privacy leak in activity pages

I just visited https://hypothes.is/search and saw this:


A link was exposed to https://hypothes.is/groups/eixQ87nL/educ661ol-sp-17. I am not a member of that group, so following the link yields:


Should not happen.

We've seen this before, there may be another issue filed for it, but anyway, the problem is that the groups page itself was annotated in public. Not sure if we agreed on a solution last time we noticed this. We could perhaps treat group URLs annotated in public as if they were URLs belonging to the group? And/or prevent it with a warning: "You are annotating a group page in Public, this will reveal the secret invitation link, are your sure you want to do that?"

Reproduce the exposure from https://hypothes.is/search and inspect the linked group URL, then review the issue's existing discussion for the unresolved solution. Done means a public activity page no longer reveals a private group invitation URL, with any warning or access behavior matching the agreed resolution.

Written by the indexing model from the issue text.