[mooreds]

They still used basic auth across all their apps?

[shadowbanned4]

No. They used Oauth. I wrote their entire Oauth system. And it was a nightmare reading through Oauth/OIDC specs for something that could be handled trivially with http basic auth.