impulsive on X: "every public Notion page is leaking the email addresses of everyone who edited it.
zero authentication. no cookies. no tokens. one POST request returns full names, emails, and profile photos for every editor on the page.
your company wiki is public? every employee's email is https://t.co/jqWSCVBoyH" / X
every public Notion page is leaking the email addresses of everyone who edited it.
zero authentication. no cookies. no tokens. one POST request returns full names, emails, and profile photos for every editor on the page.
your company wiki is public? every employee's email is exposed. right now.
reported in 2022. still works in 2026. like what is the point of even having a BBP
thread...
Read more at x.com