Radically Open Security audited happyDomain. Six issues came out of it. Here is what they are, what we fixed, and what comes next.

A few days ago, Anthropic published the details of a collaboration with Mozilla in which Claude Opus 4.6 found 22 vulnerabilities in Firefox over two weeks, 14 of them rated high-severity by Mozilla, accounting for nearly a fifth of all high-severity Firefox fixes in 2025.
The result was striking enough that we wanted to try the same thing on happyDomain.

The scope we chose: authentication, session management, and the OIDC/OAuth2 flow.
Three areas where mistakes tend to be subtle, where the consequences of getting them wrong are serious, and where a fresh pair of eyes (even a synthetic one) can catch things that familiarity makes invisible.