        private Object readResolve() throws ObjectStreamException {
            if (user != null) {
                String id = user.getId();
                if (id != null) {
                    userId = id;
                } else {
                    // The user field is not properly deserialized so id may be missing. Look the user up by fullname
                    User user = User.get(this.user.getFullName(), true, Collections.emptyMap());
                    userId = user.getId();
                }
                this.user = null;
            }
            return this;
        }
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.