Before launch, verify HTTPS, a unique secret, exact Google redirect URIs, strong password hashing and rate limiting in the backend, generic login errors, minimal session fields, server-side authorization for every protected resource, safe redirect handling, deliberate account-linking rules, patched dependencies, and safe logging. Do not expose provider secrets, passwords, session cookies, or unnecessary OAuth tokens.