c2e65adbc6
POST /herowars/clans was accessible without authentication. console.log(req.profile) in profiles controller leaked user data to logs.