I’m told your apps must be hitting a legacy/old endpoint for how sharing used to work with friends adn may be picked up fols listed as friends. They do not actually have access to your server.
In any case I can remove everyone from your legacy friends list unless you can give me specific ones.
