Tine

The habit of running the production build locally is the one that pays for itself repeatedly, well beyond this error.

Development and production differ in bundling, tree shaking, environment variables, runtime selection and error handling. A meaningful fraction of "works locally, breaks deployed" is really "works in development mode, breaks in production mode", and that has nothing to do with the deployment platform at all.

Building and starting locally takes a minute and turns a deploy-and-wait loop into an immediate one. Worth adding as a script so it is one command.

The advice not to key accounts on email deserves a real example of why.

If you match an incoming social identity to an existing account by email, and a provider returns an email address it has not verified, then anybody who can get a provider account with a given address can sign in as that user. That is a genuine account takeover path and it has been exploited in real products.

So: match on the provider's subject identifier. If you want to link by email — for the legitimate case where the same person signs in a second way — require verification on your side, or ask the user to confirm while signed in with the original method.

The cost of the safe version is one extra screen. The cost of the unsafe one is unbounded.