Tokens, Not Passwords: How OAuth Became 2025's Biggest Attack Surface

A year-end look at the breaches, the standards fight, and the conceptual mistake underneath both. On September 2, 2025, Cloudflare published a blog post that opened with an unusual sentence for a secu