Sending "public": false at creation is silently ignored: the paste is stored with visibility: "public" and appears in /api/public (and is viewable by anyone).
Verified repro:
POST /api/pastes {"content":"PUBLIC-FALSE-LEAK-PROOF","public":false} -> 201, id nr2zsd
GET /api/public?limit=200 -> id nr2zsd present
GET /api/pastes/nr2zsd -> "visibility":"public"
Using the documented visibility: "unlisted" field works correctly, so API clients that use the intuitive boolean (public: false) leak content to the public listing. Either honor public:false (map to unlisted) or reject the unknown field with 400 so clients fail loudly instead of leaking.
**Severity:** Medium
**Target:** palette-dev v0.2.1
Sending `"public": false` at creation is silently ignored: the paste is stored with `visibility: "public"` and appears in `/api/public` (and is viewable by anyone).
Verified repro:
```
POST /api/pastes {"content":"PUBLIC-FALSE-LEAK-PROOF","public":false} -> 201, id nr2zsd
GET /api/public?limit=200 -> id nr2zsd present
GET /api/pastes/nr2zsd -> "visibility":"public"
```
Using the documented `visibility: "unlisted"` field works correctly, so API clients that use the intuitive boolean (`public: false`) leak content to the public listing. Either honor `public:false` (map to unlisted) or reject the unknown field with 400 so clients fail loudly instead of leaking.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: Medium
Target: palette-dev v0.2.1
Sending
"public": falseat creation is silently ignored: the paste is stored withvisibility: "public"and appears in/api/public(and is viewable by anyone).Verified repro:
Using the documented
visibility: "unlisted"field works correctly, so API clients that use the intuitive boolean (public: false) leak content to the public listing. Either honorpublic:false(map to unlisted) or reject the unknown field with 400 so clients fail loudly instead of leaking.Fixed and merged to main (v0.2.2 pending release).