I've been considering doing something like this for my company, as some activities cannot be done on a web browser. My plan was that when the client is associat

I've been considering doing something like this for my company, as some activities cannot be done on a web browser. My plan was that when the client is associated with the server via OpenID Connect, a public key is transferred to the client. The server will then sign all commands with its public key and timestamp so the client knows they are genuine. (Can I get HN's opinion on this design please?) So, I don't think it's strictly necessary that when you find something like this it indicates some sort of vulnerability, although you are trusting the skill of third-party developers. That said, if this is a vulnerability I'd first try getting in touch with their security team. If you have discovered a vulnerability you should give them a fair chance to patch it first before reporting it further, as you might be giving bad guys ideas.