Hacker News Reader

I agreed, would at least consider it a bug if not a security issue.

Definitely bad behavior. Ideally, no one but privileged users should be able to edit the configuration imho but this opens the door for attackers.