OAuth Test Tenants Need Email Trust Boundaries
OAuth tests often stop at the redirect. That misses an important part of the trust story: what happens when a user must prove control of an email address before the authorization flow is considered complete? The email is not just…