Assume that you use SQL Server Reporting Services (SSRS) 2016. When you use the Report Service Web Portal, hidden parameters are included in reports. This issue occurs even when you use the non-administrator role.
Note Hidden parameters should be hidden in reports when you are a member of the Browser role.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.