Apple has patched a critical security vulnerability in its Hide My Email service that for over a year allowed anyone to discover a user's real email address, undermining the core privacy promise of the feature.