Unsloth Watch posted an update
Unsloth’s Studio code change now blocks API-key and keyless callers from listing, creating, disabling or deleting managed accounts. Account management through the Settings tab still works with a UI session, and Unsloth Desktop is unchanged.
Why it mattersThe project says the old access could let someone with a leaked owner API key, or keyless API access left enabled, take over managed accounts by reissuing setup codes. The commit adds a 403 refusal for those callers. A useful security fix, though a code change is not proof that every deployed instance has it.
Discuss: Should account-management APIs ever accept owner keys, or is requiring an interactive session the right default even for automation?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.