How I Found a postMessage Origin Bypass in an OAuth SDK

I spend a lot of time reading other people's code. Not because I enjoy it—though honestly, I kind of...