Users API endpoint discloses GDPRed username history

[byc14 (byc)]

The https://users.roblox.com/v1/users/{userId}/username-history?limit=10&sortOrder=Asc endpoint discloses the username history.

I don’t believe this is intentional, as Roblox has been pretty adamant about not providing developers with their usernames.

I’ve tested using multiple userIds from the GDPR messages. This includes their current usernames, and I’m guessing previous ones.

[MisterRedTurtle (Red)]

Thanks for the report! We’ve filed this internally and we’ll follow up.

[Hippie_ofDoom]

This issue should now be resolved! If this issue is still occurring, please create a new topic for us to look into.