you just raised another problem haha. response_type. it's also flexible. Even if app 99.99% of time uses response_type=code someday hacker comes and usues toke

you just raised another problem haha. response_type. it's also flexible. Even if app 99.99% of time uses response_type=code someday hacker comes and usues token on hacked redirect_uri. simply speaking response_type is also should be static and constant. But, gosh, let's fix first-world-problem first