Hang on... So this means that when I check the token as per the guide at https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/#checkt

Hang on... So this means that when I check the token as per the guide at https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/#checktoken https://developers.facebook.com/docs/facebook-login/guides/a... , it returns the information regardless of the access_token parameter matching the app id or not? My assumption without reading the docs would have been that if the input_token was from another app, FB would refuse to debug it if the access_token was not associated with the app id. What's the point in asking for the access_token at all for that endpoint otherwise? Am I misunderstanding the bug? This feels like a foot gun that was happily handed over to a lot of people all this time.