OAuth Surface - check your OAuth provider before an app leaks a token

Check a platform's OAuth provider so a compromised app or a leaked token stays contained, then write the provider core and the app review program. Free in your browser: the grants (or your discovery document) checked for implicit and password, PKCE S256 for every client, exact redirect matching with a redirect tester, code, access and refresh token lifetimes, refresh rotation and its grace window, every scope linted for catch-alls, read/write splits, consent copy and token binding and put in a review tier, the refresh, scope and registration choices ranked from a short interview, plus a discovery document and a PKCE pair. A metered run writes the provider core, or the registration and verification program. Built on the SkillSafe skill @samber/oauth2-provider-design, from samber/developer-platform-skills (MIT), by Samuel Berthe.