Non-Public data returned in API calls

[Kirby]

Affected version

2.2.13

A custom user field can be defined as

• Not being editable by the user
• Not being shown on pofile pages
• Not being shown in message user info
• Not being required

The general perception here is that such a field is "private", eg. can only be seen / modified by Moderators or Administrators.

Yet such fields are returned in API calls like me if the API key has scope user:read.

This could be a security issue, at least it is unexpected.

Suggested Fix
Do not return information in API calls (including but not limited to me) that is otherwise not normally accessible by the user (Preferred)
or
Explicitly document such behaviour