Eventually, we warned Slack that we had drafted a public disclosure, and then we still sat on the post quietly for months after they asked us to give them more time. We kept quiet and proactively asked for updates. We reached out to Slack support over 6 months ago. UPDATE : While we’re thrilled to see this patched, we can’t help noticing the timing of the fix. Guest calls to are still able to query users inside and outside the channel to retrieve profile fields (including hidden custom fields 😬 – special thanks to Eric Miller for the confirmation) This change seems limited to the users.list endpoint. Guest account calls to that endpoint now only receive profile information for users in their channels 🎉 UPDATE : Slack rolled out a change to the users.list API endpoint on Friday Mato filter responses for guests.
0 kommentar(er)
