/markvanlan)
#### Post date: [July 18, 2025, 1:42pm UTC](https://meta.discourse.org/t/pasting-category-link-into-the-composer-reveals-hidden-sub-categories/366541/8 "2025-07-18T13:42:35Z")