`didbot confirm <url> --as <did>` hands the daemon the page a client printed. The daemon fetches only the authorize endpoint this deployment publishes, follows only a loopback redirect, and confirms as the account it was given. Nothing checks the caller is that account: the type says so, and says what closing it would take. Askers are counted separately, so a second plugin on the same events is answered rather than met with silence. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>