Players can use the target macro to get all attributes, e.g. @{target|token_name} even if they don't have permissions. I found some answers to this topic, and if I'm not mistaken, that is by design and there is no way to hide attributes of dnd5e monsters to player macros. Is that true? If not, how to hide or forbid?