prevent data leakage in %username/public.json