IT

InstaTunnel Team

Published by our engineering team

The OAuth Tunnel Trap: Preventing Subdomain Hijacking in Local Development

Your local tunnel is closed, but your OAuth redirect is still active. Here’s how attackers hijack free-tier tunnel subdomains to steal authorization codes — and how to lock down your local auth flows before they do.