Okay okay.

Just realized that you could brute-force list discovery by just trying to AUTH with any active npub.