That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems.

I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.