Facebook users can limit the visibility of just about every aspect of their online personas, including the list of their friends on the site. However, as detailed in Mashable this week, even your private friends list can be partially visible to the public.

Even if you set your friends list privacy to “Only Me,” other people can still see their mutual connections with you. It’s all too easy to figure out who someone is friends with by solely look through mutual connections; according to Mashable, inputting two Facebook users’ names into this URL template (https://www.facebook.com/profile.name[Hidden Friends Profile]/friends?and=second.profile[Public Friends Profile]) can show you a mutual list of friends for any two individuals, provided they both do not have their friend lists set to private.

The site even tested this URL trick on Mark Zuckerberg, whose friend list is understandably private, and Chris Cox, the head of product at Facebook, and found 248 friends that they shared on the site.

This is a pretty large loophole for a seemingly “private” setting on Facebook, though the site is aware of it, warning users to:

“Remember: Your friends control who can see their friendships on their own timelines. If people can see your friendship on another timeline, they’ll be able to see it in news feed, search and other places on Facebook. They’ll also be able to see mutual friends on your timeline”

It’s a discomforting thought, but your Facebook friend list is partially only as private as the settings of your mutual friends.

We have often encouraged our readers to set their friends list visibility to “Only Me.” Now would be a good time to encourage your friends to do the same!