# Private category comments exposed via email

**URL:** https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764
**Category:** Bug
**Created:** [December 8, 2018, 2:01pm UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764 "2018-12-08T14:01:52Z")
**Posts on this page:** 1
**Showing post:** 13

<div class="post-metadata">

### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [January 9, 2019, 2:23pm UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/13 "2019-01-09T14:23:00Z")

</div>

> [@dachary](#):
>
> Create a topic in a private category and include a link to the topic

> [@icaria36](#):
>
> Create a topic in Discourse (where the staged user cannot access)

I cannot reproduce this when I post in a category that is exclusive to certain members (e.g. the “Staff” category).

But, at least in @icaria36’s case that’s not what happened. The topic was created in the “Site Feedback” category which is visible to everyone. I guess the fact that Discourse sent a notification was unexpected because the forum is configured as `login required`.

I’m not sure if we should prevent notifications emails to staged users when the forum requires a login (and maybe even is `invite_only` or requires user approval). I’m on the fence here. The notifications certainly make sense when the forum is public.

@dachary and @hellekin: Can you please verify the permissions of the “private category”? I don’t see a way for a staged user to get a notification unless the user has access to the category.

---

_[View the full topic](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764)._