Directus REST API's /items/{collection} endpoint leaks information about the existence of collections through differing error messages. Unauthorized users receive distinct error responses when accessing existing collections they lack permission for versus non-existent collections. This behavior reveals the presence of collections to unauthorized users.