Hi all, I've been chatting to people about this Umbraco pitfall for a while and lots of folk didn't know about it, so I wrote it up! The bottom line is that it's really easy to expose view/user data by extending the page model 🫠.
Let me know if you have any thoughts or want to discuss at all!
https://harrygordon.co.uk/blog/content-model-best-practices/