I wasn’t criticizing the guide — just pointing out real OAuth2 pitfalls that still affect users. The spec itself made mistakes: • Silent account hijack via “C

I wasn’t criticizing the guide — just pointing out real OAuth2 pitfalls that still affect users. The spec itself made mistakes: • Silent account hijack via “Connect this provider.” • Redirect leaks of code (via Referrer) or access_token (via #hash). • CSRF because state was optional and often ignored. The point is: these aren’t obscure edge cases, they’re structural issues baked into the protocol.