If you configure a prod client with a wildcard redirect uri that's your fault. It has nothing to do with Keycloak. If you configure a dev client with one, the

If you configure a prod client with a wildcard redirect uri that's your fault. It has nothing to do with Keycloak. If you configure a dev client with one, the prod backend won't accept this client. So this is rather, "don't be stupid", than keycloak bad