Request RSS allows bypassing embargo status

[morisy]

Right now, embargoed requests are exposed by the RSS feeds (you could just spider each number to see every embargoed request).

There's two possible fixes I see:

• A randomized RSS "key" so that embargoed requests can still have their feed while not being guessable (comes with its own problems, particularly since the feed URLs become uglier and unpredictable.
• Disable RSS for embargoed requests, which probably makes more sense.

[morisy]

This is not fixed. To see, open this RSS feed for an embargoed request in a browser you're not signed in on or in a private browsing tab:

https://www.muckrock.com/foi/feeds/14044/

[allanlasser]

Oops, sorry about that.