The full user list can be downloaded
Unrestricted enumeration of user records
What this means
Your app lets anyone request every user at once — with no size limit and no check on why they are needed.
Why it matters
A list of email addresses and phone numbers leaves in a single request and is later used for mailings and for defrauding your own customers in your name.
When this is not a problem
Public directories of authors or participants are open by design.
How to fix it
- Limit page size and add pagination.
- Return only the fields the interface actually needs.
- Rate-limit requests to list endpoints.
Prompt for your AI agent
Limit user list responses: add pagination, cap the page size, and return the minimum set of fields.
How to verify the fix: request the list without limits — expect a bounded response