Well, it’s possible to self-host. Someone offered they will create a docker image for it.

Note that with OAuth nothing much will change - the app will still have access to the JWT token which is used to impersonate you. And that I don’t do anything with the password you can see already in the source code:

• Here’s the login controller
• Here’s the authenticator that intercepts the http request when logging in
• The authenticator passes the password to API factory
• The factory passes it to the api library
• That finally passes it to the http request against Lemmy api and that’s pretty much it (the http uses Symfony, a very respectable and widely used framework)
• Nowhere else is the password used