It requests this URL: https://ledstrain.org/api/users
Here is the content of "users"
{
"type":"users",
"id":"10",
"attributes":{
"username":"xxxx",
"avatarUrl":null,
"bio":null,
"joinTime":"2016-10-00T13:13:41+00:00",
"discussionsCount":0,
"commentsCount":2,
"canEdit":false,
"canDelete":false,
"lastSeenTime":"2017-07-00T02:19:38+00:00",
"canSuspend":false
},
"relationships":{
"groups":{"data":[]}
}
}
So, no email included, it's safe.
I think it's a bug, and Flarum Team might fix it at the next release. @Slacor