Thanks for the heads-up. Apparently my instance (Lemmy.one) hadn’t implemented the feature that introduced the vulnerability, and my profile looks fine, but I am going to be taking extra precautions for a while.
And yeah, I think Reddit has been coasting on a combination of user goodwill and a lack of attention to their privacy policies, and now that they’ve burned all the goodwill and shown a variety of weaknesses… I’m looking forward to seeing the lawsuits roll in over the next few years.