The Dragonfly Manager exposes "GET /api/v1/oauth" and "GET /api/v1/oauth/:id" to unauthenticated clients. The response body deserializes the entire "manager/models.Oauth" struct, which includes the "client_secret" field. Any network-reachable attacker can read the OAuth client secrets configured for "github" or "google" providers, defeating the confidentiality guarantee of those secrets and enabling subsequent abuse against the connected identity providers.