GPDR

adding a user to a project allows any authenticated manager user to access the list of all users, including their password :