GET /api/geschichten shipped every author's AppUser email to all readers via GeschichteSummary.AuthorSummary — contradicting the documented rule that author projections never expose email or group memberships. The frontend only used it as a display-name fallback; it now falls back to [Unbekannt], matching the server-side rule in GeschichteService.toView. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
4.7 KiB
4.7 KiB