OAuth integration tests often look harmless: create a user, authorize an application, receive a callback, and assert that the session exists. It is the test fixture that quietly crosses a trust boundary.

An old inbox, a shared client secret, or a callback URL copied from staging can turn a convenient test into a source of leaked identity data. This is especially easy to miss when a team uses a disposable address or tries to get temporary email for a fast setup, then lets that address live longer than the test run.

The hidden trust boundary in an OAuth test

An OAuth test involves more parties than its assertions suggest:

The application under test.

The authorization server, or a realistic test double.

The browser or automation runner.

The mailbox that receives verification or recovery messages.

The CI system that stores logs and artifacts.

Each party can see a different slice of the identity. A fixture is safe only when the slices are intentionally scoped to one run.…