http://e26whn2524322mkxb3cbyk27ev2ihhq2biz35hty7gzgsyrwrygq27yd.onion/posts/blog/security/digging-into-the-behaviour-of-a-self-authenticating-mastodon-scraper-bot.html
Defences Unfortunately, the options available for preventing arbitrary creation of apps really are quite limited. For tiny instances, the /api/v1/apps endpoint can be blocked at the webserver level location /api/v1/apps {
return 403;
} But this really isn't particularly convenient: if you later want to connect a new app, you'll first need to re-edit this config and unblock the path.