Hacker News Reader

Hundreds of thousands of tests? That sounds like quantity > quality or outright llm-generated ones, who even maintains them?

This was before LLMs. It was a combination of unit and end-to-end tests and tests written to comprehensively test every combination of parameters (eg test this security property holds for every single JWT algorithm we support etc). Also bear in mind that the product did a lot more than just OAuth.

The times I've been involved with implementations it's been really horrible.

Oauth is so annoying, there is so much niche to it.

Honestly, new code always has bugs though. That’s pretty much a guarantee—especially if it’s somewhat complex.

That’s why companies go for things that are “battle tested” like vibe coding. ;)

Joke aside—I like how Anthropic is using their own product in a pragmatic fashion. I’m wondering if they’ll use it for their MCP authentication API.