If I sell you shit and you happily eat it, but then 3 months later you're like "dude, why did you make me eat shit?". Idk.

seems kinda like the responsibility of the person building the application and managing your users' data to do your due diligence on where the keys to the kingdom go

but... on second thought it's crazy that okta even provides this lmao. It's different when you're a SaaS provider with a position of being secure compared to being an indie merc contractor. Hell, if I was an indie merc, I'd straight up just not do it out of principle.