    def current_user
      User.except_hidden.find_by_login(self.user)
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.