Chain links
| L1 | CORS reflection on authorize 302 | … |
| L2 | .sq.auth2 SameSite=None; Secure | … |
| L3 | Session-bearing authorize → 302 + code | … |
| L4 | Attacker origin reads the code | … |
| L5 | Code → token, no secret / no PKCE | … |
| L6 | Token reads API data | … |
| L1 | CORS reflection on authorize 302 | … |
| L2 | .sq.auth2 SameSite=None; Secure | … |
| L3 | Session-bearing authorize → 302 + code | … |
| L4 | Attacker origin reads the code | … |
| L5 | Code → token, no secret / no PKCE | … |
| L6 | Token reads API data | … |