Issue #2956771 by jrockowitz, Sam152, Wim Leers, rickmanelius: Sensitive information is disclosed via REST/jsonapi