Expose only createdAt to anonymous users to prevent user account enumeration. Fixes #3