Shopify: OrderListInitial leaks order details

Hello, During my investigation I have noticed that OrderListInitial graphql operation is leaking more information that it suppose to be for a staff with "Customer" only permission. Normally the graphql call is as below. POST /admin/internal/web/graphql/core HTTP/1.1...