1. I wouldn't use the word "exploiting" in relation to missing access controls.

2. Why link to a toot instead of the blog post itself?

And to think that a simple API key almost completely solves this problem.

And yes, I've double checked that my instance uses wire guard.

We'll never learn, will we?