Hey HN! Thanks for checking this out! Sorry for the crazy permissions requirements, unfortunately I don't think there's any way around them. I also don't think there's anything I can do to assuage a highly skeptical person that I'm not a bad actor. But the code is here for anyone interested enough to look at it: https://github.com/willcosgrove/retweet-rip

The app also does not save the access tokens it gets back from twitter. They get thrown in a background job to be worked on, and once the job is done the access tokens are forgotten.