no, it is a hole, intentional or not, and a major violation of user trust. They can retain it in the DB for 30 days, but there is no justifiable reason to hand out the content of deleted comments, posts, user profiles, anything, to literally any person or script that asks for it

Wow. Whoever wrote your app… That sucks of them ngl. If there’s a “hey the user deleted this” flag you should honor it. Though I mostly blame lemmy devs for giving them the opportunity to begin with, and I really don’t think most people would expect to have to edit a comment to remove personal info or whatever they don’t want people to see, when there’s a delete button right there. Most of the time its harmless, yeah, but I still don’t think we should be giving instructions on how to view deleted comments (potentially en masse), that’s just giving the lowest effort assholes somewhere to dig for the 1% of deleted comments that are genuinely sensitive.

My whole point is there’s no way of spreading the word to every user of the site that doesn’t also tip off attackers who might want to exploit this knowledge, and even if you pushed out a pinned post or DM to every user it would still not see perfect adherence. There needs to be a server side fix, and all the instances we’re federated with need to upgrade as well, and in the meantime we probably shouldn’t yell it from the rooftops. I guess its been like this for ages but… still, this is bad and should be taken seriously