Melanie Kat reports that AT Protocol RSS app Skyreader stores subscription URLs as public records, exposing access to some paid and private feeds. The researcher retrieved more than 1,300 subscription URLs without authentication and observed public messages in some chat apps. These are the author’s observations, not evidence that every AT Protocol app or private message is exposed. Official documentation describes a personal repository as data published and signed by its user. The word personal does not guarantee confidentiality, so check what an app publishes before adding feed URLs that contain access tokens.