Authorization codes are stored as post meta on the client and are only ever removed when successfully exchanged or explicitly invalidated (e.g. a failed PKCE check, see #1). A code nobody redeems — abandoned flow, code the user never used — sits in post meta forever. Not a security issue on its own, but unbounded growth on every active client.
Needs a scheduled cleanup (e.g. WP-Cron) that deletes `oauth2_authcode*` meta past its expiration.
Authorization codes are stored as post meta on the client and are only ever removed when successfully exchanged or explicitly invalidated (e.g. a failed PKCE check, see #1). A code nobody redeems — abandoned flow, code the user never used — sits in post meta forever. Not a security issue on its own, but unbounded growth on every active client.
Needs a scheduled cleanup (e.g. WP-Cron) that deletes `oauth2_authcode*` meta past its expiration.