    def reactions_given
      params.require(:username)
      user = fetch_user_from_params(include_inactive: current_user.try(:staff?) || (current_user && SiteSetting.show_inactive_accounts))
      raise Discourse::NotFound unless guardian.can_see_profile?(user)

      reaction_users = DiscourseReactions::ReactionUser
        .joins(:reaction, :post)
        .includes(:user, :post, :reaction)
        .where(user_id: user.id)
        .where('discourse_reactions_reactions.reaction_users_count IS NOT NULL')

      if params[:before_reaction_user_id]
        reaction_users = reaction_users
          .where('discourse_reactions_reaction_users.id < ?', params[:before_reaction_user_id].to_i)
      end

      reaction_users = reaction_users
        .order(created_at: :desc)
        .limit(20)

      render_serialized(reaction_users.to_a, UserReactionSerializer)
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.