Staging.every.org: Private account causes displayed through API

Summary: Any authenticated user can see which causes a private account user is interested in, by sending a GET request to the API, even though this information is not displayed anywhere on the profile page. In the profile settings, the following message is displayed for "Private Supporter" option : People will be able to find and request to follow you, but only followers you accept will be able to see which organizations you support. Nothing is mentionned about the causes we're interested in, but as a private account, it would make sense to not disclose this information. The fact that this information is not displayed on the web profile page makes me think that it is unintentional to send it as reponse to API requests from any user. Steps To Reproduce: To reproduce this issue, I simply sent an API GET request to /api/users/ On https://www.every.org/settings/profile page, submit the form by clicking on "Update" button and get the send request with all csrf and cookie headers The first line will be PATCH /api/me HTTP/1.1, simply modify this to GET /api/users/any_username and re-send the request (you do not need to keep the body json data) Read the API Json response, especially the "causes":[{"entityName":"Cause Follow","causeCategory":"SOME_CATEGORY"}] part Example: I have two accounts : https://www.every.org/@bug.hunter ([email protected]) - "Attacker" https://www.every.org/@bug.hunter3 ([email protected]) - PRIVATE profile This is...