Would it be worth just skipping this loop and returning an empty `user_list` if the user doesn't belong to an organisation (to solve the security concern)?