nostr:npub1uvfvlddmhuh4hu4teupjs2lkdn8x3htrrw7jlwzuv0ushumkwnhqxjteda They already did one.

https://git.pleroma.social/pleroma/pleroma/-/commit/4099ddb3dc5840fa10cff743d87464acf7898a80

gonna guess this one's related to the frontend download/unzip feature, you could replace the captcha binary and call it through the api even if registration is disabled, so only cum.salon/btrfly would be affected