We just pushed Synapse 0.19.2, which contains a single but important fix for protecting event visibility when accessed via the /context API. Please upgrade from https://github.com/matrix-org/synapse!
/context