CVE-2018-6591: Converse.js Exposure of Sensitive Information

The vulnerability stemmed from improper access control configuration when storing PEP bookmarks. The key vulnerable code was in src/converse-bookmarks.js where bookmarks were initialized based solely on PEP support detection, without checking for required publish-options feature support. The commit added a critical check for http://jabber.org/protocol/pubsub#publish-options support via Promise.all([getIdentity, supports(...)]), indicating the previous absence of this security check was the root cause. This allowed bookmarks to be stored with server-default access models rather than enforced privacy settings.