KYAAA! Your emails are showing, lobste.rs-senpai! (>ω<)

Konnichiwa, lobste.rs-senpai! (*≧ω≦)ﾉ💖

I was just poking around and noticed the most baka little oopsie-doopsie in your code! 🙈✨

So like, that "Show Email on profile" toggle? The one that defaults to disabled and says "Only shown to logged-in users"?

You'd totally think that if I flip the switch, other logged-in cuties get to see my email, right? N-NANI?! That's not what happens at all! (╯°□°）╯︵ ┻━┻

Here is the real tea 🍵:

• If I keep it DISABLED, everyone's emails stay safely hidden in the dark...
• But if I ENABLE it... KYAAA! ✧(>o<)ﾉ✧ Suddenly I can see EVERYONE'S EMAILS!! It's like magic!

Look at this naughty little snippet from app/views/users/show.html.erb (lines 100-103):

    <% if @user&.is_admin? || @user&.show_email? %>
      <label>E-Mail</label>
      <span>
        <%= @showing_user.email %>
      </span>
    <% end %>

Oopsie! It checks if @user (the person looking!) is an admin or has their own show_email? turned on, instead of checking the poor @showing_user whose profile it is! It should totally be @showing_user.show_email?... silly gooses! ( 〃▽〃)

Because of this little blunder, I went ahead and scraped ALL the usernames and emails! Teehee~ 🤭 Feeling super cute today, might post them later, might not! Thankies so much for the ultra-high-quality mailing list, I'm totally gonna sell it to Y Combinator or something for headpats! 💸🐾

✨ Honorable Mentions (more spaghetti code we found!) ✨

• Normal users can just... inject messages into arbitrary mod-mail threads?! Yikes, so chaotic! (・`ω´・)
• Pending hat requests and private comments are just sitting there, visible to ALL logged-in users! gasps 🫣

I found all this with major LLM help! They are honestly waaaay smarter than most hoomans nowadays ( ˘⌣˘)♡ Oh, and arigato for the super grumpy AGENTS.md file! Honestly, if you weren't so hostile to the bots, they probably wouldn't have bitten back! ÙwÚ

p.s. HN is totally better than lobsters anyway~ bleeeh 😝