Hacker News Reader

How are attackers getting username and real names from this? Surely the password reset page doesn't reveal that information?

View on HN

The "share" button for a board does. Share a Trello board and enter an email. It returns a full name and a username in the response and sometimes the UI.

Reply on news.ycombinator.com