it seems somewhat strange to me that we have a dispute system in place so people no longer have to settle their issues in public, when all the individual disputes are visible to everyone simply by adding a number between 0 and 400 to this URL - https://deckbox.org/disputes/

seeing as there's a lot of private information being exchanged in this subsection, why is it not blocked off to everyone but the admin and the two disputees?

Thank you for reporting this ugly security bug. It is now fixed.

I am thankful for the report, but PLEASE in the future, if you find security vulnerabilities, I would very much appreciate if they are not posted publicly on the forum. I will also see the report faster if you use the support & feedback dialog, or simply email me directly.

Thanks!

Will do!