Enforce Create and object recipient match
If I post to /inbox with valid HTTP signature an activity with to:["…#Public"]
cc:[]
containing an object that doesn't have any to
or cc
at all, it gets thrown into the federated timeline while being marked as direct message.
Edited by lain