@brucewayne25, thank you for that eye-opening article, I just followed its recommendations. I forgot to add WordPress itself as a primary suspect, and sure enough, /wp-json/wp/v2/users seems to be an open book.
I’ve sent a new e-mail to your support with the info. I hope the mystery (which might well be a blunder on my part) will be solved.
