Users with only the association bonus can answer protected questions on per-site metas

Question

A user on Photography has only 103 rep, and has the association bonus rights. So their rep without the association bonus is 3.

Yet they were able to post this answer to a protected question on the per-site meta. Reputation on per-site metas is shared with that on the main site.

At first I thought it's probably "internal meta rep", since I've earned the Mortarboard badge on a per-site meta for making a highly-voted post there. But this user has no other meta posts.

How were they able to answer a protected question without the necessary rep? Is the check not performed on meta sites? Or did the user exploit some flaw to allow them to post when it's ordinarily blocked?

Update: After some testing by Suvitruf, it appears users with the association bonus rights can answer protected questions, even though this is supposed to be prevented.

Answer 1

So, when you have the association bonus, we create this user history event called "association bonus granted" that is attached to your profile. The system determines you have the association bonus by looking up this specific history event, and then subtracts 100 reputation from your total reputation when considering whether you can bypass the protected question restriction.

However, because per-site metas do not have reputation, that history event isn't created on those profiles. Thus the 100 is never subtracted on meta sites, and anyone with the association bonus copied over to their meta profile can answer.

As far as "fixing" this - it requires creating that event on meta too when the profile is created. It's possible we could do that, but who knows what kinds of weird things that would break because it's not expected to occur on meta. Past that, we probably wouldn't even consider looking into it unless it's actually causing a problem somewhere, which isn't evident.

One key feature of this is that it lets users from other sites go discuss things that might be related to their site on another without having to participate on that site first, particularly in regards to migrations between sites. While those users shouldn't be able to bypass protection on the main site for the known reasons, meta is an entirely different beast and sometimes it makes sense to have that bypass. You don't always need experience on that particular site to participate in a discussion on meta.