[neodypsis]

I wanted to give it a try, so I went to sign-up with Github but the process failed. So then I signed-out of Github and tried to login again but Flux loaded someone else's profile! Had to de-authorize Flux from my Github.

[robertfall]

Hi,

I'm on call for the team this week.

We'd love to get more information here as we take anything around privacy and authentication very seriously. I'd like to get usernames of profiles involved and rule out being redirected back to a page you were visiting before signing in.

Would you be open to discussing further? You can reach me at [e-mail]. Being able to discuss with you directly would be really helpful.

Alternatively we actively monitor and respond to bug reports filed here: https://feedback.flux.ai/bugreports

[robertfall]

neodypsis reached out and we got to the bottom of this.

When a user visits a Flux project without being signed in we create a temporary anonymous user record for them so that they can interact with the document. These user records are populated with human-like names (which is partially to blame for the confusion here. We'll fix that.)

When a user signs up their anonymous record is updated with the details they provide but the record id remains the same so we can keep the user's interaction history.

In this case when the Github sign up failed the process stopped half way. The anonymous account was never updated with the username neodypsis provided but appeared to be someone else's account (a human name followed by several numbers).

We've verified that the account was indeed linked to neodypsis' Github profile and no-one else had ever had access to it.

We've started some work to improve the OAuth sign up process.