posts/oauth-scope-upgrade

[giscus[bot]]

posts/oauth-scope-upgrade

This write-up describes an OAuth flow vulnerability in Todoist where a malicious third-party app could trick users into granting higher privileges than displayed on the consent screen.

http://localhost:4321/posts/oauth-scope-upgrade

[mpaujan21]

great!

[stelcodes]

Hey @mpaujan21 just a heads up, I've added a giscus.json file at the root of this repository to restrict the origins that can use this repo's discussions to only https://multiterm.stelclementine.com. Giscus is designed to require a unique repo per each website. Make sure to enable Giscus for one of your own repositories and update your project's giscus.json with your own URL.