# "Watching first post" Allows other to see PMs

**URL:** https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624
**Category:** Bug
**Created:** [2016年七月22日 01:53 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624 "2016-07-22T01:53:32Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![kk091](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kk091/32/61322_2.png) [@kk091](https://meta.discourse.org/u/kk091)
#### Post date: [2016年七月22日 01:53 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/1 "2016-07-22T01:53:32Z")

</div>

Recently, a member of my forums notified me when he turned on “Watching First Post”, it permitted him to see _all_ PMs. This kinda feels like an invasion of privacy.

Is this supposed to happen or is this a bug?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016年七月22日 02:18 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/2 "2016-07-22T02:18:21Z")

</div>

That seems odd. Watching first post on what category, exactly?

---

<div class="post-metadata">

### Author: ![SidV](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sidv/32/119460_2.png) [@SidV](https://meta.discourse.org/u/SidV)
#### Post date: [2016年七月22日 11:22 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/3 "2016-07-22T11:22:27Z")

</div>

@kk091, What version are you running?  
I tested that here, and did not work.

---

<div class="post-metadata">

### Author: ![kk091](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kk091/32/61322_2.png) [@kk091](https://meta.discourse.org/u/kk091)
#### Post date: [2016年七月22日 14:36 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/4 "2016-07-22T14:36:25Z")

</div>

@codinghorror In our forums, only mods and admins can PM people, but in such a way that mods first have to create a topic and then turn that into a PM through the wrench on the side. It seems to be that the topic has to be created in one of any category which allows anyone with “Watching First Post” turned on to see it. I’m not exactly sure about this though.

@SidV I’m not sure. 😅

---

<div class="post-metadata">

### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil)
#### Post date: [2016年七月22日 16:59 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/5 "2016-07-22T16:59:38Z")

</div>

Sounds like they’re being notified when the topics are not private. Can’t they enable private messaging but set `min trust to send messages` to 4 so that only staff can send them? Even without watching, their scheme could result in people seeing the messages before they become private.

---

<div class="post-metadata">

### Author: ![SidV](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sidv/32/119460_2.png) [@SidV](https://meta.discourse.org/u/SidV)
#### Post date: [2016年七月22日 17:39 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/6 "2016-07-22T17:39:10Z")

</div>

> [@kk091](#):
>
> I’m not sure

Please go to `your-forum.com/admin` and tell us your version 🙂

---

<div class="post-metadata">

### Author: ![kk091](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kk091/32/61322_2.png) [@kk091](https://meta.discourse.org/u/kk091)
#### Post date: [2016年七月22日 19:50 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/7 "2016-07-22T19:50:40Z")

</div>

I’m not sure where exactly to look on the page. Can moderators see?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016年九月21日 15:51 UTC](https://meta.discourse.org/t/watching-first-post-allows-other-to-see-pms/47624/8 "2016-09-21T15:51:18Z")

</div>


