A dashboard app that mishandles its access token in several ways. Log in, then go hunting: browser dev tools (Application > Cookies / Storage, Network), the URL bar, and logs/token-leak.log on the host.
logs/token-leak.log