@anon60302432 brought into our notice that SSO payload includes email as well so we’ve hidden the payload behind a button click as well, via:
https://github.com/discourse/discourse/commit/a174c8b8d42da08b9a9f13b96dfd17003bdaac86
3 Likes