Great writeup, didn’t expect “bad authentication” to actually be zero authentication, that’s absurd.