[jkrems]

Read the API docs, only reading DMs needs a special permission, POST direct message only needs the permissions that writing a "normal" tweet would. There's no bug here. Maybe a confusing security model, but no bug.