Today I found a new question on Crypto.SE (with nonsense content), posted by a non-existing user account.

The question is now deleted, but devs should be able to look it up: https://crypto.stackexchange.com/q/1276. The user showed up as user1119:


The corresponding user page gives only a 404, as well as any moderator-only pages about this user.

After some brainstorming with other moderators, we were able to reproduce this: An unregistered user has a delete link in his profile, which seems to delete the cookies (or the server-side association with this cookies). This link does even work when this user has an upvoted question or answer, as we (me and Gilles) tested as user1120 and user1121 on this other now deleted question.

I think that removing a user account when this user has already contributed something (like an answer or question) should not be possible, as this doesn't even allow moderators to look up user details.

(If there are only downvoted questions/answers, we can allow deletion if the user deletes his contents first, but it should not be that simple for upvoted ones.)


1 Answer 1


Users only get to self delete if they have at most ONE post or vote, deleted or not (we may adjust the deleted or not check in the future, not planned right now though). This check happens when showing the link and when handling the deletion endpoint, you cannot bypass it. Since a bounty is a type of vote under the covers, it falls under this check as well.

However this did alert us to the fact we forgot to add the self delete link to the new user profile...this will happen in the next build.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .