This needs to be hidden behind a configuration flag (off by default) to go into prod. Many networks/bouncers allow the password field to be used to authenticate as a particular user. We can't allow public users to change who the bot authenticates as at this point.
bdrewery
commented
5 years ago
This needs to be hidden behind a configuration flag (off by default) to go into prod. Many networks/bouncers allow the password field to be used to authenticate as a particular user. We can't allow public users to change who the bot authenticates as at this point.