InsertService API bypasses user inventory privacy settings

Just testing and confirming here - this only works with models and decals, so other types of assets you’ve uploaded with a private inventory should be fine (e.g. audio). In this manner, it’s not a complete bypass, just for two categories of your inventory.

Your models and decals are counted as user sets (I’m not sure why this is the case and it doesn’t really matter either). All other sets that may appear in this list are actually from a very old feature that was sunset 3 years ago, sets. Check Sunsetting Sets for details. Found out by dumping my own inventory and finding sets that I subscribed to at least 6 years back or more.

Just for anyone concerned that this can be used to dump other assets. This method can only fetch models and decals as well as sets you’ve created or subscribed to when the Sets feature existed.

4 Likes