Technically, the limitations of open graph require a specific user auth token to get any extra data. So if your fiancee gets compromised, they can get the name'

Technically, the limitations of open graph require a specific user auth token to get any extra data. So if your fiancee gets compromised, they can get the name's and profile pictures of her friend's but that's all. Any extra information (like email) require the user to visit the site with the xss as well.