diff --git a/src/cloudron.js b/src/cloudron.js
index cc60bd031..d3046474c 100644
--- a/src/cloudron.js
+++ b/src/cloudron.js
@@ -141,7 +141,8 @@ function getConfig(callback) {
             isDemo: settings.isDemo(),
             cloudronName: allSettings[settings.CLOUDRON_NAME_KEY],
             footer: allSettings[settings.FOOTER_KEY] || constants.FOOTER,
-            features: appstore.getFeatures()
+            features: appstore.getFeatures(),
+            profileLocked: allSettings[settings.DIRECTORY_CONFIG_KEY].lockUserProfiles
         });
     });
 }
diff --git a/src/server.js b/src/server.js
index 666ee77d1..fb52c443a 100644
--- a/src/server.js
+++ b/src/server.js
@@ -139,7 +139,7 @@ function initializeExpressSync() {
     router.post('/api/v1/backups/create', token, authorizeAdmin, routes.backups.startBackup);
     router.post('/api/v1/backups/cleanup', token, authorizeAdmin, routes.backups.cleanup);
 
-    // config route (for dashboard)
+    // config route (for dashboard). can return some private configuration unlike status
     router.get ('/api/v1/config', token, routes.cloudron.getConfig);
 
     // working off the user behind the provided token