What I had read in multiple places seemed to indicate that it did not do that, but now I'm not so sure

Imported my previous posts from twitter. App should show a small indicator to note that it isn't new

summary of how apps tended to mitigate a reported deserialization vulnerability

summary of how gadgets tended to be introduced into a library

paper here https://arxiv.org/pdf/2208.08173.pdf

Though tbf, anything trying to be an API is only as good as it's documentation, contracts, and change control

Older post focusing on intra-service auth is also great https://web.archive.org/web/20200507173734/https://latacora.micro.blog/a-childs-garden/