OAuth tests often look safe because they run in a staging environment. The risk is that a test email, a callback URL, and an application account can become one uncontrolled identity. If those pieces are reused between runs, a test can pass for the wrong reason or expose a token that was meant for somebody else.

The useful boundary is simple: treat the mailbox as an untrusted external actor, even when your team owns it. OAuth should prove that the callback belongs to the right flow, and the test should prove that the right account received the right message. Those are related checks, but they are not the same check.

The trust boundary in an OAuth email test

A typical test creates a user, starts an authorization request, follows a callback, and checks an email or account state.…