@homegrown It might also be fetching posts from a public api endpoint. It would be a good idea for masto admins to disable "Allow unauthenticated access to public timelines" in "/admin/settings/discovery"