GET /api/public lists pastes regardless of visibility settings:
A password-protected paste (API GET returns password required) appears in /api/public with its title, size, view_count.
An unlisted paste (unlisted: true) likewise appears.
Repro: create {"content":"pwtest","password":"hunter2","title":"pw"} -> it shows up in GET /api/public?limit=50 with title "pw". Same for an unlisted paste.
Impact: metadata of protected content leaks to everyone; titles often reveal content. Protected/unlisted pastes should be excluded from public listings.
`GET /api/public` lists pastes regardless of visibility settings:
- A password-protected paste (API GET returns `password required`) appears in /api/public with its **title, size, view_count**.
- An unlisted paste (`unlisted: true`) likewise appears.
Repro: create `{"content":"pwtest","password":"hunter2","title":"pw"}` -> it shows up in `GET /api/public?limit=50` with title "pw". Same for an unlisted paste.
Impact: metadata of protected content leaks to everyone; titles often reveal content. Protected/unlisted pastes should be excluded from public listings.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
GET /api/publiclists pastes regardless of visibility settings:password required) appears in /api/public with its title, size, view_count.unlisted: true) likewise appears.Repro: create
{"content":"pwtest","password":"hunter2","title":"pw"}-> it shows up inGET /api/public?limit=50with title "pw". Same for an unlisted paste.Impact: metadata of protected content leaks to everyone; titles often reveal content. Protected/unlisted pastes should be excluded from public listings.
Landed via PR #71/#fix landed (merged to main).