Stopping User Enumeration and REST API Leaks
Attackers do not need to guess your usernames if your site is handing them out through author archives and the REST API. Here is how the leak happens and how to close it without breaking anything you actually need.