When a PAUSE admin changes someone's secret email address, the old one is revealed

[neilb]

When an admin changes someone's email address, an email is sent to the modules@perl.org list which reveals the previous private email address.

See: https://www.nntp.perl.org/group/perl.modules/2021/03/msg102493.html

[wolfsage]

I have no idea how this happened, it does not seem possible...

[charsbar]

@wolfsage I found how to reproduce this:

• set "The email address testuser@cpan.org should be configured to forward mail to ." to my public email address
• and then remove the secret email

[wolfsage]

Huh... okay!