Reviews "Sign in with Google, Microsoft, Apple, GitHub, Okta, Auth0, Cognito or Firebase" code and the API code that checks its tokens before you merge: can someone sign in as a user they are not, and can a genuine login be stolen. Catches tokens decoded but not verified, unpinned algorithms, missing issuer, audience, expiry or nonce checks, any-tenant acceptance, users keyed on email or other mutable claims, account linking on unverified email, missing state or PKCE, loose redirect URIs and open redirects after login, then gives the smallest code that closes each path and what to check if it is already live.