A missing contributor-scoped access control in the Gittensory MCP tool and REST API profile endpoint allows any authenticated token holder to access other contributors' profile data. This includes sensitive financial metrics such as alphaPerDay, taoPerDay, usdPerDay, and in the REST API, the hotkey. Other endpoints enforce proper access controls, making this an oversight rather than by design. The vulnerability enables unauthorized disclosure of miner financial data and hotkey information via the profile endpoint and MCP tool.