Requesting a user or organization profile page ("GET /{username}") with an "Accept: application/rss+xml" or "Accept: application/atom+xml" header returned the owner's activity feed without the visibility check that the profile page and the ".rss" and ".atom" routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when "[other] ENABLE_FEED" was disabled. Activity in private repositories was not included.