    def setUp(self):
        # Find root page
        self.root_page = Page.objects.get(id=2)

        # Add child page
        child_page = SimplePage(
            title="Hello world!",
            slug="hello-world",
            content="hello",
        )
        self.root_page.add_child(instance=child_page)
        child_page.save_revision().publish()
        self.child_page = SimplePage.objects.get(id=child_page.id)

        # Login
        self.user = self.login()

        # Add a couple more users
        self.subscriber = self.create_user('subscriber')
        self.non_subscriber = self.create_user('non-subscriber')
        self.non_subscriber_2 = self.create_user('non-subscriber-2')
        self.never_emailed_user = self.create_user('never-emailed')

        PageSubscription.objects.create(
            page=self.child_page,
            user=self.user,
            comment_notifications=True
        )

        PageSubscription.objects.create(
            page=self.child_page,
            user=self.subscriber,
            comment_notifications=True
        )

        # Add comment and reply on a different page for the never_emailed_user
        # They should never be notified
        comment_on_other_page = Comment.objects.create(
            page=self.root_page,
            user=self.never_emailed_user,
            text='a comment'
        )

        CommentReply.objects.create(
            user=self.never_emailed_user,
            comment=comment_on_other_page,
            text='a reply'
        )
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.