# oauth_prescan report

files scanned: 2 — findings: 12

## HIGH
- `OAUTH-SECRET-LITERAL` hostile.js:6 — client/app secret is an inline literal (weak/<16 chars) — ships in source and bundles
- `OAUTH-STATE-UNCHECKED` hostile.js:22 — callback reads 'code' but 'state' appears nowhere in this file — nothing binds the flow to the browser that started it (login CSRF)
- `OAUTH-REDIRECT-REQ` hostile.js:32 — redirect_uri built from request input — the provider sends the authorization code wherever pointed
## MEDIUM
- `OAUTH-SECRET-LITERAL` hostile.js:7 — client/app secret is an inline literal — ships in source, images and bundle maps
- `OAUTH-STATE-MISSING` hostile.js:11 — authorize URL built without a 'state' parameter — login CSRF; state binds the callback to the initiating browser
- `OAUTH-IMPLICIT-FLOW` hostile.js:18 — implicit response_type (token / id_token) — access tokens land in the URL fragment; use auth-code + PKCE
- `OAUTH-GRANT-PASSWORD` hostile.js:25 — password grant 'grant_type=password' — ROPC is deprecated and hands user credentials to the client
- `OAUTH-REDIRECT-LOOSE` hostile.js:39 — redirect_uri compared with startswith/substring instead of exact match — allowed.com.evil.com passes
- `OAUTH-INSECURE-HTTP` hostile.js:48 — http:// in an oauth context (endpoint/redirect) — codes and tokens cross the wire in cleartext
- `OAUTH-INSECURE-HTTP` hostile.js:49 — http:// in an oauth context (endpoint/redirect) — codes and tokens cross the wire in cleartext
## LOW
- `OAUTH-PKCE-MISSING` hostile.js:13 — auth-code flow built with no code_challenge / pkce anywhere in file — public clients require PKCE, confidential clients should still use it
- `OAUTH-TOKEN-QUERY` hostile.js:44 — bearer token read from the URL query — tokens land in access logs, history and referer headers