Audit how my app uses OAuth providers (Google, GitHub, Facebook, or any other sign-in/integration provider) and tighten scopes and token handling. 1. Scopes: list every scope my app requests from each provider. For each one, identify what my code actually uses it for. Remove scopes I do not need, especially write access, contacts, calendar, or repo access when I only need sign-in identity. If a feature needs an elevated scope, request it incrementally at the moment the feature is used, not at initial login. 2. Tokens: find where provider access tokens and refresh tokens are stored. They should never reach the browser, never sit in localStorage, and never be logged. If I store them server-side for API calls, encrypt them at rest and make sure they are excluded from API responses and serialization. 3. Expiry and revocation: make sure my app handles expired provider tokens gracefully (refresh or prompt re-auth instead of a broken screen) and that disconnecting an account revokes the provider token where the provider supports it. 4. State and nonce: confirm my OAuth flow validates the state parameter on callback to prevent CSRF on login. Do not break existing sign-in for current users. Do not remove a scope without telling me what feature, if any, depends on it. Give me a table: provider, scopes before, scopes after, what each remaining scope is for, and where each token is stored.