A privacy researcher explored the AT Protocol's PDS infrastructure and discovered that subscribed RSS feed URLs are stored publicly on personal data servers. This exposure revealed private content including Club MacStories feeds, paywalled content from 404 Media, Patreon-exclusive feeds, and private GitLab repository feeds.
Background
The AT Protocol, underlying Bluesky, allows users to self-host their data on Personal Data Servers (PDS), but much of this data is publicly accessible by default.
- Source
- Lobsters
- Published
- Oct 30, 2026 at 07:22 PM
- Score
- 6.0 / 10