diff --git a/crates/manager-core/src/users_service.rs b/crates/manager-core/src/users_service.rs
index 4f936c4..4dd6fd9 100644
--- a/crates/manager-core/src/users_service.rs
+++ b/crates/manager-core/src/users_service.rs
@@ -496,6 +496,14 @@ impl UsersService for UsersServiceImpl {
         cx: &SdkCallCx,
         email: &str,
     ) -> Result<Option<AppUser>, UsersError> {
+        // F-S-003: an anonymous public-HTTP script could iterate emails
+        // via find_by_email to enumerate registered users (the `require`
+        // helper short-circuits on principal == None). Tighten: require
+        // an authenticated principal — scripts that need a "does this
+        // email exist?" probe must wrap it in their own auth gate.
+        if cx.principal.is_none() {
+            return Err(UsersError::Forbidden);
+        }
         self.require(cx.principal.as_ref(), Capability::AppUsersRead(cx.app_id))
             .await?;
         let normalized = validate_email(email)?;