The API create a task assign to me and return a permalink_url. That link open the task that now reside in My Tasks, the problem is if I share that link to someone else and they open it, they get access to My Tasks and all of my tasks are then visible.
Is it a bug? Should I change the permalink_url to something else?
I don’t believe they get access to anything they didn’t already see. You can go to someone’s My Tasks and see all of their tasks you have visibility on.