This question keeps coming up:


"My Gmail OAuth client_id got leaked. Is the system compromised?"


Short answer: client_id was never a secret. What you actually need to protect is the token, the client_secret (if your flow uses one), and the overall authorization exchange boundary.

This matters more in a self-host Actor scenario, because you...