Why I run a disposable OAuth2 server for testing SSO — and the day it leaked a token

Aug 2, 2026