This assumes it was by design, likely someone unfamiliar with the security impli...

OJFord · on Jan 11, 2021

Or just oversight, could actually be embarrassingly easy to mess up:

    if not twilio_authenticate(user, pass):
        return Err()

    return User(user)

and:

    def twilio_authenticate(user, pass):
        try:
            return twilio.verify(user)
        except:
            return False

Might independently look reasonable enough.