> The best solution is to aggressively log errors Until one day you find some random dev is logging failed authentication attempts and including the email and

> The best solution is to aggressively log errors Until one day you find some random dev is logging failed authentication attempts and including the email and password in the logs… (and the most amusing part of that incident was tracing down the offender by finding the earliest of those particular log lines, and getting his real email address password out of them… “Hey Phil, what’s ‘Dragons87!’?” “Ummm, what? That’s, errr, my gsuite password. How did you know?”)