http://e26whn2524322mkxb3cbyk27ev2ihhq2biz35hty7gzgsyrwrygq27yd.onion/posts/blog/security/digging-into-the-behaviour-of-a-self-authenticating-mastodon-scraper-bot.html
Mastodon As it turns out, the fact that arbitrary apps can be added to Mastodon's database is already known , but seems not to be seen as being too big of a deal. There are some reasonable arguments made in that issue for why it's not too problematic, but I tend to lean towards this still being something which requires a fix (albeit, not urgently).