The login prompt feels simple. Enter credentials, click authorize. But behind it, Oauth scopes decide everything—what the app can touch, what it cannot, and how deeply it can dig into your data. In a self-hosted instance, those scopes are both your armor and your attack surface. Mismanage them, and