Bug/Security Users

I created a separate account that is not an admin, to ensure that account only has access to a specific workspaces. However, two issues so far:
1. They user can type: https://app.snoooz.ai/users
They see all users and workspaces, they cant edit them but its still not the best approach. I would think only if they were manager of that one workspace they could see the users for that one workspace, if not a manager or admin and they should only see their own account or not get to the page at all.
2. Analytics
All users have access to Analytics, but it shows analytics for ALL emails not the emails associated with the users mailboxes. Only admin should see all, and I would argue its probably something that should be moved to workspaces or add a workspace/mailbox filter.