If you shipped a single-page application before 2024, your OAuth implementation is probably insecure. Not "theoretically vulnerable" insecure — actually exploitable insecure.

The Implicit Grant flow that every React tutorial taught you to use? Removed in OAuth 2.1. The Resource Owner Password Credentials (ROPC) flow your mobile app relies on?...