Hookmap

OAuth redirect_uri courtroom that finishes the job — open redirects · localhost · takeover-ish hosts · IOC/IT pack

Passive parse Optional HTTPS landing skim Synthetic demos

Paste the IdP registered allow-list and the URIs you actually observed. The product is the keep/add/remove/reject diff plus a recommended list that drops localhost, literal IP, and host-mismatch URIs.

Hookmap is not security advice. Passive redirect_uri analysis + defensive allow-list guidance only — not an auth bypass or exploit tool.