    it "to json" do
      expect(user.to_json).to eql([user.name].to_json)
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.