> Twitter said that a “bug” sent user’s private direct messages to third-party developers “who were not authorized to receive them.”

user's -> users'

__plural__