Some users of the popular payment app Venmo were surprised to learn that by default all transaction are public.

Venmo is part social media platform and part payment provider. The app does not show how much the transactions are, but does make public who paid whom. Users are often able to comment why they paid a particular person.

This is a problem, according to some users.

“Social media is really meant for us to share personal information, whereas we always think of payment on a more security platform,” says cybersecurity expert Scott Schober. “When you see the convergence of these two, a lot of red flags go up.”

Researchers in Germany showed that the public display of some of the information seen on Venmo can be risky. A couple’s relationship drama was exposed over the app – the man repeatedly sent a woman money, she kept sending it back.

The researchers also found an apparent marijuana dealer who unwittingly posted every sale to every customer.

A spokesperson for Venmo says in a statement, “The safety and privacy of Venmo users and their information is one of our highest priorities. Our users trust us with their money and personal information, and we take this responsibility and applicable privacy laws very seriously.”

Venmo users are able to turn off the public display using the app’s settings.

“You have to go that extra step to protect your own privacy, which is a little bit strange these days,” Schober.

Security experts say that anytime a user makes a payment over social media, they are putting themselves at risk. If someone gets access to the account, they may be able to get the money.

The experts say that the best way to protect yourself is by adding a second layer of protection, such as requiring a password or fingerprint for each transaction.