This issue was originally reported by sururu-k as part of a series of ai slop public pull requests. Although the original pull request was closed as ai slop, I later confirmed one described a real security issue.
users/notify/list
following/list