Comment by webhamster

Does Hydra follow the OAuth Security BCP (https://tools.ietf.org/html/draft-ietf-oauth-security-topics...)? I do not see PKCE or mix-up mitigation mentioned, for example.