ewan's devlog·Aug 12, 2026 MetalBear hardens OAuth, session scopes, and identity against the reference PDS
An unauthenticated login_hint could mint an OAuth code for any account, app passwords and full-access OAuth grants could reach account-deletion and email-change endpoints, and DPoP was optional everywhere it mattered -- all closed, alongside a run of PLC identity bugs and a new WebAuthn/passkey login path. 0.7.0 to 0.38.2.metalbear·atproto