OAuth token exposure

An ad-blocking Twitch extension appends 30,000 users' account tokens to a proxy URL

Socket's threat researchers found that Twitch Enhanced Viewer sends each viewer's account-scoped OAuth token to a Russian bot vendor's proxies as a query parameter, on a redirect the extension's own code shows works without it.