#browser detect suspicious

OAuth attacks grant persistent access without stealing credentials. Push operates inside the browser to detect suspicious consent flows before access is granted.