As far as I can gather the issue was autopopulating the funding source for lnbits by alby, and Francis enabling lnbits but not setting up from lnbits launch page? We didn't autopopulate the funding source, alby did. We can add an extra safeguard to help albys flow, by disabling the setup page after x mins, but using lnbits this way by a service like alby, is not something we do or account for. I'm not playing the blame game, but its a vulnerability not created by us. We can try safeguarding it, but any service that alby autopopulates should be monitored by alby and disabled if not set up correctly.
As far as I understand the issue.