http://e26whn2524322mkxb3cbyk27ev2ihhq2biz35hty7gzgsyrwrygq27yd.onion/posts/blog/security/digging-into-the-behaviour-of-a-self-authenticating-mastodon-scraper-bot.html
For example, a number of API endpoints implement security checks in the following way before_action -> { authorize_if_got_token! :read, :'read:statuses' } When I first saw this, I was concerned that the name implied that it only checked for the presence of a valid token.