#[snarfed]learning by building things is useful too though! you can mitigate the risk by limiting what you put into anything IndieAuth-accessible. a step farther would be to only use your auth lib on a test or secondary site, instead of your main one