A previously reachable board detail endpoint allowed anyone, including users not signed in, to read any board’s tasks and member list through the board address. By accessing the endpoint without authentication, a logged-out caller could inspect tasks and the member directory. After closing this endpoint on the live site, logged-out callers now receive “Unauthorized” and no board data, while logged-in users only see boards they own or belong to. The old endpoint is now gated and no longer leaks cross-board data. (https://app.hypertask.ai/detail/project-15/7160)