Mitigated potential vulnerability with Google logins

Earlier today, we were contacted by a security researcher to inform us of a potential vulnerability in our 'Sign in with Google' feature.

This flaw could allow an attacker to hijack the OAuth login process by opening our login page in a controlled environment, redirecting users to the attacker's own OAuth application instead of ours.

This effectively made customers more easily exposed to a phishing-style attack; however, we don't believe anyone has ever attempted to exploit this.

We have now added extra security headers to our server configuration that close this loophole, specifically the Cross-Origin Opener Policy header.

If you have any additional questions, please don't hesitate to let us know.