Comment by danielrmay

"It pretended to be the official client" is not a security argument if the mechanism was client-supplied metadata.

That’s not impersonation. That’s Bambu discovering that user agents are not authentication.