Bind login challenges to the challenge value the client used (not "latest row wins") so cross-session challenge confusion and login DoS are no longer possible. Burn challenges on any verify attempt, not just success. Reject passkey counter regressions to catch cloned authenticators. Wrap invite consumption + user/credential creation in a transaction so a raced invite rolls back cleanly instead of leaving an orphaned account with a working session. Re-validate redirect_uri against the app's registered list in the consent POST (the GET path already did this) so attackers can't mint authorization codes bound to arbitrary redirect URIs. Escape appName in error-page hints (stored XSS via attacker-controlled client_name) and use URLSearchParams for success/deny redirects so the state parameter can't inject extra query params. 💘 Generated with Crush Assisted-by: Crush:kimi-k3