The OAuth device flow trusted-client list still includes a test app and users can bypass the normal consent review

The production app is locked down, yet the device flow stays open because an old trusted client registration survived the environment cleanup.