Private messages are included on local timeline

[koehn]

1. From the Mastodon client, create a Toot.
2. Set the audience to “only people I mention” and mention someone, and send the message
3. Go to the main https page for your site (e.g., https://example.com/explore) and select “Local” from the list on the right
4. Your private messages are displayed there

[richfelker]

Has anyone clarified whether this is only visible logged in as yourself (laughably bad ux that could be panic inducing for users, but not actually a privacy leak) or publicly?

[xtuc]

Currently private messages are not supported, they might be displayed on public timelines. I temporarly locked this issue to avoid spam.

[EvelynSubarrow]

Would I be correct in thinking that incoming private messages (and not just outgoing private messages) would be publicly available?

[xtuc]

Locking the issue permanently.

As I said in #303 (comment). At the moment, private messages are not supported and we are well aware. Our team is looking into it.

Thanks for the issue @koehn. Feel free to reach out to me directly on Discord for concerns / questions.

[xtuc]

A fix has been merged. Private messages sent from Wildeebest are not showing in public timelines anymore. Please sync your forks to patch your instance.

Also note that, for safety, toots with private or unlisted visbility are now rejected until we implement them properly.

In the future, issues that could be security related can be reported via https://github.com/cloudflare/wildebeest/blob/main/SECURITY.md.

Closing this since the original issue has been addressed.