Severe privacy bug: Direct messages sent to mobilizon events appear publicly
When mobilizon events are posted and the event federates across different activitypub platforms people have the possibility to interact with it in different ways. When these interactions are in the form of a direct message (DM), which is normally expected to be only visibly only to the sender and addressed receivers, mobilizon posts these messages publicly under the 'comments'. This is an severe privacy failure which can have severe consequences for people expecting to communicate in confidence.
Steps to Reproduce
Make an event in Mobilizon and look that event up in another ActivityPub software like Mastodon. Then proceed to respond to the event via a DM.
The creator of the event sees the comment of the DM because they are the intended receipient. Otherwise, no one else sees the DM.
The DM is displayed publicly as a comment for everyone to see.
Reproduces how often:
1.3.2, comments enabled (https://events.undersco.re/events/3a10e02f-b68b-4d36-b333-0efce8708ec6)
1.2.3, comments enabled, (https://mobilize.berlin/events/8d3a11e3-2b8c-44c0-bba7-cf49d617a372)
1.0.0. comments disabled (https://whatup.lodis.se/events/87321298-cd64-474f-9e7c-6acd96ed8f39)
1.3.2, comments enabled (https://mobilizon.fr/events/928288e6-03f9-4dfb-8c07-9dfaf902eacc)
[Any additional information, configuration or data that might be necessary to reproduce the issue.]