Hi, if you call "rest_v2/reportExecutions" without authentication or a wrong password, you can start any report and if you have the request-id and export-id, you can download every report from any other user. all ressources have the permission "no acces" for the role "ROLE_ANONYMOUS". it also makes no difference, if you disable or delete the user "anonymousUser". Regards, Roland