Once upon a time they could perform all sorts of admin-level actions. One of my friends was there back in the day and said you could literally delete someone's account or use the built-in impersonation to see someone else's DMs. Another thing they could do back then was leak PII of specific accounts. I think it was the Saudis who paid someone to get someone's name. A friend of mine was part of the FBI team that caught one of those spies.

Insider risk is hard as heck.

There was a case in 2017 of a Twitter employee who deleted Donald Trump’s account for 11 minutes.

In 2020 hackers who gained access to Twitter admin tools that were - at the time - apparently accessible to thousands of employees were able to use that access to compromise multiple verified (blue check) Twitter accounts including Jeff Bezos, Barack Obama and Bill Gates. They used it to promote a lame Bitcoin scam.

In the aftermath of that things were supposedly tightened up a little but don’t doubt a Twitter employee could do some damage.

Create a repo for sharing the algorithm!

Twitter has a history with this.

- Rogue Twitter Employee Briefly Shuts Down Trump's Account [0]

[0] https://www.nytimes.com/2017/11/02/us/politics/trump-twitter...

look up confidential user information for the saudi government?