Agreed, it’s great that session doesn’t require a phone number. But what channel do you use to share session IDs? I only use session to talk to people I can validate their identity face to face. You risk a MITM attack if you share the ID over an insecure channel.

How about not hard code this in the first place. If they are hell bent on this logic then let each instance admin list the instances they want to use?