Please report security issues privately to the project maintainers. Do not open a public issue with exploit details.

Never include authorization codes, OAuth state, access tokens, refresh tokens, or deployment secrets in a report. The public OAuth client ID and registered redirect URI are not secrets.