I found a bug once where you could @ any user in a multi-tennant install of confluence. They ignored the report for two years until someone bruteforced a ccompl

I found a bug once where you could @ any user in a multi-tennant install of confluence. They ignored the report for two years until someone bruteforced a ccomplete list of users and emails from their public facing support site and published it to the ticket. They then 'fixed' it by suggesting use of an apache reverse proxy with a mod_rewrite rule.