Audit my social login (OAuth) flow end to end. Look at how login with Google/GitHub/etc. is initiated, how the callback is handled, and how the resulting account is linked. Verify each of these: a state parameter is generated per attempt, stored server-side or in a signed cookie, and validated on callback (missing state validation is the classic OAuth CSRF, letting an attacker link their social account to a victim's session); the redirect URI is exact-match validated against the registered value, not a prefix; authorization codes are exchanged server-side only, and tokens are never exposed to the browser beyond what's needed; account linking is deliberate (if an existing account has the same email, decide explicitly whether to auto-link, and if you do, only when the provider verified that email); and the scopes requested are the minimum the app needs. Do not change which providers are offered or the visual login flow. Use the established OAuth library already in the project rather than hand-rolling the exchange. Deliver a findings list with each fix applied, plus a test plan: complete a normal social login, attempt a callback with a mismatched state and confirm rejection, and sign in with a social account whose email matches an existing password account to confirm the linking behavior is what you intended.