🎣 Consent-phishing defense

This is a SELF-CONTAINED simulation, not the Lab's real OIDC consent flow (that lives on the demo app and your own account's Connected apps). Here you play both sides: compose a fictitious client's request below, then read exactly what a transparent consent screen would show you — per-scope sensitivity, every risk signal with its reason, and an overall risk level — BEFORE deciding whether to grant it.

Every app you've granted, with the risk you were shown at the time. Revoke anything you don't recognize — the same hygiene the real Connected-apps screen on your account page teaches.

Nothing granted yet.

The defenses, all real

• Scope transparency + risk assessment — every scope's sensitivity and every fired signal is shown, with a plain-English reason. Never a black box.
• Publisher verification — an unverified client asking for anything beyond bare profile data is THE central phishing red flag (unverified_publisher_sensitive), and alone pushes the risk to high.
• Least-privilege awareness — over_broad and write_or_admin flag requests asking for more (or more dangerous) access than a single-purpose app plausibly needs.
• Revocable grants — every decision is recorded with the risk you were shown, and you can revoke access at any time from "Connected apps" above.