Is returning list of app_name + codename of permissions for currently logged in user a security risk in django?

I have an app named "todos" and inside this app I have a permission code named "add_todo", Is it a bad idea to return app name + code name(todos.add_todo) as a mechanism to control which buttons and UI to show to user in the Frontend?

I currently wrote an endpoint that returns all of the user's permissions as a list in this format: "app_name.permission__codename". I was wondering whether this would pose a security risk or not. Also it's worth noting that only currently logged in user can see his/her own permissions.

No there is no security issue but prefered way is to return action + app_name. if you look at permission model it has content_type that directs to app's model.

So your codename will be:

can_add_todos
can_delete_todos

And name would be caps of first letter of each word and space instead of underscopes similar example is from the docs